last executing test programs: 334.506412ms ago: executing program 1 (id=2): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:02.0/driver/unbind\x00', 0x1, 0x0) write(r0, &(0x7f0000000180)='0000:00:02.0\x00', 0xd) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/bus/pci/devices/0000:00:02.0/driver_override\x00', 0x1, 0x0) write(r1, &(0x7f0000000100)='vfio-pci\x00', 0x9) r2 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/bus/pci/drivers/vfio-pci/bind\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='0000:00:02.0\x00', 0xd) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000400)='./dev\x00', &(0x7f0000000440)='devtmpfs\x00', 0x0, 0x0) nanosleep(&(0x7f0000000500)={0x0, 0x1dcd6500}, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./dev/vfio/devices/vfio0\x00', 0x2, 0x0) 0s ago: executing program 0 (id=1): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x1000, 0x3, 0x11, r2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 0s ago: executing program 0 (id=6): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/power/state\x00', 0x2, 0x0) write(r1, &(0x7f0000000180)='disk\x00', 0x4) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:35720' (ED25519) to the list of known hosts. syzkaller login: [ 68.455021][ T3363] cgroup: Unknown subsys name 'net' [ 68.617723][ T3363] cgroup: Unknown subsys name 'cpuset' [ 68.640108][ T3363] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.064263][ T3363] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 78.534573][ T3370] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.546119][ T3370] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.689288][ T3371] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.701474][ T3371] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.285047][ T3370] hsr_slave_0: entered promiscuous mode [ 79.290736][ T3370] hsr_slave_1: entered promiscuous mode [ 79.538784][ T3371] hsr_slave_0: entered promiscuous mode [ 79.542381][ T3371] hsr_slave_1: entered promiscuous mode [ 79.544779][ T3371] debugfs: 'hsr0' already exists in 'hsr' [ 79.545403][ T3371] Cannot create hsr debugfs directory [ 80.143427][ T3370] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.165336][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.171862][ T3370] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.188388][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.191798][ T3370] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.205402][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.238153][ T3370] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.252441][ T3370] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 80.396139][ T3371] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.419393][ T3371] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 80.425970][ T3371] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.442807][ T3371] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 80.462652][ T3371] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.484839][ T3371] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 80.493024][ T3371] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 80.510092][ T3371] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 81.142598][ T3370] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.303472][ T3371] 8021q: adding VLAN 0 to HW filter on device bond0 [ 83.626108][ T3370] veth0_vlan: entered promiscuous mode [ 83.661055][ T3370] veth1_vlan: entered promiscuous mode [ 83.765109][ T3370] veth0_macvtap: entered promiscuous mode [ 83.801190][ T3370] veth1_macvtap: entered promiscuous mode [ 83.983590][ T3371] veth0_vlan: entered promiscuous mode [ 84.034782][ T29] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.035391][ T29] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.035537][ T29] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.035665][ T29] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.085231][ T3371] veth1_vlan: entered promiscuous mode [ 84.334539][ T3371] veth0_macvtap: entered promiscuous mode [ 84.371270][ T3371] veth1_macvtap: entered promiscuous mode [ 84.516669][ T3370] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 84.522613][ T50] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.528273][ T50] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.529792][ T50] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 84.540535][ T50] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 85.644195][ T3519] vfio-pci 0000:00:02.0: probe with driver vfio-pci failed with error -22 [ 86.504785][ T3536] PM: hibernation: hibernation entry [ 86.554023][ T3537] vfio-pci 0000:00:02.0: probe with driver vfio-pci failed with error -22 [ 86.873016][ T1019] Filesystems sync: 0.301 seconds [ 86.876164][ T3536] Freezing user space processes [ 86.893523][ T3536] Freezing user space processes completed (elapsed 0.012 seconds) [ 86.894169][ T3536] OOM killer disabled. [ 86.898984][ T3536] Freezing remaining freezable tasks [ 86.903844][ T3536] Freezing remaining freezable tasks completed (elapsed 0.004 seconds) [ 86.917165][ T3536] PM: hibernation: Preallocating image memory [ 92.642089][ T3536] PM: hibernation: Allocated 65075 pages for snapshot [ 92.642308][ T3536] PM: hibernation: Allocated 260300 kbytes in 5.72 seconds (45.50 MB/s) [ 92.642637][ T3536] printk: Suspending console(s) (use no_console_suspend to debug) [ 92.844222][ T3536] Disabling non-boot CPUs ... [ 92.873600][ T3536] psci: CPU1 killed (polled 0 ms) [ 92.899959][ T3536] hibernate: Saved 0 MTE pages [ 92.899959][ T3536] ================================================================== [ 92.899959][ T3536] BUG: KASAN: invalid-access in swsusp_save+0x2cc/0x590 [ 92.899959][ T3536] Read at addr f4f000000341f100 by task syz.0.6/3536 [ 92.899959][ T3536] Pointer tag: [f4], memory tag: [fe] [ 92.899959][ T3536] [ 92.899959][ T3536] CPU: 0 UID: 0 PID: 3536 Comm: syz.0.6 Not tainted syzkaller #0 PREEMPT [ 92.899959][ T3536] Hardware name: linux,dummy-virt (DT) [ 92.899959][ T3536] Call trace: [ 92.899959][ T3536] show_stack+0x18/0x24 (C) [ 92.899959][ T3536] dump_stack_lvl+0x60/0x80 [ 92.899959][ T3536] print_report+0x1c4/0x4b0 [ 92.899959][ T3536] kasan_report+0x84/0xac [ 92.899959][ T3536] __do_kernel_fault+0x1b4/0x220 [ 92.899959][ T3536] do_bad_area+0x68/0x80 [ 92.899959][ T3536] do_tag_check_fault+0x34/0x44 [ 92.899959][ T3536] do_mem_abort+0x40/0x90 [ 92.899959][ T3536] el1_abort+0x44/0x64 [ 92.899959][ T3536] el1h_64_sync_handler+0x50/0xac [ 92.899959][ T3536] el1h_64_sync+0x6c/0x70 [ 92.899959][ T3536] swsusp_save+0x2cc/0x590 (P) [ 92.899959][ T3536] swsusp_arch_suspend+0x74/0x618 [ 92.899959][ T3536] hibernation_snapshot+0x208/0x438 [ 92.899959][ T3536] hibernate+0x1cc/0x3c0 [ 92.899959][ T3536] state_store+0xe8/0xf4 [ 92.899959][ T3536] kobj_attr_store+0x18/0x34 [ 92.899959][ T3536] sysfs_kf_write+0x7c/0x98 [ 92.899959][ T3536] kernfs_fop_write_iter+0x138/0x200 [ 92.899959][ T3536] vfs_write+0x244/0x36c [ 92.899959][ T3536] ksys_write+0x70/0x108 [ 92.899959][ T3536] __arm64_sys_write+0x1c/0x30 [ 92.899959][ T3536] invoke_syscall+0x54/0x10c [ 92.899959][ T3536] el0_svc_common.constprop.0+0x40/0xe0 [ 92.899959][ T3536] do_el0_svc+0x1c/0x34 [ 92.899959][ T3536] el0_svc+0x38/0x1fc [ 92.899959][ T3536] el0t_64_sync_handler+0xa0/0xf0 [ 92.899959][ T3536] el0t_64_sync+0x1a4/0x1a8 [ 92.899959][ T3536] [ 92.899959][ T3536] The buggy address belongs to the physical page: [ 92.899959][ T3536] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4341c [ 92.899959][ T3536] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 92.899959][ T3536] flags: 0x1ffec0000000040(head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0xb) [ 92.899959][ T3536] page_type: f8(unknown) [ 92.899959][ T3536] raw: 01ffec0000000040 0000000000000000 dead000000000122 0000000000000000 [ 92.899959][ T3536] raw: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 92.899959][ T3536] head: 01ffec0000000040 0000000000000000 dead000000000122 0000000000000000 [ 92.899959][ T3536] head: 0000000000000000 0000000000000000 00000000f8000000 0000000000000000 [ 92.899959][ T3536] head: 01ffec0000000002 ffffc1ffc00d0701 00000000ffffffff 00000000ffffffff [ 92.899959][ T3536] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 [ 92.899959][ T3536] page dumped because: kasan: bad access detected [ 92.899959][ T3536] [ 92.899959][ T3536] Memory state around the buggy address: [ 92.899959][ T3536] fff000000341ef00: f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 [ 92.899959][ T3536] fff000000341f000: f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 f4 [ 92.899959][ T3536] >fff000000341f100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 92.899959][ T3536] ^ [ 92.899959][ T3536] fff000000341f200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 92.899959][ T3536] fff000000341f300: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 92.899959][ T3536] ================================================================== [ 92.899959][ T3536] Disabling lock debugging due to kernel taint [ 92.900745][ T3536] Enabling non-boot CPUs ... [ 92.941088][ T0] Detected PIPT I-cache on CPU1 [ 92.946912][ T0] CPU1: Booted secondary processor 0x0000000001 [0x000f0510] [ 92.986987][ T3536] CPU1 is up [ 93.053684][ T29] virtio_blk virtio2: 2/0/0 default/read/poll queues [ 93.147565][ T3536] PM: Cannot find swap device, try swapon -a [ 93.147753][ T3536] PM: Cannot get swap writer [ 94.284512][ T3536] OOM killer enabled. [ 94.284774][ T3536] Restarting tasks: Starting [ 94.331837][ T3536] Restarting tasks: Done [ 94.332913][ T3536] PM: hibernation: hibernation exit VM DIAGNOSIS: 15:41:13 Registers: info registers vcpu 0 CPU#0 PC=ffff800081c83148 X00=0000000000012ef4 X01=fff000007f8bd988 X02=fff07ffffcd88000 X03=ffff800082b53d80 X04=fff07ffffcd88000 X05=4000000000000000 X06=0000000000000000 X07=0000000000000004 X08=ffff800082b7da78 X09=7dbe5e499ba5e3c5 X10=bb06ad74adeb2504 X11=00000000000000c0 X12=0000000000000001 X13=00000000000009ac X14=0000000000000762 X15=0000000000000000 X16=fbf000000aca4840 X17=0000000000000000 X18=0000000000000001 X19=0000000000000000 X20=ffff800082b5ed70 X21=ffff800082b390e8 X22=0000000000000000 X23=ffff800082b5ed94 X24=ffff800082b7ca00 X25=ffff8000828b0000 X26=fff000007f8ec400 X27=0000000000000000 X28=0000000000000000 X29=ffff800082b53da0 X30=ffff800081c8315c SP=ffff800082b53da0 PSTATE=604020c9 -ZC- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000000000000000 P01=0000000000000000 P02=0000000000000000 P03=0000000000000000 P04=0000000000000000 P05=0000000000000000 P06=0000000000000000 P07=0000000000000000 P08=0000000000000000 P09=0000000000000000 P10=0000000000000000 P11=0000000000000000 P12=0000000000000000 P13=0000000000000000 P14=0000000000000000 P15=0000000000000000 FFR=0000000000000000 Z00=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z01=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:00302e37332e312e:6f732e786f627973 Z02=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:fffff00000000000 Z03=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z04=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:3333333333333333:3333333333333333 Z05=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:000000000c000000 Z06=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z07=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z08=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z17=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z18=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000:0000000000000000 info registers vcpu 1 CPU#1 PC=ffff8000809adfdc X00=0000000000000002 X01=0000000000000018 X02=ffff800082f21018 X03=ffff800082cbc6b8 X04=f7f0000003fb9880 X05=000000000000000a X06=ffff800082cbc788 X07=0000000000000001 X08=f6f0000003690000 X09=0000000000000338 X10=0000000000004d58 X11=ffff800082b8ed68 X12=0000000000011b98 X13=ffff80008326bb58 X14=ffff80008326b9a0 X15=ffff80008326bb4d X16=f0f000000aca47c0 X17=0000000000000000 X18=00000000ffffffff X19=f9f0000003458031 X20=ffff8000809ae18c X21=f7f0000003fb9880 X22=f9f0000003458031 X23=ffff8000809ae18c X24=0000000000000031 X25=f6f0000003690000 X26=0000000000000001 X27=0000000000000000 X28=0000000000000000 X29=ffff80008326bcc0 X30=ffff8000809ae1b4 SP=ffff80008326bcc0 PSTATE=814000c9 N--- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=0000000000000000:0000000000000000 Z01=0000000000000000:0000000000000000 Z02=0000000000000000:0000000000000000 Z03=0000000000000000:0000000000000000 Z04=0000000000000000:0000000000000000 Z05=0000000000000000:0000000000000000 Z06=0000000000000000:0000000000000000 Z07=0000000000000000:0000000000000000 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000 Z17=0000000000000000:0000000000000000 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000