last executing test programs: 1m5.362018484s ago: executing program 1 (id=289): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2b) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000240)={0x1, 0xe000, 0x1}) (async) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000001480)={0xfffffffffffffdfd, 0x13000, 0x1}) (async) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2c) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000000)=@arm64_ccsidr={0x6030000000110001, 0x0}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0x401c5820, 0xffff98600fff) (async, rerun: 64) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (rerun: 64) ioctl$KVM_RUN(r9, 0x8000ae8c, 0x0) 1m0.762299205s ago: executing program 0 (id=290): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000003c0)=[@code={0xa, 0xb4, {"009687d200c0b8f2a10180d2820180d2230080d2c40180d2020000d4807f95d200e0b8f2e10180d2020180d2c30180d2440180d2020000d4a0218ed200c0b0f2c10080d2e20180d2e30080d2c40080d2020000d40000007d00b8315e000028d5800684d20060b0f2810080d2220180d2030180d2040180d2020000d4007008d5805c9ad20060b0f2210180d2820180d2630080d2a40180d2020000d4007008d5"}}, @irq_setup={0x46, 0x18, {0x1, 0x26b}}, @svc={0x122, 0x40, {0x30000100, [0xfffffffffffffffa, 0x47, 0x4, 0x8, 0x7]}}, @memwrite={0x6e, 0x30, @generic={0x5000, 0x4b2, 0x0, 0x1}}, @msr={0x14, 0x20, {0x603000000013f088, 0x80a1}}, @hvc={0x32, 0x40, {0x8400000c, [0x9, 0x9, 0xe, 0x400, 0x401]}}, @irq_setup={0x46, 0x18, {0x2, 0x77}}, @its_setup={0x82, 0x28, {0x4, 0x0, 0xff}}, @svc={0x122, 0x40, {0xc5000020, [0x4, 0x0, 0xf, 0x9, 0x3]}}, @code={0xa, 0x6c, {"0000431e007008d500bb92d200a0b0f2c10080d2c20180d2830080d2840080d2020000d4c03b8dd200e0b8f2010180d2e20180d2630180d2a40080d2020000d4000480b80068200e000000f9008008d500d8a12e003c000e"}}, @mrs={0xbe, 0x18, {0x603000000013c4f6}}, @eret={0xe6, 0x18}, @uexit={0x0, 0x18, 0xfffffffffffffff7}, @msr={0x14, 0x20, {0x603000000013c118, 0x3}}, @smc={0x1e, 0x40, {0x84000007, [0x9, 0x0, 0x9, 0xfffffffffffffffb, 0x1000]}}, @uexit={0x0, 0x18, 0x7}, @eret={0xe6, 0x18, 0x7fffffffffffffff}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1ce}}, @hvc={0x32, 0x40, {0x84000052, [0x5, 0x101, 0x4, 0x2, 0x6]}}, @irq_setup={0x46, 0x18, {0x0, 0x6f}}, @its_setup={0x82, 0x28, {0x0, 0x3, 0x20c}}, @uexit={0x0, 0x18, 0x6}, @its_setup={0x82, 0x28, {0x0, 0x2, 0x3c0}}, @mrs={0xbe, 0x18, {0x603000000013e6d2}}], 0x460}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) (async) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000160003, &(0x7f0000000000)=0x8}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r9 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) (async) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000380)=@arm64_sve_vls={0x606000000015ffff, &(0x7f00000000c0)=0x8000000000000000}) (async) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000380)=@arm64_sve_vls={0x606000000015ffff, &(0x7f00000000c0)=0x8000000000000000}) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r12, 0x4018aee1, &(0x7f0000000040)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r8, 0x3, 0x80010, r3, 0x0) (async) r13 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r8, 0x3, 0x80010, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r13, 0xffffffffffffffff) (async) syz_kvm_assert_syzos_uexit$arm64(r13, 0xffffffffffffffff) syz_kvm_assert_reg(r3, 0x603000000013c4f1, 0x8000) (async) syz_kvm_assert_reg(r3, 0x603000000013c4f1, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013c4f2, 0x8000) (async) syz_kvm_assert_reg(r3, 0x603000000013c4f2, 0x8000) syz_kvm_assert_reg(r12, 0xc, 0x200000007ffd) syz_kvm_assert_reg(r3, 0x603000000013dce1, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce2, 0x8000) (async) syz_kvm_assert_reg(r3, 0x603000000013dce2, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce3, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce4, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce5, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce8, 0x8000) syz_kvm_assert_reg(r3, 0x603000000013dce9, 0x8000) 52.802940528s ago: executing program 1 (id=291): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_vgic_v3_setup(r1, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000080)=@attr_other={0x0, 0x9, 0x5660b638, 0x0}) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x3000003, 0x13, r6, 0x0) ioctl$KVM_CREATE_VM(r3, 0x80087601, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x2000006, 0x13, r7, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000000080)=@arm64_fp_extra={0x60200000001000d5, &(0x7f0000000040)=0x5}) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 50.676174405s ago: executing program 0 (id=292): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x17) r1 = syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x401, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x2, 0x9, 0x9, 0x80, 0x1}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r9, 0x4, 0x220) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x4, 0x8, 0x0}) r13 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@msr={0x14, 0x20, {0x603000000013df60, 0x2}}], 0x20}, &(0x7f0000000280)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r14, 0x4018aee1, &(0x7f0000000240)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000000000)=0x1a}) ioctl$KVM_RUN(r14, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000180)={0x8}) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0xffffff00, 0x1, &(0x7f00000002c0)=0x7340}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 42.522151666s ago: executing program 1 (id=293): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000bfd000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000b80)={0x0, &(0x7f0000000140)=[@uexit={0x0, 0x18, 0x9b}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x0, 0x10, 0x12ba9a40, 0x5fc, 0x2}}, @memwrite={0x6e, 0x30, @generic={0xd000, 0x4d0, 0x144, 0xc}}, @irq_setup={0x46, 0x18, {0x2, 0x1e}}, @msr={0x14, 0x20, {0x603000000013e6d5, 0x4}}, @hvc={0x32, 0x40, {0x84000051, [0x5, 0x9, 0x0, 0x400, 0x5]}}], 0xe8}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) 35.371657896s ago: executing program 1 (id=294): r0 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x101101, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) close(r2) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r4 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r3, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000280)={0x0, 0x0}, &(0x7f00000002c0)=[@featur1={0x1, 0xa0}], 0x1) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000080)=@arm64_sys={0x603000000013c4f1, &(0x7f00000001c0)=0x3}) r9 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r9, 0x4018aee1, &(0x7f0000000040)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000000)=0x18}) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x9, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000180)=@attr_other={0x0, 0x1, 0x8, &(0x7f00000000c0)=0x45d4970}) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x101300, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x1a) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r16, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) 33.765234958s ago: executing program 0 (id=295): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r5, 0x4010ae67, &(0x7f0000000380)={0x2, 0x25000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r5, 0x4010ae68, &(0x7f0000000240)={0xffff1000, 0xa000}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, 0x0, 0x0, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000100)="4bead90a8a524c79f126541ba60686d7378e2f7235828bcf3fa4a80d5e3c6753e0fbf42973da38e59cd4b2dc174f7f7ed37dd8abc6a52715ea2d8a070028857f943eed4506eaf7a1", 0x0, 0x48) r6 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000180)=[@irq_setup={0x46, 0x18, {0x0, 0x1b8}}, @eret={0xe6, 0x18, 0x2}, @code={0xa, 0x84, {"0030004fa04397d20040b0f2610080d2620080d2630080d2640180d2020000d4400c9ed20060b0f2210080d2c20180d2030080d2640080d2020000d40000407ce00300da000028d5000028d50048c01a0000006ca06b9cd200e0b8f2010180d2620080d2e30180d2040180d2020000d4"}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xc48, 0x79bd, 0x6}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xf20, 0x3, 0x8}}, @smc={0x1e, 0x40, {0x84000010, [0x0, 0x400, 0x100000000, 0x6, 0x9]}}, @irq_setup={0x46, 0x18, {0x0, 0x111}}, @irq_setup={0x46, 0x18, {0x2, 0x306}}, @irq_setup={0x46, 0x18, {0xbd, 0x230}}, @msr={0x14, 0x20, {0x0, 0x8}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x1, 0x0, 0xe, 0xb54, 0x10000, 0x3}}, @uexit={0x0, 0x18, 0x84}, @uexit={0x0, 0x18, 0x8}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x4, 0x7, 0x2}}, @its_setup={0x82, 0x28, {0x4, 0x2, 0x3ab}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x400, 0x5, 0x6}}, @mrs={0xbe, 0x18, {0x603000000013e21b}}, @smc={0x1e, 0x40, {0x84000003, [0xffffffffffffffff, 0xe81, 0x1ff, 0x6, 0x6]}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x0, 0x200, 0x2}}, @uexit={0x0, 0x18, 0x7}, @msr={0x14, 0x20, {0x6030000000138066, 0x8}}, @code={0xa, 0x9c, {"20e49dd20020b0f2610180d2620180d2c30080d2c40080d2020000d440aa88d20000b8f2410080d2220180d2430080d2e40080d2020000d460cc81d20020b0f2610080d2a20080d2430080d2840080d2020000d400c0600d0054007f000040d300e4005f000040d400000088e0d997d20000b0f2e10180d2220080d2030080d2e40180d2020000d4"}}, @mrs={0xbe, 0x18, {0x603000000013c111}}, @code={0xa, 0x6c, {"009c006f000028d50000581e000028d5a0408ed200a0b8f2010080d2a20080d2c30180d2440080d2020000d4008008d50098212e000000180008607ca0239ed20000b0f2810080d2c20080d2630180d2c40080d2020000d4"}}, @msr={0x14, 0x20, {0x6030000000138024, 0x8}}, @hvc={0x32, 0x40, {0x2, [0x9, 0x3, 0x9, 0x2, 0x9]}}, @svc={0x122, 0x40, {0x800, [0x9, 0x6590d23, 0x40, 0x5, 0xa]}}, @code={0xa, 0x54, {"007008d5e00300aa0000191e007008d5201191d20020b8f2c10080d2c20080d2430180d2c40180d2020000d4007008d5000008d5007008d50020df0d0088205e"}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x8, 0xfff, 0x2}}, @code={0xa, 0x9c, {"800a96d20060b0f2c10080d2820080d2030080d2a40180d2020000d4007008d500a8212e0000021e40f18cd20060b8f2010180d2c20180d2830180d2840180d2020000d4008008d5208a8ed200e0b0f2a10080d2a20180d2830180d2440180d2020000d4001c0053000008d5a07d8bd20020b8f2210080d2e20080d2830180d2a40180d2020000d4"}}, @memwrite={0x6e, 0x30, @generic={0x4, 0x27e, 0x6}}], 0x66c}, &(0x7f0000000080)=[@featur2={0x1, 0x2}], 0x1) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x10010, r6, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x400100, 0x1f01) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x151400, 0x0) 19.051778455s ago: executing program 0 (id=296): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000853000/0x400000)=nil) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0x80111500, 0x20000000) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000000000/0xc00000)=nil, 0x930, 0xf, 0x32, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0x541b, 0x10000000000000) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x7}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1e) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x4, 0xdddd0000, 0x2000, &(0x7f00006b4000/0x2000)=nil}) syz_kvm_assert_syzos_uexit$arm64(0x0, 0xffffffffffffffff) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000) munmap(&(0x7f0000584000/0x800000)=nil, 0x800000) 17.113997853s ago: executing program 1 (id=297): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1fe, 0x4, 0x8080000, 0x2000, &(0x7f0000fb0000/0x2000)=nil}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x4, 0x3, 0x100000, 0x2000, &(0x7f000000f000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x0, 0x6000, 0x1000, &(0x7f0000fd3000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x10004, 0x0, 0xeeef0000, 0x2000, &(0x7f0000fd3000/0x2000)=nil}) 8.101942341s ago: executing program 0 (id=298): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f00000000c0)=[@msr={0x14, 0x20, {0x603000000013c600, 0xfefefee0}}], 0x20}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000140)=@arm64_core={0x603000000010002c, &(0x7f0000000000)=0x160000000}) 4.76190164s ago: executing program 1 (id=299): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x40480, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x3, 0x800) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x1fc, 0x1000, 0x2, r3, 0x1}) r4 = eventfd2(0x0, 0x80000) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000001340)={0x0, 0x0, 0x2, r4, 0x3}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xd) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000140)={0x203, 0x0, 0x2, r4, 0xf}) ioctl$KVM_CAP_ARM_USER_IRQ(r2, 0x4068aea3, &(0x7f00000001c0)) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x200, 0x0) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000240)={0x5, 0x5000, 0x0, r3, 0xc}) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x31) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x603000000010003c, &(0x7f0000000140)=0x7}) syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000000)={0x0, &(0x7f0000000400)=[@hvc={0x32, 0x40, {0x84000053, [0x53, 0x8, 0x1, 0x8, 0x100]}}], 0x40}, 0x0, 0x0) r12 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000180)={0x0, &(0x7f00000003c0)=[@hvc={0x32, 0x40, {0x86000001, [0xc, 0x5, 0x2, 0xfffffffffffffffc, 0x52]}}], 0xffffffb5}, 0x0, 0x0) munmap(&(0x7f0000e4e000/0x4000)=nil, 0x4000) ioctl$KVM_RUN(r12, 0xae80, 0x0) 0s ago: executing program 0 (id=300): mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000eb2000/0x3000)=nil, 0x930, 0x0, 0x32e7851d6de9e532, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c94000/0x3000)=nil, 0x930, 0x8, 0xc1812, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000280), 0x24041, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2) syz_kvm_vgic_v3_setup(r3, 0x2, 0x40) ioctl$KVM_IRQ_LINE_STATUS(r3, 0xc008ae67, &(0x7f0000000000)={0x9, 0x5}) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r5}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff}) ioctl$KVM_GET_DEVICE_ATTR(r8, 0x4018aee2, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x5, 0x0}) ioctl$KVM_GET_DEVICE_ATTR(r8, 0x4018aee2, &(0x7f0000000200)=@attr_other={0x0, 0x7f, 0x7, &(0x7f00000001c0)}) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616}) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000180)={0x10000, 0x4000}) r9 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r11 = eventfd2(0x4, 0x80801) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000000)={0x0, 0xf000, 0x1, r11, 0x3}) kernel console output (not intermixed with test programs): [ 426.991029][ T3156] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:29228' (ED25519) to the list of known hosts. [ 593.866926][ T25] audit: type=1400 audit(593.080:61): avc: denied { name_bind } for pid=3314 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 595.671742][ T25] audit: type=1400 audit(594.890:62): avc: denied { execute } for pid=3315 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 595.698114][ T25] audit: type=1400 audit(594.920:63): avc: denied { execute_no_trans } for pid=3315 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 615.498220][ T25] audit: type=1400 audit(614.720:64): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 615.526173][ T25] audit: type=1400 audit(614.740:65): avc: denied { mount } for pid=3315 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 615.608211][ T3315] cgroup: Unknown subsys name 'net' [ 615.658175][ T25] audit: type=1400 audit(614.880:66): avc: denied { unmount } for pid=3315 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 616.050723][ T3315] cgroup: Unknown subsys name 'cpuset' [ 616.149313][ T3315] cgroup: Unknown subsys name 'rlimit' [ 617.071238][ T25] audit: type=1400 audit(616.290:67): avc: denied { setattr } for pid=3315 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 617.089990][ T25] audit: type=1400 audit(616.310:68): avc: denied { mounton } for pid=3315 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 617.119842][ T25] audit: type=1400 audit(616.340:69): avc: denied { mount } for pid=3315 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 618.288985][ T3318] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 618.309780][ T25] audit: type=1400 audit(617.520:70): avc: denied { relabelto } for pid=3318 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 618.336611][ T25] audit: type=1400 audit(617.550:71): avc: denied { write } for pid=3318 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 618.519377][ T25] audit: type=1400 audit(617.740:72): avc: denied { read } for pid=3315 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 618.541796][ T25] audit: type=1400 audit(617.750:73): avc: denied { open } for pid=3315 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 618.583303][ T3315] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 669.472979][ T25] audit: type=1400 audit(668.690:74): avc: denied { execmem } for pid=3319 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 674.148325][ T25] audit: type=1400 audit(673.350:75): avc: denied { read } for pid=3322 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 674.166989][ T25] audit: type=1400 audit(673.360:76): avc: denied { open } for pid=3321 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 674.215634][ T25] audit: type=1400 audit(673.430:77): avc: denied { mounton } for pid=3322 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 674.478010][ T25] audit: type=1400 audit(673.700:78): avc: denied { module_request } for pid=3322 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 674.509591][ T25] audit: type=1400 audit(673.730:79): avc: denied { module_request } for pid=3321 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 675.610070][ T25] audit: type=1400 audit(674.820:80): avc: denied { sys_module } for pid=3322 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 701.657413][ T3321] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 702.217035][ T3321] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 702.307432][ T3322] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 702.707720][ T3322] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 717.242278][ T3321] hsr_slave_0: entered promiscuous mode [ 717.272747][ T3321] hsr_slave_1: entered promiscuous mode [ 718.081433][ T3322] hsr_slave_0: entered promiscuous mode [ 718.127379][ T3322] hsr_slave_1: entered promiscuous mode [ 718.154855][ T3322] debugfs: 'hsr0' already exists in 'hsr' [ 718.165198][ T3322] Cannot create hsr debugfs directory [ 723.623150][ T25] audit: type=1400 audit(722.840:81): avc: denied { create } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 723.685082][ T25] audit: type=1400 audit(722.900:82): avc: denied { write } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 723.746696][ T25] audit: type=1400 audit(722.920:83): avc: denied { read } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 723.898063][ T3321] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 724.179910][ T3321] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 724.476428][ T3321] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 724.936753][ T3321] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 726.348672][ T3322] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 726.547808][ T3322] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 726.756131][ T3322] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 726.901323][ T3322] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 739.548777][ T3321] 8021q: adding VLAN 0 to HW filter on device bond0 [ 741.781162][ T3322] 8021q: adding VLAN 0 to HW filter on device bond0 [ 797.119762][ T3321] veth0_vlan: entered promiscuous mode [ 797.684355][ T3321] veth1_vlan: entered promiscuous mode [ 799.752598][ T3321] veth0_macvtap: entered promiscuous mode [ 799.929639][ T3322] veth0_vlan: entered promiscuous mode [ 800.188205][ T3321] veth1_macvtap: entered promiscuous mode [ 800.667905][ T3322] veth1_vlan: entered promiscuous mode [ 802.211332][ T2130] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.342721][ T2130] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.349161][ T2130] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.359815][ T2130] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 803.501717][ T3322] veth0_macvtap: entered promiscuous mode [ 804.059530][ T3322] veth1_macvtap: entered promiscuous mode [ 804.916360][ T25] audit: type=1400 audit(804.130:84): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 805.132293][ T25] audit: type=1400 audit(804.350:85): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/syzkaller.TEhQtT/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 805.282051][ T25] audit: type=1400 audit(804.450:86): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 805.594549][ T25] audit: type=1400 audit(804.790:87): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/syzkaller.TEhQtT/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 805.822332][ T25] audit: type=1400 audit(805.040:88): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/syzkaller.TEhQtT/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 806.550616][ T3370] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.552772][ T3370] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.565238][ T25] audit: type=1400 audit(805.770:89): avc: denied { unmount } for pid=3321 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 806.575166][ T3370] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.638507][ T3370] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.897616][ T25] audit: type=1400 audit(806.080:90): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 806.960208][ T25] audit: type=1400 audit(806.180:91): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="gadgetfs" ino=3783 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 807.171858][ T25] audit: type=1400 audit(806.390:92): avc: denied { mount } for pid=3321 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 807.300219][ T25] audit: type=1400 audit(806.510:93): avc: denied { mounton } for pid=3321 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 808.817479][ T3321] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 809.955160][ T25] kauditd_printk_skb: 3 callbacks suppressed [ 809.956103][ T25] audit: type=1400 audit(809.160:97): avc: denied { ioctl } for pid=3321 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 818.705238][ T25] audit: type=1400 audit(817.920:98): avc: denied { read } for pid=3474 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 818.755970][ T25] audit: type=1400 audit(817.970:99): avc: denied { open } for pid=3474 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 819.056620][ T25] audit: type=1400 audit(818.200:100): avc: denied { ioctl } for pid=3474 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 878.350639][ T25] audit: type=1400 audit(877.570:101): avc: denied { write } for pid=3507 comm="syz.1.9" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 907.241618][ T3525] kvm [3525]: Failed to find VMA for hva 0x20c01000 [ 913.209626][ T25] audit: type=1400 audit(912.400:102): avc: denied { append } for pid=3530 comm="syz.0.18" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 978.715686][ T25] audit: type=1400 audit(977.930:103): avc: denied { map } for pid=3569 comm="syz.1.31" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 987.614807][ T25] audit: type=1400 audit(986.810:104): avc: denied { execute } for pid=3575 comm="syz.0.33" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=5479 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 995.272059][ T25] audit: type=1400 audit(994.460:105): avc: denied { setattr } for pid=3578 comm="syz.0.34" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1037.779692][ T3604] kvm [3604]: Failed to find VMA for hva 0x20de9000 [ 1242.178910][ T3721] kvm [3721]: Failed to find VMA for hva 0x21016000 [ 1367.317954][ T3806] kvm [3806]: Failed to find VMA for hva 0x20c01000 [ 1367.397511][ T3809] kvm [3809]: Failed to find VMA for hva 0x20c01000 [ 1779.211137][ T25] audit: type=1400 audit(1778.430:106): avc: denied { ioctl } for pid=4052 comm="syz.0.184" path="net:[4026532629]" dev="nsfs" ino=4026532629 ioctlcmd=0x582a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1793.067828][ T4058] kvm [4058]: Failed to find VMA for hva 0x20c01000 [ 2082.272673][ T4243] kvm [4243]: Failed to find VMA for hva 0x21016000 [ 2179.729295][ T4305] kvm [4305]: Failed to find VMA for hva 0x20c01000 [ 2179.757877][ T4307] kvm [4307]: Failed to find VMA for hva 0x20c01000 [ 2364.295233][ T25] audit: type=1400 audit(2363.510:107): avc: denied { execute } for pid=4411 comm="syz.1.291" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2415.057366][ T4439] ================================================================== [ 2415.057995][ T4439] BUG: KASAN: invalid-access in __kvm_pgtable_walk+0x8e4/0xa68 [ 2415.059721][ T4439] Read of size 8 at addr ebf000001fa36000 by task syz.1.299/4439 [ 2415.059946][ T4439] Pointer tag: [eb], memory tag: [fe] [ 2415.060092][ T4439] [ 2415.061076][ T4439] CPU: 0 UID: 0 PID: 4439 Comm: syz.1.299 Not tainted syzkaller #0 PREEMPT [ 2415.061611][ T4439] Hardware name: linux,dummy-virt (DT) [ 2415.062050][ T4439] Call trace: [ 2415.062421][ T4439] show_stack+0x2c/0x3c (C) [ 2415.064863][ T4439] __dump_stack+0x30/0x40 [ 2415.065159][ T4439] dump_stack_lvl+0xd8/0x12c [ 2415.065362][ T4439] print_address_description+0xac/0x288 [ 2415.065645][ T4439] print_report+0x84/0xa0 [ 2415.065888][ T4439] kasan_report+0xb0/0x110 [ 2415.066096][ T4439] kasan_tag_mismatch+0x28/0x3c [ 2415.066315][ T4439] __hwasan_tag_mismatch+0x30/0x60 [ 2415.066612][ T4439] __kvm_pgtable_walk+0x8e4/0xa68 [ 2415.066877][ T4439] kvm_pgtable_walk+0x294/0x468 [ 2415.067126][ T4439] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 2415.067409][ T4439] kvm_free_stage2_pgd+0x198/0x28c [ 2415.067687][ T4439] kvm_uninit_stage2_mmu+0x20/0x38 [ 2415.067943][ T4439] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 2415.068246][ T4439] kvm_mmu_notifier_release+0x48/0xa8 [ 2415.068530][ T4439] mmu_notifier_unregister+0x128/0x42c [ 2415.068792][ T4439] kvm_put_kvm+0x6a0/0xfa8 [ 2415.068984][ T4439] kvm_vm_release+0x58/0x78 [ 2415.069217][ T4439] __fput+0x4ac/0x980 [ 2415.069414][ T4439] ____fput+0x20/0x58 [ 2415.069615][ T4439] task_work_run+0x1bc/0x254 [ 2415.069825][ T4439] do_notify_resume+0x1bc/0x270 [ 2415.070054][ T4439] el0_svc+0xb8/0x164 [ 2415.070281][ T4439] el0t_64_sync_handler+0x84/0x12c [ 2415.070531][ T4439] el0t_64_sync+0x198/0x19c [ 2415.071021][ T4439] [ 2415.071189][ T4439] The buggy address belongs to the physical page: [ 2415.072285][ T4439] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fa36 [ 2415.072676][ T4439] flags: 0x1ffc50000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x14) [ 2415.073828][ T4439] raw: 01ffc50000000000 ffffc1ffc07e8a88 ffffc1ffc07e22c8 0000000000000000 [ 2415.074059][ T4439] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2415.074254][ T4439] page dumped because: kasan: bad access detected [ 2415.074376][ T4439] [ 2415.074481][ T4439] Memory state around the buggy address: [ 2415.074839][ T4439] fff000001fa35e00: 35 35 35 35 35 35 35 35 35 35 35 35 35 35 35 35 [ 2415.075029][ T4439] fff000001fa35f00: 35 35 35 35 35 35 35 35 35 35 35 35 35 35 35 35 [ 2415.075205][ T4439] >fff000001fa36000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 2415.075332][ T4439] ^ [ 2415.075602][ T4439] fff000001fa36100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 2415.075786][ T4439] fff000001fa36200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 2415.075978][ T4439] ================================================================== [ 2415.383115][ T4439] Disabling lock debugging due to kernel taint [ 2416.684659][ T4439] Unable to handle kernel paging request at virtual address ffff780007ffff00 [ 2416.691577][ T4439] KASAN: probably wild-memory-access in range [0xffff80007ffff000-0xffff80007ffff00f] [ 2416.709160][ T4439] Mem abort info: [ 2416.715301][ T4439] ESR = 0x0000000096000006 [ 2416.728664][ T4439] EC = 0x25: DABT (current EL), IL = 32 bits [ 2416.746663][ T25] audit: type=1400 audit(2415.970:108): avc: denied { read } for pid=3115 comm="syslogd" name="log" dev="vda" ino=1857 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 2416.759278][ T4439] SET = 0, FnV = 0 [ 2416.772321][ T25] audit: type=1400 audit(2415.990:109): avc: denied { search } for pid=3115 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2416.798833][ T4439] EA = 0, S1PTW = 0 [ 2416.826260][ T4439] FSC = 0x06: level 2 translation fault [ 2416.838890][ T4439] Data abort info: [ 2416.856220][ T4439] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 2416.864139][ T25] audit: type=1400 audit(2416.070:110): avc: denied { search } for pid=3115 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2416.878089][ T4439] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2416.922692][ T4439] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2416.930867][ T4439] swapper pgtable: 4k pages, 52-bit VAs, pgdp=00000000476e2000 [ 2416.938555][ T25] audit: type=1400 audit(2416.160:111): avc: denied { add_name } for pid=3115 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2416.956453][ T4439] [ffff780007ffff00] pgd=100000004c698003, p4d=00000000bfa1e003, pud=00000000bfa1d003, pmd=0000000000000000 [ 2416.968662][ T25] audit: type=1400 audit(2416.180:112): avc: denied { create } for pid=3115 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 2416.980973][ T4439] [ 2416.999503][ T4439] Internal error: Oops: 0000000096000006 [#1] SMP [ 2417.002709][ T4439] Modules linked in: [ 2417.004510][ T4439] CPU: 0 UID: 0 PID: 4439 Comm: syz.1.299 Tainted: G B syzkaller #0 PREEMPT [ 2417.006039][ T4439] Tainted: [B]=BAD_PAGE [ 2417.006722][ T4439] Hardware name: linux,dummy-virt (DT) [ 2417.007725][ T4439] pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2417.008981][ T4439] pc : __kvm_pgtable_walk+0x268/0xa68 [ 2417.009982][ T4439] lr : __kvm_pgtable_walk+0x214/0xa68 [ 2417.010888][ T4439] sp : ffff80008ef876d0 [ 2417.011598][ T4439] x29: ffff80008ef87770 x28: 0000000000000005 x27: ffff80007ffff000 [ 2417.013173][ T4439] x26: ffff80007ffff000 x25: 0000000000000000 x24: 0000000000000002 [ 2417.014508][ T4439] x23: 00000000000000ff x22: efff800000000000 x21: ffff80008ef879d8 [ 2417.015749][ T4439] x20: 00000000000000ff x19: 00000000000000ff x18: 0000000000001b80 [ 2417.017022][ T4439] x17: 00000000000000eb x16: 0000000000000018 x15: fff0000072d7e404 [ 2417.018302][ T4439] x14: 00000000000000ff x13: ffff80008ef879e0 x12: ffff80008ef879e8 [ 2417.019589][ T4439] x11: ffff80008ef879e8 x10: 0000000000ff0100 x9 : ffff80008ef87728 [ 2417.020995][ T4439] x8 : 0ffff80007ffff00 x7 : ffff800080bc7058 x6 : 0000000000000000 [ 2417.022254][ T4439] x5 : 0000000000000000 x4 : 00000000000000ff x3 : 0000000000000002 [ 2417.023472][ T4439] x2 : ffff80007ffff000 x1 : 0000000000000000 x0 : 0000000000000000 [ 2417.024836][ T4439] Call trace: [ 2417.025494][ T4439] __kvm_pgtable_walk+0x268/0xa68 (P) [ 2417.026476][ T4439] __kvm_pgtable_walk+0x600/0xa68 [ 2417.027373][ T4439] __kvm_pgtable_walk+0x600/0xa68 [ 2417.028287][ T4439] kvm_pgtable_walk+0x294/0x468 [ 2417.029178][ T4439] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 2417.030194][ T4439] kvm_free_stage2_pgd+0x198/0x28c [ 2417.031122][ T4439] kvm_uninit_stage2_mmu+0x20/0x38 [ 2417.031929][ T4439] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 2417.032821][ T4439] kvm_mmu_notifier_release+0x48/0xa8 [ 2417.033734][ T4439] mmu_notifier_unregister+0x128/0x42c [ 2417.034692][ T4439] kvm_put_kvm+0x6a0/0xfa8 [ 2417.035455][ T4439] kvm_vm_release+0x58/0x78 [ 2417.036280][ T4439] __fput+0x4ac/0x980 [ 2417.037026][ T4439] ____fput+0x20/0x58 [ 2417.037738][ T4439] task_work_run+0x1bc/0x254 [ 2417.038533][ T4439] do_notify_resume+0x1bc/0x270 [ 2417.039353][ T4439] el0_svc+0xb8/0x164 [ 2417.040153][ T4439] el0t_64_sync_handler+0x84/0x12c [ 2417.041016][ T4439] el0t_64_sync+0x198/0x19c [ 2417.042314][ T4439] Code: f94023ec f9400fed a9017d3f f800813f (38686ac8) [ 2417.044011][ T4439] ---[ end trace 0000000000000000 ]--- [ 2417.045531][ T4439] Kernel panic - not syncing: Oops: Fatal exception [ 2417.047368][ T4439] Kernel Offset: disabled [ 2417.048079][ T4439] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 2417.049115][ T4439] Memory Limit: none [ 2417.050737][ T4439] Rebooting in 86400 seconds.. VM DIAGNOSIS: 20:07:58 Registers: info registers vcpu 0 CPU#0 PC=ffff800082159154 X00=0000000000000003 X01=0000000000000002 X02=0000000000000001 X03=ffff800082159050 X04=0000000000000001 X05=0000000000000001 X06=0000000000000000 X07=ffff800081f1ef70 X08=8ff000000d9b9d80 X09=0000000000000000 X10=0000000000ff0100 X11=00000000000000fe X12=0000000000000002 X13=0000000000000002 X14=0000000000000000 X15=00000000e8d27fab X16=000000009cf021ed X17=0000000000000000 X18=000000009cff78f5 X19=efff800000000000 X20=26f000000dcb4880 X21=b3ff80008c4bb018 X22=0000000000000002 X23=26f000000dcb497c X24=0000000000000026 X25=26f000000dcb4ac8 X26=26f000000dcb48c8 X27=0000000000000026 X28=0000000000000026 X29=ffff80008c4f7b40 X30=ffff800082159154 SP=ffff80008c4f7b30 PSTATE=814020c9 N--- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=0000000000000000:0000000000000000 Z01=0000ffffcef63080:af242ec51e32a500 Z02=0000ffffcef63060:ffffff80ffffffd8 Z03=0000ffffcef63110:0000ffffcef63110 Z04=0000ffffcef63110:0000ffff8e137408 Z05=0000ffffcef630e0:0000ffffcef63110 Z06=6edc4d3a2914b135:d8e9c869e2695c88 Z07=b20fae707afde253:388e9c6c4fa85ca0 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffcef63330:0000ffffcef63330 Z17=ffffff80ffffffd0:0000ffffcef63300 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000