last executing test programs: 23m12.925981088s ago: executing program 0 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) (async) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r1, 0x4068aea3, &(0x7f00000001c0)) (async) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r4 = syz_kvm_vgic_v3_setup(r3, 0x1, 0x40) ioctl$KVM_HAS_DEVICE_ATTR(r4, 0x4018aee3, &(0x7f0000000080)=@attr_other={0x0, 0x5, 0x2, 0x0}) (async) r5 = mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x0, 0x4, 0x110, 0xffffffffffffffff, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x100a83, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r7, 0xae60) (async) ioctl$KVM_SET_GSI_ROUTING(r7, 0x4008ae6a, &(0x7f00000002c0)={0x2, 0x0, [{0x3, 0x1, 0x0, 0x0, @adapter={0x0, 0x0, 0x8, 0x5, 0x3}}, {0x3, 0x5, 0x0, 0x0, @msi={0x1, 0x5, 0x0, 0xcfb}}]}) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) (async) ioctl$KVM_CAP_HALT_POLL(r9, 0x4068aea3, &(0x7f0000000000)={0xdf, 0x0, 0x10000}) (async) ioctl$KVM_CAP_HALT_POLL(r9, 0x4068aea3, &(0x7f0000000000)={0xe1}) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000000)="bce46c80352f2d65af06b6b896ff1ad4516c9e4dd5a28dea9591fce03711eb8af9b9c218ce4701b68ae20d7f1e7fa868311d947ae8d1b7165ab666a1c56a06c7e2ead92f00", 0x0, 0x48) ioctl$KVM_CAP_ARM_INJECT_SERROR_ESR(r1, 0x4068aea3, &(0x7f0000000140)) 23m5.485087473s ago: executing program 1 (id=5): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0x0, &(0x7f00000002c0), 0x42000, 0x0) (async) openat$kvm(0x0, &(0x7f00000002c0), 0x42000, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x4) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000004}}], 0x50}, 0x0, 0x0) (async) syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000004}}], 0x50}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000340), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CAP_ARM_USER_IRQ(r5, 0x4068aea3, &(0x7f0000000240)) syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000280)={0x0, &(0x7f0000000000)=[@its_setup={0x82, 0x28, {0x0, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x802, 0x40000008, 0x0, 0x80}}], 0x50}, 0x0, 0x0) (async) r6 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000280)={0x0, &(0x7f0000000000)=[@its_setup={0x82, 0x28, {0x0, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x802, 0x40000008, 0x0, 0x80}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r10, 0x4020aeae, &(0x7f0000000140)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r10, 0x4010aeac, &(0x7f0000000040)=@arm64_core={0x6030000000100050, &(0x7f0000000000)=0x85c7}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x5, 0xffffffffffffffff, 0x1}) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x5, 0xffffffffffffffff, 0x1}) ioctl$KVM_HAS_DEVICE_ATTR(r11, 0x4018aee3, &(0x7f0000000240)=@attr_other={0x0, 0x7fffffff, 0x7f, &(0x7f0000000140)=0x8}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 22m56.342712262s ago: executing program 0 (id=6): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) (async) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000fec000/0x11000)=nil, 0x0, 0x2000002, 0x8010, r5, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r5, 0x0) (async) openat$kvm(0x0, 0x0, 0x0, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r7 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, 0x0, 0x0, 0x0) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0xe0000, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=[@featur1={0x1, 0x4}], 0x1) (async) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000003, [0x4, 0x100000003, 0x5, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r11, 0xae80, 0x0) (async) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001640), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r12, 0xae03, 0xea) (async) syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x2000003, 0x11, r5, 0x0) r13 = eventfd2(0x0, 0x0) close(r13) (async) openat$kvm(0xffffff9c, &(0x7f0000000100), 0x1e57b2, 0x1f01) write$eventfd(r13, &(0x7f0000000180)=0x5, 0xfffffde3) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) (async) write$eventfd(r13, 0x0, 0x0) 22m54.610674468s ago: executing program 1 (id=7): mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000004, 0x40032, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$KVM_SET_DEVICE_ATTR(r0, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x6, 0x86, &(0x7f0000000000)=0x961d}) 22m48.656507743s ago: executing program 1 (id=8): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0x8}) r6 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bc2000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x36) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) r11 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x2010, r10, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r11, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r10, 0x0) r12 = eventfd2(0x0, 0x0) close(r12) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01) write$eventfd(r12, &(0x7f0000000180)=0x5, 0xfffffde3) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) write$eventfd(r12, 0x0, 0x0) syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000100)=[@featur1={0x1, 0x83}], 0x1) 22m48.398102722s ago: executing program 0 (id=9): munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0x801c581f, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x1000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bc2000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) 22m38.758586385s ago: executing program 1 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x181b03, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r4, 0x400454de, 0x110c23000a) r5 = eventfd2(0xeffffffd, 0x801) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x25) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, 0x0}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f0000000240)=@arm64_core={0x603000000010003c, &(0x7f0000000080)=0x5}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x200, 0x4000, 0x4, r5, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x2, r5, 0x3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x2, r5, 0xf}) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x27) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x0, 0x0, 0x6, 0x0, 0x9}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r14, 0xae80, 0x0) 22m34.757045556s ago: executing program 0 (id=11): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f00000000c0)=@arm64_fw={0x6030000000140001, &(0x7f00000003c0)=0x6}) r7 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r7, 0x4004ae8b, &(0x7f0000000040)={0x8, "22f1ebbef8b17f4b"}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 22m24.10855669s ago: executing program 0 (id=12): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r2 = mmap$KVM_VCPU(&(0x7f0000c58000/0x1000)=nil, r1, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x8, 0x8000000000000001, 0xffffffffffffffff}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f0000000580)="892bd021b85d2e2c634b14db20c70d2613d1367960a62b59b4005102ee41873e97f75d16f76a3f9e7228032a6d673389ab58b9d3dca77ecf57fd32e2e1a0598faaa1a52221283684", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f00000004c0)={0x0, &(0x7f0000000600)=[@msr={0x14, 0x20, {0x603000000013801e, 0x1}}, @code={0xa, 0x9c, {"000008d5000008d5007c200e60e382d200c0b0f2410080d2a20180d2e30180d2e40080d2020000d4007008d520798cd200c0b8f2610080d2e20180d2030180d2a40180d2020000d4008008d5000008d5406986d200c0b8f2210080d2020180d2a30180d2440180d2020000d4c0078fd20020b0f2c10080d2220180d2230080d2240080d2020000d4"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x2ac}}, @uexit={0x0, 0x18, 0xe}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x100, 0x400, 0x9}}, @code={0xa, 0x54, {"007008d5007008d5000040b3405d87d20040b8f2a10080d2220180d2c30080d2c40080d2020000d400d4a02e00c0c00d00d8212e000028d5007008d5000028d5"}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x1, 0x1, 0xc, 0x1, 0x2}}, @eret={0xe6, 0x18, 0x200}, @irq_setup={0x46, 0x18, {0x2, 0x140}}, @msr={0x14, 0x20, {0x603000000013c016, 0xf}}, @eret={0xe6, 0x18, 0xc73}, @smc={0x1e, 0x40, {0x8400000a, [0x5, 0x81, 0x3, 0x0, 0x8]}}, @eret={0xe6, 0x18, 0x6}, @its_setup={0x82, 0x28, {0x2, 0x4, 0x3a7}}, @hvc={0x32, 0x40, {0xc5000020, [0x524e, 0x0, 0x6, 0x7d, 0x4]}}, @irq_setup={0x46, 0x18, {0x4, 0x72}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x23f}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x100, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x4, 0x1, 0x8, 0x8}}, @its_setup={0x82, 0x28, {0x4, 0x6, 0x38a}}, @svc={0x122, 0x40, {0x4000000, [0x1, 0x100, 0x7, 0x5, 0x4]}}, @code={0xa, 0x9c, {"007008d5007008d5c0128bd20020b0f2c10080d2a20180d2a30180d2240180d2020000d40040000e007008d5008008d5408085d200e0b0f2610180d2820180d2630080d2e40180d2020000d440c492d20060b0f2810080d2c20080d2e30080d2c40080d2020000d4e0ab93d200e0b0f2210080d2820080d2230180d2040080d2020000d4007008d5"}}], 0x46c}, &(0x7f0000000500)=[@featur1={0x1, 0x50}], 0x1) ioctl$KVM_PRE_FAULT_MEMORY(r7, 0xc040aed5, &(0x7f0000000540)={0xdddd0000, 0x5000}) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) mmap$KVM_VCPU(&(0x7f000064b000/0x4000)=nil, r8, 0x100000d, 0x9032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000667000/0x2000)=nil, 0x2000) r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0xd) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r13, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000140001, 0x0}) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000763000/0x400000)=nil) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x800, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r15, 0xc008ae67, 0xfffffffffffffffe) 22m18.925511866s ago: executing program 1 (id=13): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x2000) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x108, &(0x7f0000000340)=0xfffffffffffffffc}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0x5460, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2e) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000100)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x603000000010001a, &(0x7f00000000c0)=0x11}) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000080)=@arm64={0xe6, 0x7, 0x8, '\x00', 0xff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) 22m1.422149534s ago: executing program 0 (id=14): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000140)=[{0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1e000000000000004000000000000000000000ef00000000fcffffffffffff1bf3a3b292e50d9600020000000100000003000000000000000400000000000000320000000000000040000000000000005200008400"], 0x80}], 0x1, 0x0, 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31) r5 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 21m58.673911613s ago: executing program 1 (id=15): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000340)=[@uexit={0x0, 0x18, 0x3}], 0x18}, 0x0, 0x0) r5 = syz_kvm_vgic_v3_setup(r1, 0x2, 0x100) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0xfffffffffffffffd) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100006, &(0x7f0000000100)=0xc5c5}) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r10 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r9, 0x3, 0x11, r3, 0x0) r11 = mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, r9, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r4, r11, 0xffffffffffffffff) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = eventfd2(0x8, 0x80800) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r4, 0x4018aee2, &(0x7f0000000280)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000240)=0x8}) r15 = eventfd2(0x8, 0x0) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f00000000c0)={0x4, 0x25000, 0x0, r15, 0x2}) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f0000000140)={0x8000000000000002, 0x0, 0x2, r14, 0x2}) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x2, r14, 0x3}) write$eventfd(r15, &(0x7f0000000200)=0x6, 0x8) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) ioctl$KVM_GET_DEVICE_ATTR_vm(r5, 0x4018aee2, &(0x7f00000001c0)=@attr_other={0x0, 0x200, 0xd0, &(0x7f0000000000)=0x3b80000000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000002c0)="ac0d180b6924ef465522105fa43d42b99dc26cc4ec3619041e5612e171f412056c4ed942ddc1fb0cce22fa8ccda90d47f7cf8f964c56f6297a432e8f1b64caf647b383ccf9b0b0fb", 0x0, 0x48) syz_kvm_assert_syzos_uexit$arm64(r3, r10, 0xfffffffffffffffe) 21m7.964501264s ago: executing program 32 (id=14): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000140)=[{0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1e000000000000004000000000000000000000ef00000000fcffffffffffff1bf3a3b292e50d9600020000000100000003000000000000000400000000000000320000000000000040000000000000005200008400"], 0x80}], 0x1, 0x0, 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31) r5 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 21m1.813955865s ago: executing program 33 (id=15): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000340)=[@uexit={0x0, 0x18, 0x3}], 0x18}, 0x0, 0x0) r5 = syz_kvm_vgic_v3_setup(r1, 0x2, 0x100) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0xfffffffffffffffd) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100006, &(0x7f0000000100)=0xc5c5}) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r10 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r9, 0x3, 0x11, r3, 0x0) r11 = mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, r9, 0x3, 0x11, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r4, r11, 0xffffffffffffffff) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = eventfd2(0x8, 0x80800) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r4, 0x4018aee2, &(0x7f0000000280)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000240)=0x8}) r15 = eventfd2(0x8, 0x0) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f00000000c0)={0x4, 0x25000, 0x0, r15, 0x2}) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f0000000140)={0x8000000000000002, 0x0, 0x2, r14, 0x2}) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x2, r14, 0x3}) write$eventfd(r15, &(0x7f0000000200)=0x6, 0x8) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) ioctl$KVM_GET_DEVICE_ATTR_vm(r5, 0x4018aee2, &(0x7f00000001c0)=@attr_other={0x0, 0x200, 0xd0, &(0x7f0000000000)=0x3b80000000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000002c0)="ac0d180b6924ef465522105fa43d42b99dc26cc4ec3619041e5612e171f412056c4ed942ddc1fb0cce22fa8ccda90d47f7cf8f964c56f6297a432e8f1b64caf647b383ccf9b0b0fb", 0x0, 0x48) syz_kvm_assert_syzos_uexit$arm64(r3, r10, 0xfffffffffffffffe) 13m35.617168669s ago: executing program 2 (id=16): r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, &(0x7f0000000780)=[@svc={0x122, 0x40, {0x800, [0x7fffffff, 0x4, 0x9, 0xff, 0x1]}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0xd00, 0x400, 0x1}}, @svc={0x122, 0x0, {0x1, [0x80, 0x5, 0x2, 0x7, 0xb]}}, @smc={0x1e, 0x40, {0xc4000005, [0x8, 0xa50, 0x0, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x1, 0x0, 0xd, 0x9, 0x40, 0x1}}, @msr={0x14, 0x20, {0x58d, 0x3}}, @its_setup={0x82, 0x28, {0x2, 0x4, 0x3bb}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x4, 0x9, 0x14, 0x4}}, @code={0xa, 0x84, {"0020005e007008d5e0ff92d200c0b8f2c10080d2c20180d2830180d2640080d2020000d4804195d20080b8f2e10180d2e20180d2c30080d2640180d2020000d4000008d50008c038000008d5e00300b2008008d5a07b88d20060b0f2210080d2020080d2230080d2640180d2020000d4"}}, @irq_setup={0x46, 0x18, {0x1, 0x73}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x3, 0x10, 0x2, 0x4135, 0x3}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x1, 0x1, 0xd, 0x8, 0x8d, 0x2}}, @hvc={0x32, 0x40, {0x84000000, [0x8, 0x5, 0x3, 0x401, 0x4]}}, @msr={0x14, 0x20, {0x603000000013c65e}}, @irq_setup={0x46, 0x18, {0x3, 0x25b}}, @svc={0x122, 0x40, {0x86000001, [0xe1, 0x4, 0x9, 0xdb, 0xa]}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x180, 0x5f722c75, 0x5}}, @its_setup={0x82, 0x28, {0x4, 0x0, 0x38}}, @code={0xa, 0x9c, {"0068201e000f8cd20080b0f2010080d2420180d2830180d2440080d2020000d4c0f592d200e0b0f2a10180d2c20080d2c30080d2040080d2020000d4401191d20060b0f2810080d2620080d2a30180d2440080d2020000d4000008d50008a0b8007008d5007008d50020201e403d8bd20040b8f2410180d2620180d2030080d2c40080d2020000d4"}}, @mrs={0xbe, 0x18, {0x603000000013deb4}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x0, 0x0, 0x8}}, @irq_setup={0x46, 0x18, {0x2, 0x3b5}}, @memwrite={0x6e, 0x62, @generic={0xf000, 0x1ae, 0x8, 0xf}}, @hvc={0x32, 0x40, {0x2000, [0x7, 0x0, 0x4c, 0x2, 0x2]}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x40, 0xdb, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x1, 0x1, 0xc, 0x7}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x3, 0x10, 0x6, 0x5}}, @eret={0xe6, 0x18, 0x3}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1ae}}, @irq_setup={0x46, 0x18, {0x2, 0x247}}, @msr={0x14, 0x20, {0x603000000013c019, 0x8}}], 0x5d8}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r0, 0x1000018, 0x100010, r4, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f00000000c0)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r6, 0xc018aec0, &(0x7f00000000c0)={0x5, 0xffffffffffffffff, 0x1}) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x36) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000000)={0x10200, 0x0, 0x4, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x1000000) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) 13m26.112051558s ago: executing program 3 (id=18): mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f0000000040)=@x86={0x7, 0x7f, 0x4, 0x0, 0x9, 0x1, 0x4, 0xb, 0x6, 0x7, 0x6, 0x4, 0x0, 0x8, 0x954, 0x4, 0x1, 0x4, 0xf5, '\x00', 0x1, 0x80000001}) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r1, 0x4018aee2, &(0x7f0000000000)=@attr_pmu_init) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, 0x930, 0x0, 0x8032, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, &(0x7f00000000c0)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000080)=0x1}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) 13m12.640229798s ago: executing program 2 (id=19): r0 = openat$kvm(0x0, &(0x7f00000001c0), 0x2083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000073000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, 0x0, 0x1000000, 0x40010, r1, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0xc000, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_IRQFD(r8, 0x4020ae76, &(0x7f0000000080)={0xffffffffffffffff, 0x8, 0x7ffffffe}) r9 = ioctl$KVM_CREATE_VM(r6, 0x80111500, 0x20000000) close(r9) ioctl$KVM_GET_STATS_FD_vm(r5, 0xaece) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0x80111500, 0x20000000) ioctl$KVM_CREATE_VM(r11, 0x541b, 0x20) r12 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x3) r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r16 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x181900, 0x0) r17 = ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r17, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r18, 0x400454d9, 0x13) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r15, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x1, 0x4, &(0x7f0000000240)=0x2}) syz_kvm_add_vcpu$arm64(r14, 0x0, &(0x7f0000000440)=[@featur1={0x1, 0x57}], 0x1) 13m11.838299692s ago: executing program 3 (id=20): r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x18) ioctl$KVM_GET_DIRTY_LOG(r6, 0x4010ae42, &(0x7f0000000000)={0x10002, 0x0, &(0x7f0000ffc000/0x2000)=nil}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000140)=0x80000001}) r7 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000300)={0x0, &(0x7f0000000480)=[@smc={0x1e, 0x40, {0xc4000001, [0x8, 0x939, 0xe, 0x7f, 0x4]}}], 0x40}, &(0x7f00000001c0)=[@featur1={0x1, 0xc}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) ioctl$KVM_RUN(r8, 0xae80, 0x0) 12m58.585272356s ago: executing program 2 (id=21): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21) close(0xffffffffffffffff) (async) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x8002) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_IRQ_LINE(r4, 0x4008ae61, &(0x7f0000000100)={0x1002000, 0x1}) r5 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000080)="fb4149dd033be3ac2ca5a22332a70000000000000071b14c94a6ab8031d1dfd90f05000000010000521ce16f8f1f449a7a8356733169d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r2, 0x0) openat$kvm(0x0, &(0x7f0000000000), 0x4c4882, 0x0) 12m46.559133856s ago: executing program 3 (id=22): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x21) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r3, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r3, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x4c4882, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0x40086602, 0x110c230000) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2a) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0xf4) 12m43.494528705s ago: executing program 2 (id=23): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x0, 0x1}}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r4, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000100)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x29) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000340)=[@uexit={0x0, 0x18, 0x1f95}], 0x18}, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r7, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000080)=@x86={0x5, 0x1, 0x5, 0x0, 0xb, 0x1, 0x2, 0xe, 0x3, 0x2e, 0xe, 0xc0, 0x0, 0x9db, 0x101, 0xf2, 0x7f, 0x80, 0xc, '\x00', 0x6, 0x4}) 12m33.793665885s ago: executing program 3 (id=24): r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000680)=[@irq_setup={0x46, 0x18, {0x2, 0x18}}, @uexit={0x0, 0x18, 0x1}, @memwrite={0x6e, 0x30, @generic={0x4000, 0x3e3, 0x7, 0xb}}, @msr={0x14, 0x20, {0x603000000013c4ca, 0x80000000}}, @smc={0x1e, 0x40, {0x84000007, [0x7, 0x10001, 0x2, 0x2, 0x1]}}, @uexit={0x0, 0x18, 0x5}, @svc={0x122, 0x40, {0xc5000021, [0x5d5c1bbe, 0xfffffffffffff801, 0x8000, 0x6, 0x100000000]}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x4, 0xe, 0x5, 0x6, 0x4}}, @uexit={0x0, 0x18, 0x3}, @uexit={0x0, 0x18, 0x5}, @msr={0x14, 0x20, {0x811, 0x7fff}}, @smc={0x1e, 0x40, {0x8600ff01, [0x8, 0x4, 0xffffffffffffff11, 0x9a, 0x1]}}], 0x1d0}, &(0x7f0000000140)=[@featur2], 0x1) mmap$KVM_VCPU(&(0x7f0000c33000/0x2000)=nil, r0, 0xf, 0x8010, r1, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x80402, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2c) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000a49000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, &(0x7f0000000280)=[@mrs={0xbe, 0x18, {0x603000000013800f}}, @irq_setup={0x46, 0x18, {0x3, 0x2f5}}, @its_setup={0x82, 0x28, {0x2, 0x0, 0x2e9}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x2fa}}, @eret={0xe6, 0x18, 0x8}], 0x98}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(r3, r5, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000340)=[@smc={0x1e, 0x40, {0x400, [0x5, 0x6d4a, 0xd0, 0x7]}}, @code={0xa, 0x9c, {"e0299dd200e0b0f2a10080d2220080d2630080d2840180d2020000d480139ed20020b0f2a10180d2a20080d2030180d2040180d2020000d4403398d200a0b0f2810180d2420180d2630180d2e40180d2020000d40030000e00e4005f20a192d20060b0f2210180d2a20180d2a30080d2440080d2020000d40000239e0000400c000008d50074000f"}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x2d5}}, @hvc={0x32, 0x40, {0x32000000, [0xa, 0x4, 0x9, 0x3, 0x9]}}, @mrs={0xbe, 0x18, {0x603000000013def9}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x1, 0x2, 0x0, 0x41, 0xb7a2, 0x1}}, @msr={0x14, 0x20, {0x603000000013c201, 0xffffffffffffff00}}, @irq_setup={0x46, 0x18, {0x2, 0x3}}, @smc={0x1e, 0x40, {0x40000000, [0x5, 0x6, 0x200, 0xfff, 0x5bc]}}, @irq_setup={0x46, 0x18, {0x4, 0x35a}}, @irq_setup={0x46, 0x18, {0x2, 0x140}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x1, 0x4, 0x8, 0x5515, 0x8, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xc, 0x401, 0x1}}, @code={0xa, 0x9c, {"00b8215e20479ad20060b0f2a10080d2220180d2c30080d2640080d2020000d40000241e000080ad008008d5009186d20040b0f2e10180d2220080d2430180d2a40180d2020000d460b093d200c0b8f2e10080d2c20080d2830180d2840180d2020000d4007008d5409788d20060b8f2c10180d2a20180d2830080d2240080d2020000d4007008d5"}}], 0x320}], 0x1, 0x0, &(0x7f0000000040)=[@featur1={0x1, 0x1}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) 12m21.718036307s ago: executing program 2 (id=25): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x9, 0x1) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, r4}) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000001c0)="f21bc75509bf71c9d70236fc044842da01000000000000004c24501958da2e2c18b875c2357c6ed600", 0x0, 0x48) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) write$eventfd(r5, &(0x7f00000001c0)=0xffffff7f, 0xff25) r6 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x1}}, @its_setup={0x82, 0x28, {0x3, 0x1, 0x3ee}}], 0x50}, 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000140001, 0x0}) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000000)={0xfffff828, 0x6}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r3, 0x4010aeb5, &(0x7f0000000040)={0x9, 0x7}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 12m18.609810318s ago: executing program 3 (id=26): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x29) r4 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) r7 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r6, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r6, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000000)=@arm64={0x0, 0x1, 0xf, '\x00', 0xfffffffffffff105}) ioctl$KVM_CREATE_VM(r8, 0x401c5820, 0x20000001) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000340)=[@its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x3, 0x10, 0x8, 0x8, 0x2}}, @svc={0x122, 0x40, {0x100, [0x9, 0x7030, 0x3, 0x5, 0x3]}}, @code={0xa, 0x6c, {"008008d50044207e0000809a007008d5006c200e007c001b20ec99d20040b8f2810180d2e20180d2230180d2240180d2020000d4a0a19dd20080b0f2810180d2620080d2630080d2640080d2020000d40820601e000008d5"}}], 0xd4}, 0x0, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r10 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r9, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000100)={0x202, 0x2, 0x1, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) 12m0.614330981s ago: executing program 2 (id=27): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2b) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000240)={0x1, 0xe000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x3000, 0x122000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000001480)={0xfdfd, 0x13000, 0x1}) r2 = openat$kvm(0x0, &(0x7f0000000040), 0xe0000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000003, [0x1000004, 0x100000003, 0x5, 0x101, 0x9]}}], 0xfffffea4}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x33) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0xdddd1000, 0x0, r9}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000000)={0xc, 0xeeef0000, 0x2, r9}) (async) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000080)={0x5, 0x7000, 0x4, r9, 0x9}) 11m55.18025603s ago: executing program 3 (id=28): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000240)=[@hvc={0x32, 0x40, {0x84000050, [0x9, 0xb4, 0x100, 0x6, 0x88]}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x2, 0x6, 0x8, 0x102}}], 0x68}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@memwrite={0x6e, 0x30, @generic={0x8000000, 0x8ea, 0xa420, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x10, 0x10000, 0x0, 0x40000004}}], 0xa6}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000040)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000200)=@attr_arm64={0x0, 0x1, 0x1, &(0x7f00000001c0)=0xc}) r10 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r12, 0x4020aeae, &(0x7f0000000040)={0x5}) ioctl$KVM_RUN(r12, 0xae80, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000001c0)="57ab104b263109323526c8a07f3bccefa6e9025825473e51e830f7bac7110701d044a0808b946794e9a5b047596a9f894c98d14500b893c9d2add431cbf1bf9f9518486cc05248c6", 0x0, 0x48) ioctl$KVM_ARM_PREFERRED_TARGET(r12, 0x8020aeaf, &(0x7f0000000180)) r13 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x1010, 0xffffffffffffffff, 0x0) r14 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r15, &(0x7f0000c00000/0x400000)=nil) 11m12.719063151s ago: executing program 34 (id=27): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2b) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000240)={0x1, 0xe000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000080)={0x3000, 0x122000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000001480)={0xfdfd, 0x13000, 0x1}) r2 = openat$kvm(0x0, &(0x7f0000000040), 0xe0000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000003, [0x1000004, 0x100000003, 0x5, 0x101, 0x9]}}], 0xfffffea4}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x33) (async) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0xdddd1000, 0x0, r9}) ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000000)={0xc, 0xeeef0000, 0x2, r9}) (async) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000080)={0x5, 0x7000, 0x4, r9, 0x9}) 11m5.93891961s ago: executing program 35 (id=28): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000240)=[@hvc={0x32, 0x40, {0x84000050, [0x9, 0xb4, 0x100, 0x6, 0x88]}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x2, 0x6, 0x8, 0x102}}], 0x68}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@memwrite={0x6e, 0x30, @generic={0x8000000, 0x8ea, 0xa420, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x10, 0x10000, 0x0, 0x40000004}}], 0xa6}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000040)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000200)=@attr_arm64={0x0, 0x1, 0x1, &(0x7f00000001c0)=0xc}) r10 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r12, 0x4020aeae, &(0x7f0000000040)={0x5}) ioctl$KVM_RUN(r12, 0xae80, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000001c0)="57ab104b263109323526c8a07f3bccefa6e9025825473e51e830f7bac7110701d044a0808b946794e9a5b047596a9f894c98d14500b893c9d2add431cbf1bf9f9518486cc05248c6", 0x0, 0x48) ioctl$KVM_ARM_PREFERRED_TARGET(r12, 0x8020aeaf, &(0x7f0000000180)) r13 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x1010, 0xffffffffffffffff, 0x0) r14 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r15, &(0x7f0000c00000/0x400000)=nil) 2m58.462871404s ago: executing program 4 (id=32): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000200)={0x1fd, 0x2, 0x8000000, 0x2000, &(0x7f0000ecf000/0x2000)=nil}) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r4 = eventfd2(0xeffffffd, 0x801) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x200, 0x4000, 0x4, r4, 0x1}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x2, r4, 0x3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x2, r4, 0xf}) 2m39.363533757s ago: executing program 4 (id=34): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x300, 0x0) r1 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r4 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r3, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fb707cd24b7eebb20700000000000000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r3, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) r8 = syz_kvm_vgic_v3_setup(r6, 0x3, 0xa0) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x6, 0x4, &(0x7f0000000000)=0x4}) (async) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r9, 0x40305839, 0x19) (async) r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r13, 0x4040aea0, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r13, 0x8040ae9f, &(0x7f0000000000)=@arm64) (async) r14 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r15 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r16 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r16, 0x0) mmap$KVM_VCPU(&(0x7f0000e04000/0x2000)=nil, 0x930, 0x1, 0x11, r16, 0x0) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r15, 0xae04) (async) r17 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) ioctl$KVM_CREATE_VM(r17, 0xae01, 0x2e) 2m29.193918394s ago: executing program 5 (id=35): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x82880, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x101282, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000c0b000/0x1000)=nil, r5, 0x3, 0x40b2811, r4, 0x6000) 2m20.953740423s ago: executing program 4 (id=36): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x1011, r2, 0x0) (async) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000680)=[@mrs={0xbe, 0x18, {0x603000000013c800}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) (async) r8 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, r9, 0x1000000, 0x4004012, r7, 0x0) (async) r10 = eventfd2(0x0, 0x0) close(r10) (async) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01) write$eventfd(r10, &(0x7f0000000180)=0x5, 0xfffffde3) (async) write$eventfd(r10, 0x0, 0x0) (async) r11 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000b80)={0x0, &(0x7f00000002c0)=[@smc={0x1e, 0x40, {0xc5000020, [0x8, 0x7, 0xa, 0x0, 0x1]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) (async) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r13, 0x80111500, 0xfffffffffffff000) ioctl$KVM_RUN(r12, 0xae80, 0x0) syz_kvm_setup_cpu$arm64(r8, r12, &(0x7f0000922000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013de95, 0xef}}, @its_setup={0x82, 0x28, {0x2, 0x0, 0x225}}, @eret={0xe6, 0x18, 0x40}, @smc={0x1e, 0x40, {0x80000001, [0x9, 0xf10, 0x757, 0xfffffffffffffffc, 0x7fffffffffffffff]}}, @irq_setup={0x46, 0x18, {0x0, 0x16f}}, @hvc={0x32, 0x40, {0x80000002, [0x57, 0x6, 0x6, 0x16, 0x200]}}, @irq_setup={0x46, 0x18, {0x3, 0x2ee}}, @smc={0x1e, 0x40, {0x0, [0x9, 0x2, 0x6, 0x8000000000000001, 0x5]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x80, 0xffffffffffffffff, 0x9}}, @code={0xa, 0x54, {"000028d5000c8038007008d5000008d5007008d5007008d5007008d540628dd200e0b0f2210180d2c20080d2630180d2e40180d2020000d4007008d5007008d5"}}, @irq_setup={0x46, 0x18, {0x0, 0xcc}}, @code={0xa, 0x6c, {"0080000d202596d20040b0f2e10180d2820080d2630080d2c40180d2020000d40000005a0000641e0000201f0054207e007008d5803185d20000b8f2210080d2e20080d2e30080d2040080d2020000d40000701e000040ba"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x3ec}}, @smc={0x1e, 0x40, {0x84000002, [0x8, 0x7ff, 0x8000000000, 0x2, 0x1]}}, @msr={0x14, 0x20, {0x603000000013dcf3, 0xb973}}, @msr={0x14, 0x20, {0x603000000013e18e, 0x3}}, @mrs={0xbe, 0x18, {0x603000000013c00d}}, @code={0xa, 0x84, {"0050204e000008d580188bd200e0b8f2810080d2a20080d2030080d2a40080d2020000d40000c02800fc000f002196d20080b8f2810180d2e20080d2e30180d2e40080d2020000d4007d92d20040b8f2610080d2a20180d2030180d2a40080d2020000d4007008d5007008d5007ca09b"}}], 0x39c}], 0x1, 0x0, &(0x7f0000000100)=[@featur2={0x1, 0x88}], 0x1) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) (rerun: 32) 2m12.112441252s ago: executing program 5 (id=37): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xb8000, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x2f) r2 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00000000000000f500", 0x0, 0xffffffffffffff32) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r4, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) r5 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000140)={0x0, &(0x7f0000000300)=[@msr={0x14, 0x20, {0x603000000013fe07, 0xfffffffffffffff7}}, @msr={0x14, 0x20, {0x603000000013df7a, 0x3e52}}, @irq_setup={0x46, 0x18, {0x0, 0x2fe}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x0, 0xc, 0xe, 0x4ee3}}, @hvc={0x32, 0x40, {0x1c8008018, [0x4, 0x3, 0x0, 0x40, 0x1ff]}}, @irq_setup={0x46, 0x18, {0x3, 0xd3}}, @msr={0x14, 0x20, {0x603000000013da17, 0xfffffffffffffdbd}}, @irq_setup={0x46, 0x18, {0x2, 0x2ec}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x800, 0xfffffffffffffeff, 0x2}}, @eret={0xe6, 0x18, 0x700ef37c}, @eret={0xe6, 0x18, 0x8000000000000000}, @irq_setup={0x46, 0x18, {0x4, 0x190}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x2, 0xb, 0x100, 0x1, 0x3}}, @hvc={0x32, 0x40, {0x80008000, [0xff, 0x8, 0x0, 0x1, 0x8]}}, @msr={0x14, 0x20, {0x603000000013e66c, 0x5}}, @eret={0xe6, 0x18, 0xfffffffffffffffb}, @uexit={0x0, 0x18}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x4, 0xf, 0x4, 0x46, 0x100001}}, @irq_setup={0x46, 0x18, {0x3, 0x3ac}}, @eret={0xe6, 0x18, 0x2}, @mrs={0xbe, 0x18, {0x603000000013df42}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x1, 0xc, 0x4, 0x0, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x1, 0x7, 0x1e08, 0xfffffffa, 0x3}}], 0x300}, &(0x7f0000000200)=[@featur1={0x1, 0x1}], 0x1) r6 = eventfd2(0xfffffff9, 0x800) write$eventfd(r6, &(0x7f0000000640)=0xa, 0x8) close(0xffffffffffffffff) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0x7ff, 0x8, &(0x7f0000000240)=0x7}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) 2m1.577620673s ago: executing program 4 (id=38): r0 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x183643, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x86000001, [0x99b, 0x100000003, 0x5, 0x101, 0x10]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r7, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) r8 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000140)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x290}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x300, 0x7, 0xa}}, @uexit={0x0, 0x18, 0x3}, @irq_setup={0x46, 0x18, {0x3, 0x221}}, @smc={0x1e, 0x40, {0x8000, [0x4, 0x81, 0xa264, 0x136, 0x2]}}, @uexit={0x0, 0x18, 0x5}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x0, 0xf, 0xd55, 0x1, 0x3}}, @svc={0x122, 0x40, {0x84000012, [0x3, 0x8, 0x3, 0x4, 0xffffffff]}}, @mrs={0xbe, 0x18, {0x603000000013c4c9}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x50, 0x3}}], 0x190}, &(0x7f0000000040)=[@featur1={0x1, 0xfd3b8a24da921a1a}], 0x1) mmap$KVM_VCPU(&(0x7f0000cd1000/0x4000)=nil, r7, 0x0, 0x20010, r8, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) 1m54.432156029s ago: executing program 5 (id=39): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x80001, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0x0, 0x2}) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000240)={0x0, &(0x7f00000000c0)=[@its_setup={0x82, 0x28, {0x3, 0x95d9, 0x197}}], 0x28}, 0x0, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x21) r8 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0x80087601, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r9, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r9, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r9, 0xaece) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x0, 0x300000c, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) 1m34.358890845s ago: executing program 4 (id=40): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r2 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x57) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x9c, {"000c4078000008d5003c004e403b87d20080b8f2810180d2e20080d2430180d2040080d2020000d4007008d5007008d5e04c82d200e0b0f2210180d2a20080d2e30080d2840080d2020000d4a0208ed20040b0f2e10180d2020080d2a30080d2c40180d2020000d400da9bd200a0b0f2410180d2020180d2e30080d2a40180d2020000d4000008d5"}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x1, 0xb, 0x3, 0x6}}, @uexit={0x0, 0x18, 0x18}, @smc={0x1e, 0x40, {0x8, [0x1, 0x2, 0xf6de, 0x3, 0x36d5]}}, @uexit={0x0, 0x18, 0x3}, @irq_setup={0x46, 0x18, {0x4, 0x307}}, @uexit={0x0, 0x18, 0x2a0c00000000000}, @smc={0x1e, 0x40, {0x80008000, [0x5, 0x3, 0x5, 0xd]}}, @eret={0xe6, 0x18, 0x100000001}, @its_setup={0x82, 0x28, {0x4, 0x2, 0x3de}}, @hvc={0x32, 0x40, {0x80, [0x2, 0xc, 0x4, 0x9]}}, @irq_setup={0x46, 0x18, {0x1, 0x77}}, @smc={0x1e, 0x40, {0x84000051, [0x8000, 0x101, 0xa, 0x8, 0x98]}}, @msr={0x14, 0x20, {0x603000000013e132, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x0, 0x4, 0xb, 0x0, 0x7, 0x1}}, @memwrite={0x6e, 0x30, @generic={0x80a0000, 0x7fffffffffffffff, 0x867, 0x9}}, @eret={0xe6, 0x18, 0x9}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x18a}}, @hvc={0x32, 0x40, {0x80000002, [0x2, 0x4, 0xdc]}}, @mrs={0xbe, 0x18, {0x603000000013e6dc}}], 0x38c}, &(0x7f0000000480)=[@featur2={0x1, 0x90}], 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r4 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) close(r3) syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) close(0x4) close(0x5) (async) close(0x5) 1m32.990491456s ago: executing program 5 (id=41): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0x801c581f, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bc2000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000180)=@attr_other={0x0, 0x5, 0x2, &(0x7f0000000300)=0x1}) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x28) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) 1m16.912100646s ago: executing program 4 (id=42): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$arm64(r1, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000100)=@arm64={0x4e, 0x2, 0x0, '\x00', 0x4}) r3 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x41000000000024) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r6 = openat$kvm(0x0, &(0x7f0000000140), 0x503002, 0x0) ioctl$KVM_CREATE_VM(r6, 0x801c581f, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101400, 0x0) r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x213) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r9 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur1={0x1, 0x25}], 0x1) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x34) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r9, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f0000000040)={0x5}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r4, 0x4010aeb5, &(0x7f0000000000)={0xbf4}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f00000000c0)=@arm64) 1m7.484939033s ago: executing program 5 (id=43): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xb8000, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x2f) r2 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00000000fffffffff400", 0x0, 0xffffffffffffff32) syz_memcpy_off$KVM_EXIT_MMIO(r2, 0x20, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r4, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) r5 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000140)={0x0, &(0x7f0000000300)=[@msr={0x14, 0x20, {0x603000000013fe07, 0xfffffffffffffff7}}, @msr={0x14, 0x20, {0x603000000013df7a, 0x3e52}}, @irq_setup={0x46, 0x18, {0x0, 0x2fe}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x0, 0xc, 0xe, 0x4ee3}}, @hvc={0x32, 0x40, {0x1c8008018, [0x4, 0x3, 0x0, 0x40, 0x1ff]}}, @irq_setup={0x46, 0x18, {0x3, 0xd3}}, @msr={0x14, 0x20, {0x603000000013da17, 0xfffffffffffffdbd}}, @irq_setup={0x46, 0x18, {0x2, 0x2ec}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x800, 0xfffffffffffffeff, 0x2}}, @eret={0xe6, 0x18, 0x700ef37c}, @eret={0xe6, 0x18, 0x8000000000000000}, @irq_setup={0x46, 0x18, {0x4, 0x190}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x2, 0xb, 0x100, 0x1, 0x3}}, @hvc={0x32, 0x40, {0x80008000, [0xff, 0x8, 0x0, 0x1, 0x8]}}, @msr={0x14, 0x20, {0x603000000013e66c, 0x5}}, @eret={0xe6, 0x18, 0xfffffffffffffffb}, @uexit={0x0, 0x18}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x4, 0xf, 0x4, 0x46, 0x100001}}, @irq_setup={0x46, 0x18, {0x3, 0x3ac}}, @eret={0xe6, 0x18, 0x2}, @mrs={0xbe, 0x18, {0x603000000013df42}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x1, 0xc, 0x4, 0x0, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x1, 0x7, 0x1e08, 0xfffffffa, 0x3}}], 0x300}, &(0x7f0000000200)=[@featur1={0x1, 0x1}], 0x1) r6 = eventfd2(0xfffffff9, 0x800) write$eventfd(r6, &(0x7f0000000640)=0xa, 0x8) close(0xffffffffffffffff) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0x7ff, 0x8, &(0x7f0000000240)=0x7}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) 49.300381562s ago: executing program 5 (id=44): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xb701, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xb704, 0xfffffffffffffffe) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x300, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000100)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f00000000c0)=@riscv64_d={0x803000000600000f, &(0x7f0000000040)=0xa}) 27.471953934s ago: executing program 36 (id=42): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$arm64(r1, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000100)=@arm64={0x4e, 0x2, 0x0, '\x00', 0x4}) r3 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x41000000000024) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r6 = openat$kvm(0x0, &(0x7f0000000140), 0x503002, 0x0) ioctl$KVM_CREATE_VM(r6, 0x801c581f, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101400, 0x0) r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x213) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r9 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur1={0x1, 0x25}], 0x1) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x34) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r9, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f0000000040)={0x5}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r4, 0x4010aeb5, &(0x7f0000000000)={0xbf4}) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f00000000c0)=@arm64) 0s ago: executing program 37 (id=44): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xb701, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xb704, 0xfffffffffffffffe) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x300, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000100)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f00000000c0)=@riscv64_d={0x803000000600000f, &(0x7f0000000040)=0xa}) kernel console output (not intermixed with test programs): [ 394.224053][ T25] audit: type=1400 audit(393.440:60): avc: denied { read } for pid=3171 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 414.424284][ T3171] 8021q: adding VLAN 0 to HW filter on device bond0 [ 475.683247][ T3171] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:8937' (ED25519) to the list of known hosts. [ 632.233138][ T25] audit: type=1400 audit(631.450:61): avc: denied { name_bind } for pid=3331 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 633.123349][ T25] audit: type=1400 audit(632.340:62): avc: denied { execute } for pid=3332 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 633.151340][ T25] audit: type=1400 audit(632.370:63): avc: denied { execute_no_trans } for pid=3332 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 664.502712][ T25] audit: type=1400 audit(663.720:64): avc: denied { mounton } for pid=3332 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 664.558323][ T25] audit: type=1400 audit(663.770:65): avc: denied { mount } for pid=3332 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 664.648846][ T3332] cgroup: Unknown subsys name 'net' [ 664.712245][ T25] audit: type=1400 audit(663.930:66): avc: denied { unmount } for pid=3332 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 665.197408][ T3332] cgroup: Unknown subsys name 'cpuset' [ 665.343405][ T3332] cgroup: Unknown subsys name 'rlimit' [ 666.319043][ T25] audit: type=1400 audit(665.530:67): avc: denied { setattr } for pid=3332 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 666.340039][ T25] audit: type=1400 audit(665.550:68): avc: denied { mounton } for pid=3332 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 666.363745][ T25] audit: type=1400 audit(665.580:69): avc: denied { mount } for pid=3332 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 667.442785][ T3335] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 667.467889][ T25] audit: type=1400 audit(666.680:70): avc: denied { relabelto } for pid=3335 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 667.489874][ T25] audit: type=1400 audit(666.700:71): avc: denied { write } for pid=3335 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 667.690293][ T25] audit: type=1400 audit(666.900:72): avc: denied { read } for pid=3332 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 667.707821][ T25] audit: type=1400 audit(666.920:73): avc: denied { open } for pid=3332 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 667.757111][ T3332] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 725.670664][ T25] audit: type=1400 audit(724.890:74): avc: denied { execmem } for pid=3336 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 729.531802][ T25] audit: type=1400 audit(728.750:75): avc: denied { read } for pid=3338 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 729.543557][ T25] audit: type=1400 audit(728.760:76): avc: denied { read } for pid=3339 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 729.580629][ T25] audit: type=1400 audit(728.800:77): avc: denied { open } for pid=3339 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 729.639605][ T25] audit: type=1400 audit(728.840:78): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 729.877009][ T25] audit: type=1400 audit(729.090:79): avc: denied { module_request } for pid=3338 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 729.918009][ T25] audit: type=1400 audit(729.110:80): avc: denied { module_request } for pid=3339 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 730.939336][ T25] audit: type=1400 audit(730.150:81): avc: denied { sys_module } for pid=3339 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 754.180308][ T3338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.453254][ T3338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 754.570442][ T3339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 754.949087][ T3339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 770.117255][ T3338] hsr_slave_0: entered promiscuous mode [ 770.173719][ T3338] hsr_slave_1: entered promiscuous mode [ 771.971696][ T3339] hsr_slave_0: entered promiscuous mode [ 772.043136][ T3339] hsr_slave_1: entered promiscuous mode [ 772.095452][ T3339] debugfs: 'hsr0' already exists in 'hsr' [ 772.134274][ T3339] Cannot create hsr debugfs directory [ 779.153811][ T25] audit: type=1400 audit(778.370:82): avc: denied { create } for pid=3338 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 779.190806][ T25] audit: type=1400 audit(778.400:83): avc: denied { write } for pid=3338 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 779.249590][ T25] audit: type=1400 audit(778.450:84): avc: denied { read } for pid=3338 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 779.470806][ T3338] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 779.892583][ T3338] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 780.198038][ T3338] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 780.475546][ T3338] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 783.067631][ T3339] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 783.392573][ T3339] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 783.639311][ T3339] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 783.873077][ T3339] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 800.013332][ T3338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 802.622880][ T3339] 8021q: adding VLAN 0 to HW filter on device bond0 [ 858.845256][ T3338] veth0_vlan: entered promiscuous mode [ 859.422882][ T3338] veth1_vlan: entered promiscuous mode [ 861.301821][ T3339] veth0_vlan: entered promiscuous mode [ 862.000106][ T3338] veth0_macvtap: entered promiscuous mode [ 862.204118][ T3339] veth1_vlan: entered promiscuous mode [ 862.520264][ T3338] veth1_macvtap: entered promiscuous mode [ 865.123993][ T21] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.142147][ T21] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.151352][ T21] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.322159][ T2170] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 865.374188][ T3339] veth0_macvtap: entered promiscuous mode [ 865.756634][ T3339] veth1_macvtap: entered promiscuous mode [ 868.144242][ T25] audit: type=1400 audit(867.330:85): avc: denied { mount } for pid=3338 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 868.433702][ T25] audit: type=1400 audit(867.620:86): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/syzkaller.JggRFZ/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 868.579402][ T25] audit: type=1400 audit(867.770:87): avc: denied { mount } for pid=3338 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 868.924138][ T25] audit: type=1400 audit(868.140:88): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/syzkaller.JggRFZ/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 869.014264][ T21] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.029881][ T21] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.082597][ T21] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.120992][ T21] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 869.151380][ T25] audit: type=1400 audit(868.290:89): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/syzkaller.JggRFZ/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3754 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 869.809389][ T25] audit: type=1400 audit(869.020:90): avc: denied { unmount } for pid=3338 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 870.151138][ T25] audit: type=1400 audit(869.350:91): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1546 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 870.291004][ T25] audit: type=1400 audit(869.510:92): avc: denied { mount } for pid=3338 comm="syz-executor" name="/" dev="gadgetfs" ino=3764 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 870.692563][ T25] audit: type=1400 audit(869.910:93): avc: denied { mount } for pid=3338 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 870.781176][ T25] audit: type=1400 audit(869.970:94): avc: denied { mounton } for pid=3338 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 872.043945][ T3338] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 873.157105][ T25] kauditd_printk_skb: 1 callbacks suppressed [ 873.160305][ T25] audit: type=1400 audit(872.350:96): avc: denied { read write } for pid=3338 comm="syz-executor" name="loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 873.201172][ T25] audit: type=1400 audit(872.400:97): avc: denied { open } for pid=3338 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 873.271294][ T25] audit: type=1400 audit(872.470:98): avc: denied { ioctl } for pid=3338 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 882.847444][ T25] audit: type=1400 audit(882.060:99): avc: denied { read } for pid=3494 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 882.905593][ T25] audit: type=1400 audit(882.120:100): avc: denied { open } for pid=3494 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 883.073321][ T25] audit: type=1400 audit(882.290:101): avc: denied { ioctl } for pid=3494 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 885.837945][ T25] audit: type=1400 audit(885.040:102): avc: denied { append } for pid=3496 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 911.702870][ T25] audit: type=1400 audit(910.920:103): avc: denied { execute } for pid=3504 comm="syz.1.3" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=3980 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 912.851661][ T25] audit: type=1400 audit(912.070:104): avc: denied { write } for pid=3508 comm="syz.0.4" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1052.141256][ T3435] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.709068][ T3435] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1057.650955][ T3435] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1060.061680][ T3435] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1090.060814][ T3435] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1090.360169][ T3435] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1090.694747][ T3435] bond0 (unregistering): Released all slaves [ 1095.143467][ T3435] hsr_slave_0: left promiscuous mode [ 1095.527876][ T3435] hsr_slave_1: left promiscuous mode [ 1097.170732][ T3435] veth1_macvtap: left promiscuous mode [ 1097.184341][ T3435] veth0_macvtap: left promiscuous mode [ 1097.220703][ T3435] veth1_vlan: left promiscuous mode [ 1097.241923][ T3435] veth0_vlan: left promiscuous mode [ 1127.672486][ T3435] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1129.241895][ T3435] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1130.725376][ T3435] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1133.252381][ T3435] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.717700][ T3435] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1155.995308][ T3435] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1156.163525][ T3435] bond0 (unregistering): Released all slaves [ 1158.441648][ T3435] hsr_slave_0: left promiscuous mode [ 1158.827552][ T3435] hsr_slave_1: left promiscuous mode [ 1160.165331][ T3435] veth1_macvtap: left promiscuous mode [ 1160.184603][ T3435] veth0_macvtap: left promiscuous mode [ 1160.200581][ T3435] veth1_vlan: left promiscuous mode [ 1160.208464][ T3435] veth0_vlan: left promiscuous mode [ 1219.314821][ T3559] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1219.525103][ T3556] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1220.184970][ T3559] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1220.642177][ T3556] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1249.369782][ T3559] hsr_slave_0: entered promiscuous mode [ 1249.471923][ T3559] hsr_slave_1: entered promiscuous mode [ 1254.395234][ T3556] hsr_slave_0: entered promiscuous mode [ 1254.502633][ T3556] hsr_slave_1: entered promiscuous mode [ 1254.570229][ T3556] debugfs: 'hsr0' already exists in 'hsr' [ 1254.598875][ T3556] Cannot create hsr debugfs directory [ 1276.662194][ T3559] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1277.289062][ T3559] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1279.119526][ T3559] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1280.929724][ T3559] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1288.899871][ T3556] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1289.319774][ T3556] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1289.853670][ T3556] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1291.369212][ T3556] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1330.681363][ T3559] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1338.125632][ T3556] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1458.282484][ T3559] veth0_vlan: entered promiscuous mode [ 1459.311262][ T3559] veth1_vlan: entered promiscuous mode [ 1463.709834][ T3556] veth0_vlan: entered promiscuous mode [ 1464.165643][ T3559] veth0_macvtap: entered promiscuous mode [ 1465.002041][ T3559] veth1_macvtap: entered promiscuous mode [ 1465.629257][ T3556] veth1_vlan: entered promiscuous mode [ 1469.583278][ T3561] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1469.602411][ T3561] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1469.753859][ T3561] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1469.779020][ T3717] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1471.081061][ T3556] veth0_macvtap: entered promiscuous mode [ 1472.003679][ T3556] veth1_macvtap: entered promiscuous mode [ 1477.135352][ T3223] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.144819][ T3223] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.221636][ T3400] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1477.248512][ T21] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1758.379547][ T3875] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1758.978682][ T3879] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1759.451548][ T3875] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1759.811932][ T3879] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1773.544561][ T3943] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1777.314398][ T3943] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1779.121710][ T3943] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1780.801291][ T3943] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1806.394929][ T3943] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1806.611676][ T3943] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1806.743220][ T3943] bond0 (unregistering): Released all slaves [ 1808.667593][ T3943] hsr_slave_0: left promiscuous mode [ 1808.767756][ T3943] hsr_slave_1: left promiscuous mode [ 1809.640359][ T3943] veth1_macvtap: left promiscuous mode [ 1809.641819][ T3943] veth0_macvtap: left promiscuous mode [ 1809.668369][ T3943] veth1_vlan: left promiscuous mode [ 1809.675030][ T3943] veth0_vlan: left promiscuous mode [ 1834.922995][ T3879] hsr_slave_0: entered promiscuous mode [ 1835.023433][ T3879] hsr_slave_1: entered promiscuous mode [ 1835.103747][ T3879] debugfs: 'hsr0' already exists in 'hsr' [ 1835.119270][ T3879] Cannot create hsr debugfs directory [ 1836.249409][ T3875] hsr_slave_0: entered promiscuous mode [ 1836.314338][ T3875] hsr_slave_1: entered promiscuous mode [ 1836.361874][ T3875] debugfs: 'hsr0' already exists in 'hsr' [ 1836.368171][ T3875] Cannot create hsr debugfs directory [ 1840.255517][ T3943] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1842.238735][ T3943] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1843.954643][ T3943] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1845.431383][ T3943] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1868.944722][ T3943] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1869.257694][ T3943] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1869.401341][ T3943] bond0 (unregistering): Released all slaves [ 1870.940232][ T3943] hsr_slave_0: left promiscuous mode [ 1871.001250][ T3943] hsr_slave_1: left promiscuous mode [ 1871.265046][ T3943] veth1_macvtap: left promiscuous mode [ 1871.271467][ T3943] veth0_macvtap: left promiscuous mode [ 1871.282324][ T3943] veth1_vlan: left promiscuous mode [ 1871.294194][ T3943] veth0_vlan: left promiscuous mode [ 1890.635644][ T3879] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1891.538834][ T3879] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1892.004536][ T3879] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1892.548356][ T3879] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1897.575537][ T3875] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1898.082492][ T3875] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1898.608470][ T3875] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1899.224805][ T3875] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1925.114825][ T3879] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1932.302298][ T3875] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2068.310766][ T3879] veth0_vlan: entered promiscuous mode [ 2069.710006][ T3879] veth1_vlan: entered promiscuous mode [ 2073.358869][ T3879] veth0_macvtap: entered promiscuous mode [ 2074.833210][ T3879] veth1_macvtap: entered promiscuous mode [ 2075.854428][ T3875] veth0_vlan: entered promiscuous mode [ 2077.788545][ T3875] veth1_vlan: entered promiscuous mode [ 2080.557524][ T2170] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2080.568968][ T3435] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2080.589704][ T3571] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2080.590612][ T3571] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2084.625702][ T3875] veth0_macvtap: entered promiscuous mode [ 2086.111768][ T3875] veth1_macvtap: entered promiscuous mode [ 2091.238092][ T3943] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2091.251573][ T2170] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2091.493555][ T3391] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2091.532566][ T3571] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2411.095319][ T4221] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2413.465122][ T4221] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2444.824160][ T4235] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2445.269700][ T4235] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2466.392200][ T4221] hsr_slave_0: entered promiscuous mode [ 2466.554939][ T4221] hsr_slave_1: entered promiscuous mode [ 2502.141260][ T4235] hsr_slave_0: entered promiscuous mode [ 2502.193385][ T4235] hsr_slave_1: entered promiscuous mode [ 2502.338088][ T4235] debugfs: 'hsr0' already exists in 'hsr' [ 2502.347634][ T4235] Cannot create hsr debugfs directory [ 2503.038971][ T4221] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2505.319478][ T4221] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2505.923629][ T4221] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2506.651060][ T4221] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2538.991821][ T4235] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2540.070281][ T4235] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2540.745240][ T4235] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2541.860017][ T4235] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 2559.544884][ T4221] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2596.581622][ T4235] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2712.321293][ T27] INFO: task syz.5.44:4208 blocked for more than 430 seconds. [ 2712.349875][ T27] Not tainted syzkaller #0 [ 2712.407652][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2712.411467][ T27] task:syz.5.44 state:D stack:0 pid:4208 tgid:4208 ppid:3879 task_flags:0x400040 flags:0x00000011 [ 2712.430642][ T27] Call trace: [ 2712.431182][ T27] __switch_to+0x584/0xb00 (T) [ 2712.433839][ T27] __schedule+0x200c/0x3428 [ 2712.434423][ T27] schedule+0xac/0x27c [ 2712.434922][ T27] schedule_timeout+0x68/0x1ec [ 2712.435413][ T27] do_wait_for_common+0x28c/0x440 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2712.578249][ T27] wait_for_completion+0x44/0x5c [ 2712.587851][ T27] __synchronize_srcu+0x2a4/0x320 [ 2712.588608][ T27] synchronize_srcu+0x3d0/0x4f8 [ 2712.589173][ T27] mmu_notifier_unregister+0x320/0x428 [ 2712.589712][ T27] kvm_put_kvm+0x698/0xbe0 [ 2712.590143][ T27] kvm_vm_release+0x58/0x78 [ 2712.590612][ T27] __fput+0x4ac/0x978 [ 2712.591053][ T27] ____fput+0x20/0x58 [ 2712.591467][ T27] task_work_run+0x1b8/0x250 [ 2712.591929][ T27] exit_to_user_mode_loop+0x110/0x188 [ 2712.592393][ T27] el0_svc+0x17c/0x238 [ 2712.592908][ T27] el0t_64_sync_handler+0x84/0x12c [ 2712.593423][ T27] el0t_64_sync+0x198/0x19c [ 2712.595130][ T27] [ 2712.595130][ T27] Showing all locks held in the system: [ 2712.595632][ T27] 1 lock held by khungtaskd/27: [ 2712.780449][ T27] #0: ffff800087a86d08 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x0/0x44 [ 2712.805353][ T27] 3 locks held by kworker/u4:6/2170: [ 2712.879624][ T27] 1 lock held by syslogd/3130: [ 2712.886971][ T27] 2 locks held by getty/3200: [ 2712.887472][ T27] #0: b3f00000123228a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 2712.889411][ T27] #1: 87ff80008c80b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x308/0x1234 [ 2712.891227][ T27] 2 locks held by syz-executor/3332: [ 2712.891568][ T27] 2 locks held by kworker/u4:5/3400: [ 2712.891879][ T27] #0: a3f000000cc26948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10 [ 2712.893940][ T27] #1: ffff8000a3d77c88 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10 [ 2712.895627][ T27] 3 locks held by kworker/u4:7/3435: [ 2713.004562][ T27] #0: dbf000000cc26d48 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10 [ 2713.109056][ T27] #1: ffff8000a3d87c88 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10 [ 2713.110737][ T27] #2: a7f0000019492250 (&devlink->lock_key#6){+.+.}-{4:4}, at: devl_trylock+0x24/0x34 [ 2713.112799][ T27] 2 locks held by kworker/u4:9/3561: [ 2713.113168][ T27] #0: a3f000000cc26948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10 [ 2713.115467][ T27] #1: ffff80008e317c88 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10 [ 2713.234403][ T27] 3 locks held by kworker/u4:10/3571: [ 2713.234756][ T27] 3 locks held by kworker/u4:11/3717: [ 2713.235119][ T27] 4 locks held by kworker/0:5/3786: [ 2713.235493][ T27] 3 locks held by kworker/u4:12/3970: [ 2713.327109][ T27] 2 locks held by syz.4.42/4197: [ 2713.329967][ T27] 2 locks held by kworker/u4:14/4355: [ 2713.333114][ T27] 3 locks held by kworker/u4:15/4414: [ 2713.333698][ T27] [ 2713.334009][ T27] ============================================= [ 2713.334009][ T27] [ 2713.334952][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 2713.341316][ T27] CPU: 0 UID: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 2713.342774][ T27] Hardware name: linux,dummy-virt (DT) [ 2713.343786][ T27] Call trace: [ 2713.344608][ T27] show_stack+0x2c/0x3c (C) [ 2713.345637][ T27] __dump_stack+0x30/0x40 [ 2713.346591][ T27] dump_stack_lvl+0x30/0x12c [ 2713.347532][ T27] dump_stack+0x1c/0x28 [ 2713.348478][ T27] vpanic+0x1d4/0x4e4 [ 2713.349313][ T27] vpanic+0x0/0x4e4 [ 2713.350145][ T27] hung_task_panic+0x0/0x2c [ 2713.351084][ T27] kthread+0x794/0x99c [ 2713.352017][ T27] ret_from_fork+0x10/0x20 [ 2713.353936][ T27] Kernel Offset: disabled [ 2713.354687][ T27] CPU features: 0x0000000,001a3005,fbe327a1,057ffe1f [ 2713.355842][ T27] Memory Limit: none [ 2713.358102][ T27] Rebooting in 86400 seconds..