last executing test programs: 59.434544356s ago: executing program 0 (id=402): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async, rerun: 64) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x102, 0x0) (rerun: 64) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0xfffffffffffffdfc) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r3, 0x4018aee3, &(0x7f00000001c0)=@attr_other={0x0, 0x5, 0x7fffffff, 0x0}) (async) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x909483, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x4) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000000)={0x5, 0xa}) (async, rerun: 32) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r6, 0x4018aee1, &(0x7f0000000180)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000040)=0x8}) (rerun: 32) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r9, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000000140)=@arm64_extra={0x603000000013df02, &(0x7f0000000100)=0x1}) 52.981690738s ago: executing program 0 (id=404): r0 = openat$kvm(0x0, &(0x7f0000000180), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000eb2000/0x3000)=nil, 0x930, 0x4, 0x40a8012, 0xffffffffffffffff, 0x2000) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x8, 0x4f832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x4) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100042, &(0x7f0000000100)=0x8}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x6030000000138012, &(0x7f0000000000)=0xfffffffffffffffc}) r8 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000ffa000/0x3000)=nil, 0x930, 0x3000007, 0x2012, r10, 0x2000000) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init) ioctl$KVM_RUN(r7, 0xae80, 0x0) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r12, 0x4040ae79, &(0x7f0000000040)={0x800000000003, 0xeeee0000, 0x2, r13, 0x8}) ioctl$KVM_IOEVENTFD(r12, 0x4040ae79, &(0x7f0000000900)={0xfffffffffffffffc, 0x0, 0x1, r13, 0x9}) ioctl$KVM_IOEVENTFD(r12, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x1, r13, 0x5}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x6, 0x3000, 0x2, r13, 0x7}) r14 = mmap$KVM_VCPU(&(0x7f0000dee000/0x3000)=nil, r4, 0x100000e, 0x8a031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r14, 0x20, &(0x7f00000000c0)="e51b9ce9a032a1ca7079bce9b3cf3ba9c7fbc2e7ab457eacc044b677d9d49c274b8d12fb382e0520cadbc6763409ffdb41911831b85a42b40c1689a8bf14be81eda4bae2d8c28ef8", 0x0, 0x48) 51.939796917s ago: executing program 1 (id=405): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = eventfd2(0x1, 0x1) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x20200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r5, 0x1, 0x100) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f00000000c0)={r3, 0x4, 0x0, r3}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000300000002"]) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x8}) ioctl$KVM_IRQFD(r5, 0x4020ae76, &(0x7f0000000040)={r3, 0x3, 0x2, r3}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x0, 0xd000, 0x1, r3, 0x2}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc9}) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x8004b707, 0x0) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r9, 0x4, 0x160) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x8, 0x0, &(0x7f0000000240)=0x8}) 40.603698429s ago: executing program 0 (id=406): munmap(&(0x7f0000d1f000/0x3000)=nil, 0x3000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f00000002c0)=@arm64_fw={0x6030000000140003, &(0x7f0000000240)=0x3}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000080)={0x5, 0x8}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000f, 0x11, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r7, 0x0) close(r6) r9 = eventfd2(0x0, 0x0) close(r6) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a3ef2, 0x0) write$eventfd(r9, &(0x7f0000000180)=0x5, 0xfffffe09) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x3000002, 0x13, r6, 0x0) ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x300000c, 0x4f832, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff}) write$eventfd(r10, &(0x7f00000001c0)=0xffffff7f, 0xff25) 40.401738696s ago: executing program 1 (id=407): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013dce0, &(0x7f0000000000)=0x3ff}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000001c0)={0x8}) ioctl$KVM_SET_SIGNAL_MASK(r2, 0x4004ae8b, &(0x7f00000001c0)=ANY=[]) close(r0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 35.024695733s ago: executing program 1 (id=408): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x40) (async) syz_kvm_vgic_v3_setup(r1, 0x1, 0x40) eventfd2(0x4, 0x801) (async) r2 = eventfd2(0x4, 0x801) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000180)={r2, 0x3, 0x2, r2}) eventfd2(0x0, 0x0) (async) r3 = eventfd2(0x0, 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000002c0)={r3, 0x40fff, 0x0, r3}) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r3, 0x7, 0x3, r2}) mmap$KVM_VCPU(&(0x7f0000c29000/0x2000)=nil, 0x0, 0x8, 0x13, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c29000/0x2000)=nil, 0x0, 0x8, 0x13, 0xffffffffffffffff, 0x0) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) r4 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f831, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x80180, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x80180, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000b80)={0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e00000000000000400000000000000002000084000000009a09000000040000faffffffffffffffca0a0000000000000101000000000000060000040000000034126ad7316e884f0d2cfa15442ec10bf81bd3d908fc2bb1717225c73f79ff70ccd210ca09056c81a8b8e889a9cdd440cbbb862d773c19f77326df62a4e71ad4f4cc40ec93c33713fc6a0f6bc7feabb10d4434ededee4c56f8c8e3bf75ecb758180a2ad873df7747bc33ec4278486eaa68241d3dc380503b052645d54d7d8b120df486cb6e3393dddc66272c01f784ed0fe883c52a1f51cb11ff12cf"], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) (async) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000b80)={0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1e00000000000000400000000000000002000084000000009a09000000040000faffffffffffffffca0a0000000000000101000000000000060000040000000034126ad7316e884f0d2cfa15442ec10bf81bd3d908fc2bb1717225c73f79ff70ccd210ca09056c81a8b8e889a9cdd440cbbb862d773c19f77326df62a4e71ad4f4cc40ec93c33713fc6a0f6bc7feabb10d4434ededee4c56f8c8e3bf75ecb758180a2ad873df7747bc33ec4278486eaa68241d3dc380503b052645d54d7d8b120df486cb6e3393dddc66272c01f784ed0fe883c52a1f51cb11ff12cf"], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x200, 0x0) ioctl$KVM_CHECK_EXTENSION(r9, 0x5450, 0xfffffffffffffff8) (async) ioctl$KVM_CHECK_EXTENSION(r9, 0x5450, 0xfffffffffffffff8) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) (async) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x8000, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r11, 0xc018aec0, 0xfffffffffffffffe) r12 = eventfd2(0x3, 0x80000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000080)={r3, 0x1, 0x1, r12}) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000200)={0x8}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) 27.641615398s ago: executing program 1 (id=409): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, 0x930, 0x100000f, 0x10, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, 0xfffffffffffffffe, 0x0, 0xfffffffffffffee9) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)=@arm64_extra={0x603000000013df1a, &(0x7f0000000100)=0xfffffffffffffffe}) 22.722703373s ago: executing program 0 (id=410): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x10000000000) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x1000006, 0x5c1fd1b656592f1, r2, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000f, 0x11, r3, 0x0) ioctl$KVM_ARM_PREFERRED_TARGET(r2, 0x8020aeaf, &(0x7f0000000080)) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000100)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67301ce16f8f1f449a7a835673312b54ebb2aa8cc869d22627e7000000000000000000001f000e00", 0x0, 0x48) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_GET_DEVICE_ATTR(r7, 0x4018aee2, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x2, 0x0}) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@mrs={0xbe, 0x18, {0x603000000013df40}}], 0x18}, &(0x7f0000000100)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r11, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_init) r12 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) r13 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r12, 0x3, 0x11, r11, 0x0) ioctl$KVM_ARM_VCPU_INIT(r11, 0x4020aeae, &(0x7f0000000180)={0x4}) ioctl$KVM_RUN(r11, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r13, 0xffffffffffffffff) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r3, 0x0) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r1, 0x4010aeb5, &(0x7f0000000000)={0x3, 0x6}) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x121218, 0x0) 20.426411639s ago: executing program 1 (id=411): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="be00000000000000180000005700000043c6130000003060"], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x2000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0xe3) r9 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x3, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x100, &(0x7f0000000080)=0x8000000000000000}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000300)=@attr_other={0x0, 0x4, 0x1, 0x0}) ioctl$KVM_SET_DEVICE_ATTR_vm(r7, 0x4018aee1, &(0x7f0000000200)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000240)={0x534, 0x800003a, 0x1}}) ioctl$KVM_SET_DEVICE_ATTR_vm(r7, 0x4018aee1, &(0x7f00000004c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000480)={0x0, 0x20}}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x4, 0xffffffffffffffff}) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r14, 0xc00caee0, &(0x7f0000000200)={0x7, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r15, 0x4018aee3, &(0x7f0000000240)=@attr_arm64={0x0, 0x5, 0x0, 0x0}) ioctl$KVM_HAS_DEVICE_ATTR(r12, 0x4018aee3, &(0x7f0000000000)=@attr_arm64={0x0, 0x1, 0x1, 0x0}) 10.976547578s ago: executing program 0 (id=412): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x82, 0x28, {0x1, 0x0, 0x1}}], 0x28}, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x0, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 4.401617214s ago: executing program 0 (id=413): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, &(0x7f0000000000)=ANY=[], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r2, 0x1, 0x100) r5 = eventfd2(0x1, 0x1) (async) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x20200, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f00000000c0)={r5, 0x4, 0x0, r5}) (async) ioctl$KVM_SET_GSI_ROUTING(r7, 0x4008ae6a, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000300000002"]) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8}) (async) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000040)={r5, 0x3, 0x2, r5}) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="820000000000000000000000000000000100000000000000090000000000000001"], 0x28}, 0x0, 0x0) (async) syz_kvm_vgic_v3_setup(r9, 0x1, 0x100) (async) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async, rerun: 32) ioctl$KVM_RUN(r11, 0xae80, 0x0) (rerun: 32) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async, rerun: 32) ioctl$KVM_RUN(r4, 0xae80, 0x0) (rerun: 32) r14 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0) (async) ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x1) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r14, 0x4068aea3, &(0x7f00000000c0)={0xdf, 0x0, 0x10000}) 0s ago: executing program 1 (id=414): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r4, 0x4020aeae, &(0x7f0000000000)={0x5, 0x4}) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_vgic_v3_setup(r3, 0x3, 0x40) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4020940d, &(0x7f0000000080)={0xec70, 0x0, 0x1, 0xffffffffffffffff, 0x5}) kernel console output (not intermixed with test programs): [ 396.907970][ T3129] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:60497' (ED25519) to the list of known hosts. [ 556.617453][ T25] audit: type=1400 audit(555.750:56): avc: denied { name_bind } for pid=3285 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 557.524353][ T25] audit: type=1400 audit(556.650:57): avc: denied { execute } for pid=3286 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 557.549749][ T25] audit: type=1400 audit(556.670:58): avc: denied { execute_no_trans } for pid=3286 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 580.747471][ T25] audit: type=1400 audit(579.880:59): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 580.780378][ T25] audit: type=1400 audit(579.910:60): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 580.865758][ T3286] cgroup: Unknown subsys name 'net' [ 580.914597][ T25] audit: type=1400 audit(580.040:61): avc: denied { unmount } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 581.360022][ T3286] cgroup: Unknown subsys name 'cpuset' [ 581.463638][ T3286] cgroup: Unknown subsys name 'rlimit' [ 582.449497][ T25] audit: type=1400 audit(581.580:62): avc: denied { setattr } for pid=3286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 582.468617][ T25] audit: type=1400 audit(581.600:63): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 582.497098][ T25] audit: type=1400 audit(581.630:64): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 583.693632][ T3289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 583.713164][ T25] audit: type=1400 audit(582.840:65): avc: denied { relabelto } for pid=3289 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 583.737605][ T25] audit: type=1400 audit(582.870:66): avc: denied { write } for pid=3289 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 583.919000][ T25] audit: type=1400 audit(583.050:67): avc: denied { read } for pid=3286 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 583.940271][ T25] audit: type=1400 audit(583.070:68): avc: denied { open } for pid=3286 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 583.987828][ T3286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 625.133767][ T25] audit: type=1400 audit(624.240:69): avc: denied { execmem } for pid=3290 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 628.724867][ T25] audit: type=1400 audit(627.800:70): avc: denied { read } for pid=3292 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 628.757670][ T25] audit: type=1400 audit(627.890:71): avc: denied { open } for pid=3292 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 628.892081][ T25] audit: type=1400 audit(628.010:72): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 629.393021][ T25] audit: type=1400 audit(628.520:73): avc: denied { module_request } for pid=3292 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 631.009654][ T25] audit: type=1400 audit(630.140:74): avc: denied { sys_module } for pid=3292 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 656.519882][ T3292] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 656.657714][ T3292] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 657.775325][ T3293] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 657.905156][ T3293] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 669.389144][ T3292] hsr_slave_0: entered promiscuous mode [ 669.438013][ T3292] hsr_slave_1: entered promiscuous mode [ 670.793882][ T3293] hsr_slave_0: entered promiscuous mode [ 670.825691][ T3293] hsr_slave_1: entered promiscuous mode [ 670.854173][ T3293] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 670.858888][ T3293] Cannot create hsr debugfs directory [ 675.700195][ T25] audit: type=1400 audit(674.820:75): avc: denied { create } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 675.725350][ T25] audit: type=1400 audit(674.850:76): avc: denied { write } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 675.802292][ T25] audit: type=1400 audit(674.930:77): avc: denied { read } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 675.986315][ T3292] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 676.319358][ T3292] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 676.556825][ T3292] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 676.830616][ T3292] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 678.170136][ T3293] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 678.325424][ T3293] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 678.465602][ T3293] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 678.699639][ T3293] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 690.926820][ T3292] 8021q: adding VLAN 0 to HW filter on device bond0 [ 694.136946][ T3293] 8021q: adding VLAN 0 to HW filter on device bond0 [ 745.062570][ T3292] veth0_vlan: entered promiscuous mode [ 745.614935][ T3292] veth1_vlan: entered promiscuous mode [ 747.235098][ T3293] veth0_vlan: entered promiscuous mode [ 747.700325][ T3292] veth0_macvtap: entered promiscuous mode [ 747.986803][ T3293] veth1_vlan: entered promiscuous mode [ 748.045564][ T3292] veth1_macvtap: entered promiscuous mode [ 750.215579][ T3292] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 750.220531][ T3292] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 750.242899][ T3292] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 750.246955][ T3292] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 750.426892][ T3293] veth0_macvtap: entered promiscuous mode [ 750.779112][ T3293] veth1_macvtap: entered promiscuous mode [ 753.172253][ T25] audit: type=1400 audit(752.290:78): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 753.570038][ T25] audit: type=1400 audit(752.680:79): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/syzkaller.g4rWKD/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 753.933453][ T25] audit: type=1400 audit(753.050:80): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 754.203999][ T3293] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.215530][ T3293] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.275710][ T3293] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.294351][ T3293] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.399239][ T25] audit: type=1400 audit(753.510:81): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/syzkaller.g4rWKD/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 754.555141][ T25] audit: type=1400 audit(753.620:82): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/syzkaller.g4rWKD/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3257 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 755.536218][ T25] audit: type=1400 audit(754.640:83): avc: denied { unmount } for pid=3292 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 755.826135][ T25] audit: type=1400 audit(754.950:84): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1546 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 755.930127][ T25] audit: type=1400 audit(755.060:85): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="gadgetfs" ino=3268 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 756.363652][ T25] audit: type=1400 audit(755.480:86): avc: denied { mount } for pid=3292 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 756.507097][ T25] audit: type=1400 audit(755.640:87): avc: denied { mounton } for pid=3292 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 758.085899][ T3292] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 759.533444][ T25] kauditd_printk_skb: 1 callbacks suppressed [ 759.553368][ T25] audit: type=1400 audit(758.650:89): avc: denied { read write } for pid=3292 comm="syz-executor" name="loop0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 759.584544][ T25] audit: type=1400 audit(758.680:90): avc: denied { open } for pid=3292 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 759.616356][ T25] audit: type=1400 audit(758.680:91): avc: denied { ioctl } for pid=3292 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=637 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 764.050372][ T25] audit: type=1400 audit(763.180:92): avc: denied { read } for pid=3435 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 764.097152][ T25] audit: type=1400 audit(763.230:93): avc: denied { open } for pid=3435 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 764.792852][ T25] audit: type=1400 audit(763.910:94): avc: denied { ioctl } for pid=3435 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 782.555962][ T25] audit: type=1400 audit(781.660:95): avc: denied { write } for pid=3448 comm="syz.0.5" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 784.550030][ T25] audit: type=1400 audit(783.680:96): avc: denied { append } for pid=3450 comm="syz.1.6" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 814.854922][ T25] audit: type=1400 audit(813.980:97): avc: denied { execute } for pid=3464 comm="syz.1.10" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4103 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 819.489846][ T25] audit: type=1400 audit(818.620:98): avc: denied { setattr } for pid=3471 comm="syz.0.12" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 856.294149][ T3503] KVM: debugfs: duplicate directory 3503-5 [ 910.407538][ T3539] kvm [3539]: Failed to find VMA for hva 0x21016000 [ 910.949553][ T3541] kvm [3541]: Failed to find VMA for hva 0x21016000 [ 1339.336016][ T25] audit: type=1400 audit(1338.470:99): avc: denied { map } for pid=3863 comm="syz.1.125" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1382.689653][ T25] audit: type=1400 audit(1381.820:100): avc: denied { ioctl } for pid=3898 comm="syz.0.136" path="net:[4026531840]" dev="nsfs" ino=4026531840 ioctlcmd=0xb708 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1410.543779][ T25] audit: type=1400 audit(1409.660:101): avc: denied { execute } for pid=3917 comm="syz.1.142" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1485.314456][ T3980] kvm [3980]: Failed to find VMA for hva 0x21016000 [ 1881.660635][ T25] audit: type=1400 audit(1880.790:102): avc: denied { map } for pid=4277 comm="syz.1.250" path="pipe:[2412]" dev="pipefs" ino=2412 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 2279.029310][ T4577] KVM: debugfs: duplicate directory 4577-5 [ 2646.703229][ T4871] ================================================================== [ 2646.704102][ T4871] BUG: KASAN: invalid-access in _raw_spin_lock_irqsave+0x5c/0x7c [ 2646.706057][ T4871] Read of size 1 at addr 00000000000013c8 by task syz.0.413/4871 [ 2646.706473][ T4871] [ 2646.707589][ T4871] CPU: 0 UID: 0 PID: 4871 Comm: syz.0.413 Not tainted 6.15.0-rc4-syzkaller-g21bfd0ea00d0 #0 PREEMPT [ 2646.708153][ T4871] Hardware name: linux,dummy-virt (DT) [ 2646.708610][ T4871] Call trace: [ 2646.708941][ T4871] show_stack+0x2c/0x3c (C) [ 2646.709546][ T4871] __dump_stack+0x30/0x40 [ 2646.709806][ T4871] dump_stack_lvl+0xd8/0x12c [ 2646.710019][ T4871] print_report+0x5c/0xa0 [ 2646.710300][ T4871] kasan_report+0xb0/0x110 [ 2646.710556][ T4871] __kasan_check_byte+0x3c/0x54 [ 2646.710818][ T4871] lock_acquire+0xb0/0x2e0 [ 2646.711101][ T4871] _raw_spin_lock_irqsave+0x5c/0x7c [ 2646.711397][ T4871] kvm_vgic_set_owner+0x18c/0x294 [ 2646.711650][ T4871] kvm_timer_enable+0x1c4/0x794 [ 2646.711891][ T4871] kvm_arch_vcpu_run_pid_change+0x1f0/0x458 [ 2646.712150][ T4871] kvm_vcpu_ioctl+0xae8/0xc24 [ 2646.712398][ T4871] __arm64_sys_ioctl+0x18c/0x244 [ 2646.712687][ T4871] invoke_syscall+0x90/0x2b4 [ 2646.712954][ T4871] el0_svc_common+0x180/0x2f4 [ 2646.713257][ T4871] do_el0_svc+0x58/0x74 [ 2646.713522][ T4871] el0_svc+0x58/0x134 [ 2646.713798][ T4871] el0t_64_sync_handler+0x78/0x108 [ 2646.714090][ T4871] el0t_64_sync+0x198/0x19c [ 2646.714663][ T4871] ================================================================== [ 2646.717072][ T4871] Disabling lock debugging due to kernel taint [ 2646.718253][ T4871] Unable to handle kernel paging request at virtual address ffef80000000013b [ 2646.718728][ T4871] KASAN: maybe wild-memory-access in range [0xff000000000013b0-0xff000000000013bf] [ 2646.719086][ T4871] Mem abort info: [ 2646.719330][ T4871] ESR = 0x0000000096000004 [ 2646.719653][ T4871] EC = 0x25: DABT (current EL), IL = 32 bits [ 2646.719988][ T4871] SET = 0, FnV = 0 [ 2646.720290][ T4871] EA = 0, S1PTW = 0 [ 2646.720555][ T4871] FSC = 0x04: level 0 translation fault [ 2646.720867][ T4871] Data abort info: [ 2646.721148][ T4871] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 2646.721430][ T4871] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2646.721733][ T4871] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2646.722176][ T4871] [ffef80000000013b] address between user and kernel address ranges [ 2646.723035][ T4871] Internal error: Oops: 0000000096000004 [#1] SMP [ 2646.750589][ T4871] Modules linked in: [ 2646.752672][ T4871] CPU: 0 UID: 0 PID: 4871 Comm: syz.0.413 Tainted: G B 6.15.0-rc4-syzkaller-g21bfd0ea00d0 #0 PREEMPT [ 2646.754646][ T4871] Tainted: [B]=BAD_PAGE [ 2646.755525][ T4871] Hardware name: linux,dummy-virt (DT) [ 2646.756750][ T4871] pstate: 614020c9 (nZCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2646.758234][ T4871] pc : do_raw_spin_lock+0x4c/0x2b4 [ 2646.759339][ T4871] lr : _raw_spin_lock_irqsave+0x64/0x7c [ 2646.760518][ T4871] sp : ffff80008e827930 [ 2646.761413][ T4871] x29: ffff80008e827940 x28: 62f000001d2a3a80 x27: 62f000001d2a4ef0 [ 2646.763396][ T4871] x26: 0000000000000001 x25: 62f000001d2a50d0 x24: 0000000000000010 [ 2646.765191][ T4871] x23: 9aff80008e9b5000 x22: 62f000001d2a3a80 x21: ffff8000802008a0 [ 2646.766966][ T4871] x20: 00000000000013b0 x19: efff800000000000 x18: 00000000000000ff [ 2646.768767][ T4871] x17: 00000000022a6af4 x16: 00000000000000fe x15: 0000000000000000 [ 2646.770374][ T4871] x14: 0000000000000000 x13: 00000000ffffffff x12: 0000000000000002 [ 2646.772139][ T4871] x11: 0000000000000001 x10: 0ff000000000013b x9 : 0000000000000000 [ 2646.773952][ T4871] x8 : 00000000000013b4 x7 : ffff8000870babc1 x6 : ffff8000865866a8 [ 2646.775516][ T4871] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802a7adc [ 2646.777264][ T4871] x2 : 0000000000000001 x1 : 0000000000000000 x0 : 00000000000013b0 [ 2646.779061][ T4871] Call trace: [ 2646.779938][ T4871] do_raw_spin_lock+0x4c/0x2b4 (P) [ 2646.781074][ T4871] _raw_spin_lock_irqsave+0x64/0x7c [ 2646.782154][ T4871] kvm_vgic_set_owner+0x18c/0x294 [ 2646.783266][ T4871] kvm_timer_enable+0x1c4/0x794 [ 2646.784338][ T4871] kvm_arch_vcpu_run_pid_change+0x1f0/0x458 [ 2646.785518][ T4871] kvm_vcpu_ioctl+0xae8/0xc24 [ 2646.786462][ T4871] __arm64_sys_ioctl+0x18c/0x244 [ 2646.787569][ T4871] invoke_syscall+0x90/0x2b4 [ 2646.788684][ T4871] el0_svc_common+0x180/0x2f4 [ 2646.789754][ T4871] do_el0_svc+0x58/0x74 [ 2646.790663][ T4871] el0_svc+0x58/0x134 [ 2646.791696][ T4871] el0t_64_sync_handler+0x78/0x108 [ 2646.792857][ T4871] el0t_64_sync+0x198/0x19c [ 2646.794382][ T4871] Code: d344fd4a aa0003f4 f90007e9 d378fd09 (386a6a6a) [ 2646.796423][ T4871] ---[ end trace 0000000000000000 ]--- [ 2646.798276][ T4871] Kernel panic - not syncing: Oops: Fatal exception [ 2646.800736][ T4871] Kernel Offset: disabled [ 2646.801718][ T4871] CPU features: 0x0000,00000340,02fbcdf1,057ffe1f [ 2646.803002][ T4871] Memory Limit: none [ 2646.804623][ T4871] Rebooting in 86400 seconds.. VM DIAGNOSIS: 18:29:58 Registers: info registers vcpu 0 CPU#0 PC=ffff800086594320 X00=0000000000000001 X01=0000000000000001 X02=0000000000000001 X03=ffff80008044b808 X04=0000000000000001 X05=0000000000000000 X06=ffff800081e7b720 X07=ffff8000870babc1 X08=00000000000000c0 X09=ffffffffffffffff X10=0000000000000000 X11=00000000000000c6 X12=0ffff80008792129 X13=0000000000000007 X14=0000000000000000 X15=0000000000000000 X16=00000000000000fe X17=00000000022a6af4 X18=00000000000000ff X19=efff800000000000 X20=00000000000000c0 X21=ffff800087921288 X22=ffff80008c399000 X23=ffff80008c399000 X24=ffff800087932958 X25=000000000000007a X26=00000000000000ff X27=ffff800087932958 X28=ffff80008e8272c0 X29=ffff80008e8270d0 X30=ffff80008659430c SP=ffff80008e8270d0 PSTATE=604020c9 -ZC- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=1900000000000000:1900000000000000 Z01=0000001900000000:0000000000000000 Z02=0000000000000019:0000000000000000 Z03=00d000a800000000:0000000000000000 Z04=0000000000000000:0000000000000002 Z05=0000000000000019:0000000000000002 Z06=6edc4d3a2914b135:d8e9c869e2695c88 Z07=b20fae707afde253:388e9c6c4fa85ca0 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000fffff5ad28c0:0000fffff5ad28c0 Z17=ffffff80ffffffd0:0000fffff5ad2890 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000