last executing test programs: 8m34.162931748s ago: executing program 0 (id=76): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x1, 0x9}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r4, 0x2, 0x1000000000000) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 8m17.590046482s ago: executing program 0 (id=78): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)}, 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000340), 0x108141, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r8, 0x4, 0x220) r11 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@hvc={0x32, 0x40, {0xcab80f5d974c52d9, [0x4, 0x54c2, 0x7, 0xffffffff]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) syz_kvm_vgic_v3_setup(r4, 0x3, 0xa0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) (async, rerun: 64) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x6, 0x0, &(0x7f0000000240)=0x5}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000200)=@attr_other={0x0, 0x80000001, 0x4, &(0x7f00000002c0)=0x2}) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000280)=@attr_arm64={0x0, 0x8, 0x88, &(0x7f0000000040)=0x1}) 8m7.999980863s ago: executing program 1 (id=79): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000280)=0x400000080a00ed}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r6 = ioctl$KVM_CREATE_VM(r5, 0x894c, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xb704, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xeeee0000, 0x1000, &(0x7f0000fd1000/0x1000)=nil}) r11 = syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x1, 0x140) ioctl$KVM_HAS_DEVICE_ATTR(r11, 0x4018aee3, &(0x7f0000000180)=@attr_other={0x0, 0x10000, 0x2, &(0x7f0000000140)=0x5}) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f00000000c0)={0x1ff, 0x0, 0x6000, 0x1000, &(0x7f0000ec2000/0x1000)=nil}) r12 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r12, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000040)={0x1}) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000100)={0x1ff, 0x0, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) 8m2.056237378s ago: executing program 0 (id=80): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, 0xfffffffffffffffe) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000240)={0x1fe, 0x3, 0xffff1000, 0x1000, &(0x7f00004bf000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f00000000c0)={0x2, 0x3, 0x100000, 0x2000, &(0x7f000000f000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000200)={0x1fd, 0x0, 0xeeee0000, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) ioctl$KVM_CAP_ARM_SYSTEM_SUSPEND(r5, 0x4068aea3, &(0x7f0000000280)) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r6, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) r7 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, &(0x7f0000000380)=[@its_setup={0x82, 0x28, {0x2, 0x2, 0x7c}}], 0x28}, 0x0, 0x0) r9 = syz_kvm_vgic_v3_setup(r3, 0xffffffffffbffffc, 0x120) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000180)={0x8}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x3, 0x20000f8, &(0x7f0000000100)=0x2c40}) 7m54.461981933s ago: executing program 1 (id=81): ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000000)={0x76dc8650, 0x4}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x6) syz_kvm_setup_cpu$arm64(r2, r3, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x58}], 0x1, 0x0, 0x0, 0xa) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100026, &(0x7f0000000000)=0x10}) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r4 = ioctl$KVM_CREATE_VM(r0, 0x40086602, 0x20000000) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xc0045878, 0x20000000) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f00000000c0)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) (async) ioctl$KVM_CREATE_DEVICE(r7, 0xc018aec0, &(0x7f00000000c0)={0x1}) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r4, 0x4068aea3, &(0x7f00000000c0)) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x300, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r11 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r12, 0x4068aea3, &(0x7f0000000000)={0xef, 0x0, 0x7}) (async) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000bff000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@mrs={0xbe, 0x18, {0x603000000013c807}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) (async) close(r12) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x28) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x21) 7m50.051631136s ago: executing program 0 (id=82): r0 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000027000/0x13000)=nil, 0x930, 0x3, 0x110, 0xffffffffffffffff, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x22200, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r2 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, r1, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x1, 0x2, 0x0}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, r7, 0x3000002, 0x8a031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 7m43.55765265s ago: executing program 0 (id=83): mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x2, 0x23ac5f9b426ec4b2, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r2, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c61000/0x3000)=nil, 0x930, 0x100000f, 0x4019032, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x0, 0x1}}) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x0, 0x1000001, 0xdc032, 0xffffffffffffffff, 0x0) 7m40.304318488s ago: executing program 1 (id=84): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x40000004}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x180) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) openat$kvm(0x0, 0x0, 0x72483, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r6, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, 0x0) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xdddd1000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r7, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000ffb000/0x3000)=nil}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 7m37.200178315s ago: executing program 0 (id=85): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r2, 0x400454ca, 0xd8ffffffffff0f00) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x4, 0xffffffffffffffff, 0x1}) (rerun: 64) ioctl$KVM_HAS_DEVICE_ATTR(r4, 0x4018aee3, &(0x7f0000000140)=@attr_arm64={0x0, 0x1, 0x3, &(0x7f0000000100)=0x52522ff6}) (async) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async, rerun: 64) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x32) (rerun: 64) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@msr={0x14, 0x20, {0x603000000013e7fc, 0x8000}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 7m27.948003871s ago: executing program 1 (id=86): mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000) munmap(&(0x7f0000e76000/0x12000)=nil, 0x12000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x17) ioctl$KVM_GET_DIRTY_LOG(r0, 0x4010ae42, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000594000/0x2000)=nil}) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f000064b000/0x4000)=nil, r2, 0x100000d, 0x9032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000667000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 7m14.463592015s ago: executing program 1 (id=87): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x410800, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) (async, rerun: 64) mmap$KVM_VCPU(&(0x7f0000027000/0x13000)=nil, 0x930, 0x3, 0x4102932, 0xffffffffffffffff, 0x0) (async, rerun: 64) openat$kvm(0x0, &(0x7f0000000040), 0x22200, 0x0) (async) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r3 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, r2, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, r5, 0x3000002, 0x8a031, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async, rerun: 32) r10 = syz_kvm_vgic_v3_setup(r8, 0x3, 0xa0) (rerun: 32) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000100)=@attr_other={0x0, 0x9, 0x7, &(0x7f0000000180)=0x7}) (async) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x1000000) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) (async) r11 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r12, 0x8933, 0x110e227ffe) (async) syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x3, 0x10000, 0x0, 0x6, 0x2}}], 0x50}, 0x0, 0x0) 7m10.259613242s ago: executing program 1 (id=88): mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, &(0x7f0000000000)={0x3, 0x22}) r0 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x1, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r4, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000cfb000/0x1000)=nil, r4, 0x8, 0x20010, 0xffffffffffffffff, 0x0) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x80001, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x100, &(0x7f0000000080)=0x8000000000000000}) (rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) (async, rerun: 64) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) (async) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f00000000c0)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) (async, rerun: 32) ioctl$KVM_CREATE_DEVICE(r11, 0xc018aec0, &(0x7f00000000c0)={0x1}) (async, rerun: 32) syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x1}}], 0x28}, 0x0, 0x0) (async, rerun: 32) syz_kvm_vgic_v3_setup(r8, 0x4, 0x220) (async, rerun: 32) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) 6m51.190381873s ago: executing program 32 (id=85): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r2, 0x400454ca, 0xd8ffffffffff0f00) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 64) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x4, 0xffffffffffffffff, 0x1}) (rerun: 64) ioctl$KVM_HAS_DEVICE_ATTR(r4, 0x4018aee3, &(0x7f0000000140)=@attr_arm64={0x0, 0x1, 0x3, &(0x7f0000000100)=0x52522ff6}) (async) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async, rerun: 64) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x32) (rerun: 64) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@msr={0x14, 0x20, {0x603000000013e7fc, 0x8000}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 6m22.840356821s ago: executing program 33 (id=88): mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, &(0x7f0000000000)={0x3, 0x22}) r0 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x1, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r4, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000cfb000/0x1000)=nil, r4, 0x8, 0x20010, 0xffffffffffffffff, 0x0) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x80001, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x100, &(0x7f0000000080)=0x8000000000000000}) (rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) (async, rerun: 64) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) (async) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f00000000c0)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) (async, rerun: 32) ioctl$KVM_CREATE_DEVICE(r11, 0xc018aec0, &(0x7f00000000c0)={0x1}) (async, rerun: 32) syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x1}}], 0x28}, 0x0, 0x0) (async, rerun: 32) syz_kvm_vgic_v3_setup(r8, 0x4, 0x220) (async, rerun: 32) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) 1m2.947184073s ago: executing program 2 (id=89): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x37) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x200) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x20}], 0x1, 0x0, 0x0, 0xfffffffffffffee3) openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, r5, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000027000/0x13000)=nil, 0x930, 0x3, 0x4102932, 0xffffffffffffffff, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x200000, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f00000002c0)={0x2, 0x4, 0x7000, 0x1000, &(0x7f0000d12000/0x1000)=nil, 0xff80000}) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) r8 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r9 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r8, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f0000000100)="fb0149dd033be3ac2cc4a29ea6af8031d1dfd900080001000000315f9731c10d097fd66f8f1f44f9ffffffffffffffebb207000000000000000000002a2900", 0x0, 0x48) r10 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x3000006, 0x20010, r10, 0x0) ioctl$KVM_SET_ONE_REG(r10, 0x4010aeac, &(0x7f00000001c0)=@riscv64_config={0x8030000000100001, &(0x7f0000000180)=0x3000000000000000}) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) 12.712261584s ago: executing program 34 (id=89): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x37) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x200) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x20}], 0x1, 0x0, 0x0, 0xfffffffffffffee3) openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, r5, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000027000/0x13000)=nil, 0x930, 0x3, 0x4102932, 0xffffffffffffffff, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x200000, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f00000002c0)={0x2, 0x4, 0x7000, 0x1000, &(0x7f0000d12000/0x1000)=nil, 0xff80000}) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) r8 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r9 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r8, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f0000000100)="fb0149dd033be3ac2cc4a29ea6af8031d1dfd900080001000000315f9731c10d097fd66f8f1f44f9ffffffffffffffebb207000000000000000000002a2900", 0x0, 0x48) r10 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x3000006, 0x20010, r10, 0x0) ioctl$KVM_SET_ONE_REG(r10, 0x4010aeac, &(0x7f00000001c0)=@riscv64_config={0x8030000000100001, &(0x7f0000000180)=0x3000000000000000}) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) 0s ago: executing program 3 (id=90): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f00000002c0)=@arm64_sys={0x603000000013df61, &(0x7f00000001c0)=0x10000008}) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013dce0, &(0x7f0000000000)=0x43ff}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x9) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000100)={0x0, &(0x7f0000000680)=[@its_setup={0x82, 0x28, {0x3, 0x0, 0x16f}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x2, 0x8, 0x8, 0x100}}], 0x50}, 0x0, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x2e) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000140)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r8, 0x4010aeab, &(0x7f0000000080)=@arm64_core={0x6030000000100004, &(0x7f0000000100)=0x7ffffffd}) syz_kvm_vgic_v3_setup(r4, 0x44, 0x220) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8}) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x80001, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x2e) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x10000, 0x3, 0x40000004}}], 0x50}, 0x0, 0x0) r12 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) kernel console output (not intermixed with test programs): [ 391.940096][ T25] audit: type=1400 audit(391.160:60): avc: denied { read } for pid=3169 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 410.144739][ T3169] 8021q: adding VLAN 0 to HW filter on device bond0 [ 463.075349][ T3169] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:43782' (ED25519) to the list of known hosts. [ 624.832941][ T25] audit: type=1400 audit(624.060:61): avc: denied { name_bind } for pid=3322 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 625.969117][ T25] audit: type=1400 audit(625.190:62): avc: denied { execute } for pid=3323 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 625.996305][ T25] audit: type=1400 audit(625.220:63): avc: denied { execute_no_trans } for pid=3323 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 657.050786][ T25] audit: type=1400 audit(656.270:64): avc: denied { mounton } for pid=3323 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 657.110908][ T25] audit: type=1400 audit(656.330:65): avc: denied { mount } for pid=3323 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 657.201287][ T3323] cgroup: Unknown subsys name 'net' [ 657.283310][ T25] audit: type=1400 audit(656.510:66): avc: denied { unmount } for pid=3323 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 657.769000][ T3323] cgroup: Unknown subsys name 'cpuset' [ 657.902326][ T3323] cgroup: Unknown subsys name 'rlimit' [ 658.888960][ T25] audit: type=1400 audit(658.100:67): avc: denied { setattr } for pid=3323 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 658.896402][ T25] audit: type=1400 audit(658.110:68): avc: denied { mounton } for pid=3323 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 658.922952][ T25] audit: type=1400 audit(658.150:69): avc: denied { mount } for pid=3323 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 659.983769][ T3327] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 660.004885][ T25] audit: type=1400 audit(659.230:70): avc: denied { relabelto } for pid=3327 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 660.032066][ T25] audit: type=1400 audit(659.260:71): avc: denied { write } for pid=3327 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 660.221834][ T25] audit: type=1400 audit(659.440:72): avc: denied { read } for pid=3323 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 660.245909][ T25] audit: type=1400 audit(659.460:73): avc: denied { open } for pid=3323 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 660.292808][ T3323] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 718.014130][ T25] audit: type=1400 audit(717.240:74): avc: denied { execmem } for pid=3328 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 721.885912][ T25] audit: type=1400 audit(721.110:75): avc: denied { read } for pid=3330 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 721.913818][ T25] audit: type=1400 audit(721.140:76): avc: denied { open } for pid=3330 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 721.999618][ T25] audit: type=1400 audit(721.220:77): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 722.264148][ T25] audit: type=1400 audit(721.490:78): avc: denied { module_request } for pid=3330 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 722.276218][ T25] audit: type=1400 audit(721.500:79): avc: denied { module_request } for pid=3331 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 723.292787][ T25] audit: type=1400 audit(722.510:80): avc: denied { sys_module } for pid=3331 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 746.619137][ T3331] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 747.004811][ T3331] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 747.121377][ T3330] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 747.625347][ T3330] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 761.525673][ T3331] hsr_slave_0: entered promiscuous mode [ 761.588634][ T3331] hsr_slave_1: entered promiscuous mode [ 763.326387][ T3330] hsr_slave_0: entered promiscuous mode [ 763.389046][ T3330] hsr_slave_1: entered promiscuous mode [ 763.430715][ T3330] debugfs: 'hsr0' already exists in 'hsr' [ 763.438907][ T3330] Cannot create hsr debugfs directory [ 771.790087][ T25] audit: type=1400 audit(770.980:81): avc: denied { create } for pid=3331 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 771.850952][ T25] audit: type=1400 audit(771.010:82): avc: denied { write } for pid=3331 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 771.901611][ T25] audit: type=1400 audit(771.120:83): avc: denied { read } for pid=3331 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 772.160387][ T3331] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 772.541625][ T3331] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 772.806763][ T3331] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 773.126232][ T3331] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 774.756310][ T3330] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 775.019924][ T3330] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 775.263931][ T3330] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 775.510796][ T3330] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 787.950691][ T3331] 8021q: adding VLAN 0 to HW filter on device bond0 [ 790.787248][ T3330] 8021q: adding VLAN 0 to HW filter on device bond0 [ 851.802673][ T3331] veth0_vlan: entered promiscuous mode [ 852.284496][ T3331] veth1_vlan: entered promiscuous mode [ 854.391997][ T3330] veth0_vlan: entered promiscuous mode [ 854.963043][ T3331] veth0_macvtap: entered promiscuous mode [ 855.437280][ T3330] veth1_vlan: entered promiscuous mode [ 855.541531][ T3331] veth1_macvtap: entered promiscuous mode [ 857.875483][ T3330] veth0_macvtap: entered promiscuous mode [ 858.512632][ T3384] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.641323][ T3330] veth1_macvtap: entered promiscuous mode [ 858.714593][ T3384] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.731362][ T3384] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 858.735821][ T3384] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.256237][ T25] audit: type=1400 audit(860.480:84): avc: denied { mount } for pid=3331 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 861.473730][ T25] audit: type=1400 audit(860.700:85): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/syzkaller.lCuGlg/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 861.770638][ T25] audit: type=1400 audit(860.990:86): avc: denied { mount } for pid=3331 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 861.944776][ T3384] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.959098][ T3384] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.965939][ T3384] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 861.990859][ T3358] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 862.243493][ T25] audit: type=1400 audit(861.470:87): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/syzkaller.lCuGlg/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 862.364281][ T25] audit: type=1400 audit(861.590:88): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/syzkaller.lCuGlg/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 863.035424][ T25] audit: type=1400 audit(862.260:89): avc: denied { unmount } for pid=3331 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 863.253896][ T25] audit: type=1400 audit(862.460:90): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1546 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 863.540627][ T25] audit: type=1400 audit(862.760:91): avc: denied { mount } for pid=3331 comm="syz-executor" name="/" dev="gadgetfs" ino=3765 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 864.021814][ T25] audit: type=1400 audit(863.150:92): avc: denied { mount } for pid=3331 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 864.174021][ T25] audit: type=1400 audit(863.400:93): avc: denied { mounton } for pid=3331 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 865.135694][ T3331] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 866.276192][ T25] kauditd_printk_skb: 2 callbacks suppressed [ 866.290119][ T25] audit: type=1400 audit(865.500:96): avc: denied { open } for pid=3331 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 866.382131][ T25] audit: type=1400 audit(865.550:97): avc: denied { ioctl } for pid=3331 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 876.239085][ T25] audit: type=1400 audit(875.460:98): avc: denied { read write } for pid=3487 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 876.306289][ T25] audit: type=1400 audit(875.530:99): avc: denied { open } for pid=3487 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 876.451112][ T25] audit: type=1400 audit(875.600:100): avc: denied { ioctl } for pid=3487 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 898.939362][ T25] audit: type=1400 audit(898.160:101): avc: denied { append } for pid=3502 comm="syz.1.5" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 920.663368][ T3514] FAULT_INJECTION: forcing a failure. [ 920.663368][ T3514] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 920.693641][ T3514] CPU: 0 UID: 0 PID: 3514 Comm: syz.1.8 Not tainted syzkaller #0 PREEMPT [ 920.694297][ T3514] Hardware name: linux,dummy-virt (DT) [ 920.694778][ T3514] Call trace: [ 920.695172][ T3514] show_stack+0x2c/0x3c (C) [ 920.697143][ T3514] __dump_stack+0x30/0x40 [ 920.697590][ T3514] dump_stack_lvl+0xd8/0x12c [ 920.697902][ T3514] dump_stack+0x1c/0x28 [ 920.698178][ T3514] should_fail_ex+0x56c/0x6d8 [ 920.698392][ T3514] should_fail+0x14/0x24 [ 920.698627][ T3514] should_fail_usercopy+0x20/0x30 [ 920.698850][ T3514] simple_read_from_buffer+0xd0/0x294 [ 920.699089][ T3514] proc_fail_nth_read+0x184/0x214 [ 920.699326][ T3514] vfs_read+0x220/0x9d8 [ 920.699532][ T3514] ksys_read+0x108/0x1fc [ 920.699765][ T3514] __arm64_sys_read+0x98/0xcc [ 920.699978][ T3514] invoke_syscall+0x90/0x230 [ 920.700250][ T3514] el0_svc_common+0x120/0x2f4 [ 920.700536][ T3514] do_el0_svc+0x58/0x74 [ 920.700813][ T3514] el0_svc+0x5c/0x238 [ 920.701093][ T3514] el0t_64_sync_handler+0x84/0x12c [ 920.701368][ T3514] el0t_64_sync+0x198/0x19c [ 975.540999][ T25] audit: type=1400 audit(974.760:102): avc: denied { execute } for pid=3544 comm="syz.1.18" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4844 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 983.415804][ T25] audit: type=1400 audit(982.630:103): avc: denied { setattr } for pid=3550 comm="syz.1.20" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1332.559997][ T25] audit: type=1400 audit(1331.780:104): avc: denied { ioctl } for pid=3751 comm="syz.1.79" path="net:[4026532624]" dev="nsfs" ino=4026532624 ioctlcmd=0xb704 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1449.282484][ T3222] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1450.742508][ T3222] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1452.516840][ T3222] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1453.955802][ T3222] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1472.792459][ T3222] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1473.015284][ T3222] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1473.106441][ T3222] bond0 (unregistering): Released all slaves [ 1474.993529][ T3222] hsr_slave_0: left promiscuous mode [ 1475.069483][ T3222] hsr_slave_1: left promiscuous mode [ 1476.242858][ T3222] veth1_macvtap: left promiscuous mode [ 1476.280107][ T3222] veth0_macvtap: left promiscuous mode [ 1476.285074][ T3222] veth1_vlan: left promiscuous mode [ 1476.332726][ T3222] veth0_vlan: left promiscuous mode [ 1508.744366][ T3787] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1509.550829][ T3787] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1540.976792][ T3787] hsr_slave_0: entered promiscuous mode [ 1541.142998][ T3787] hsr_slave_1: entered promiscuous mode [ 1556.392184][ T3804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1557.354509][ T3804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1565.025710][ T3787] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1565.657079][ T3787] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1566.126793][ T3787] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1566.665469][ T3787] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1593.634761][ T3804] hsr_slave_0: entered promiscuous mode [ 1593.682252][ T3804] hsr_slave_1: entered promiscuous mode [ 1593.730503][ T3804] debugfs: 'hsr0' already exists in 'hsr' [ 1593.734201][ T3804] Cannot create hsr debugfs directory [ 1597.836835][ T3787] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1618.076552][ T3804] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1618.791224][ T3804] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1619.315463][ T3804] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1619.960197][ T3804] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1657.024830][ T3804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1731.894574][ T3787] veth0_vlan: entered promiscuous mode [ 1733.176939][ T3787] veth1_vlan: entered promiscuous mode [ 1737.422114][ T3787] veth0_macvtap: entered promiscuous mode [ 1738.045007][ T3787] veth1_macvtap: entered promiscuous mode [ 1742.472017][ T3375] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1742.609141][ T3375] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1742.625949][ T3384] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1742.656050][ T3384] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1790.186395][ T3804] veth0_vlan: entered promiscuous mode [ 1791.374015][ T3804] veth1_vlan: entered promiscuous mode [ 1795.201870][ T3804] veth0_macvtap: entered promiscuous mode [ 1795.854636][ T3804] veth1_macvtap: entered promiscuous mode [ 1801.046603][ T3222] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1801.062034][ T3222] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1801.135095][ T3222] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1801.311949][ T3222] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1844.461890][ T27] INFO: task syz.1.88:3782 blocked for more than 430 seconds. [ 1844.462902][ T27] Not tainted syzkaller #0 [ 1844.463806][ T27] Blocked by coredump. [ 1844.464137][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1844.465084][ T27] task:syz.1.88 state:D stack:0 pid:3782 tgid:3779 ppid:3331 task_flags:0x40044c flags:0x00000018 [ 1844.466310][ T27] Call trace: [ 1844.466742][ T27] __switch_to+0x584/0xb00 (T) [ 1844.532044][ T27] __schedule+0x200c/0x3428 [ 1844.574172][ T27] schedule+0xac/0x27c [ 1844.599172][ T27] schedule_timeout+0x68/0x1ec [ 1844.599958][ T27] do_wait_for_common+0x28c/0x440 [ 1844.600474][ T27] wait_for_completion+0x44/0x5c [ 1844.600970][ T27] __synchronize_srcu+0x2a4/0x320 [ 1844.601490][ T27] synchronize_srcu+0x3d0/0x4f8 [ 1844.602001][ T27] mmu_notifier_unregister+0x320/0x428 [ 1844.602525][ T27] kvm_put_kvm+0x698/0xbe0 [ 1844.602951][ T27] kvm_vm_release+0x58/0x78 [ 1844.603392][ T27] __fput+0x4ac/0x978 [ 1844.603864][ T27] ____fput+0x20/0x58 [ 1844.604295][ T27] task_work_run+0x1b8/0x250 [ 1844.604758][ T27] do_exit+0x7f8/0x2378 [ 1844.605219][ T27] do_group_exit+0x1d4/0x2ac [ 1844.605701][ T27] get_signal+0x1440/0x154c [ 1844.606177][ T27] arch_do_signal_or_restart+0x23c/0x4bac [ 1844.606684][ T27] exit_to_user_mode_loop+0x88/0x188 [ 1844.607138][ T27] el0_svc+0x17c/0x238 [ 1844.729194][ T25] audit: type=1400 audit(1843.780:105): avc: denied { write } for pid=3323 comm="syz-executor" path="pipe:[2723]" dev="pipefs" ino=2723 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1844.738708][ T27] el0t_64_sync_handler+0x84/0x12c [ 1844.754981][ T27] el0t_64_sync+0x198/0x19c [ 1844.760107][ T27] [ 1844.760107][ T27] Showing all locks held in the system: [ 1844.760504][ T27] 1 lock held by pr/ttyAMA-1/26: [ 1844.760939][ T27] 1 lock held by khungtaskd/27: [ 1844.761145][ T27] #0: ffff800087a86d08 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x0/0x44 [ 1844.762714][ T27] 1 lock held by syslogd/3128: [ 1844.762930][ T27] 2 locks held by getty/3199: [ 1844.763109][ T27] #0: 48f000001231a8a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 1844.764075][ T27] #1: 9aff80008c80b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x308/0x1234 [ 1844.765548][ T27] 2 locks held by kworker/u4:0/3222: [ 1844.765760][ T27] 1 lock held by sshd-session/3322: [ 1844.765918][ T27] 1 lock held by syz-executor/3323: [ 1844.766084][ T27] 2 locks held by kworker/u4:6/3384: [ 1844.766233][ T27] #0: 5df000000cc26948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10 [ 1844.767193][ T27] #1: ffff8000a3ce7c88 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10 [ 1844.962744][ T27] 2 locks held by syz.0.85/3767: [ 1844.963144][ T27] 3 locks held by kworker/u4:10/3918: [ 1844.963647][ T27] [ 1844.963956][ T27] ============================================= [ 1844.963956][ T27] [ 1844.964888][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 1844.972396][ T27] CPU: 0 UID: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 1844.973781][ T27] Hardware name: linux,dummy-virt (DT) [ 1844.974667][ T27] Call trace: [ 1844.975374][ T27] show_stack+0x2c/0x3c (C) [ 1844.976477][ T27] __dump_stack+0x30/0x40 [ 1844.977481][ T27] dump_stack_lvl+0x30/0x12c [ 1844.978504][ T27] dump_stack+0x1c/0x28 [ 1844.979285][ T27] vpanic+0x1d4/0x4e4 [ 1844.980194][ T27] vpanic+0x0/0x4e4 [ 1844.981052][ T27] hung_task_panic+0x0/0x2c [ 1844.982031][ T27] kthread+0x794/0x99c [ 1844.982996][ T27] ret_from_fork+0x10/0x20 [ 1844.984872][ T27] Kernel Offset: disabled [ 1844.985710][ T27] CPU features: 0x0000000,001a3005,fbe327a1,057ffe1f [ 1844.986851][ T27] Memory Limit: none [ 1844.989136][ T27] Rebooting in 86400 seconds..