last executing test programs: 49.509958916s ago: executing program 1 (id=270): r0 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r3, 0x4068aea3, &(0x7f0000000000)={0xef, 0x0, 0x7}) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0xa0401, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r7, 0x4018aee3, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x1, 0x0}) r8 = eventfd2(0x1, 0x80001) write$eventfd(r8, &(0x7f0000000040)=0x100000000, 0x8) (async) ioctl$KVM_CAP_ARM_MTE(r4, 0x4068aea3, &(0x7f0000000140)={0xb1}) (async) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r10, 0xae03, 0xa5) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) (async) r11 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe4, 0x7fffffff, 0x4}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x2, 0x9, 0x0, 0x80}}], 0x58}, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) ioctl$KVM_RUN(r14, 0xae80, 0x0) (async) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000000)="63aeebc74f21fa29a66188df20475303c8b2eac88196cbb9", 0x0, 0x18) 48.59000112s ago: executing program 0 (id=271): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x2000001, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x3000000, 0x4f831, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x1, 0x1, 0xeeee8000, 0x1000, &(0x7f0000f95000/0x1000)=nil}) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000001, 0x12, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) 40.466232022s ago: executing program 0 (id=272): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000100)=@arm64_fw={0x6030000000140003, &(0x7f0000000000)=0x100}) r6 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000000140)=@arm64_core={0x6030000000100010, &(0x7f0000000100)=0x2}) r12 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r12, 0xc018aec0, &(0x7f00000000c0)={0x5, 0x340, 0x1, 0x0}) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r13, 0x4020940d, 0xfffffffffffff4c2) syz_kvm_assert_reg(r6, 0x603000000013df11, 0x8000) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x108, &(0x7f0000000340)=0xfffffffffffffffc}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) 34.827440738s ago: executing program 1 (id=273): ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000040)=@other) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) (async) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x11) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000080)={0x1000, 0x10a000, 0x1}) (async) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000080)={0x1000, 0x10a000, 0x1}) syz_kvm_vgic_v3_setup(r0, 0x2, 0x0) (async) r1 = syz_kvm_vgic_v3_setup(r0, 0x2, 0x0) ioctl$KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x8, 0xc9ed, &(0x7f00000000c0)=0x101}) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000140)={0x8, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000180)={0x2, 0x3, 0xdddd0000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) ioctl$KVM_GET_API_VERSION(r2, 0xae00, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000380)={0x0, &(0x7f0000000200)=[@eret={0xe6, 0x18, 0x8c}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x327}}, @svc={0x122, 0x40, {0x84000012, [0x6, 0x89fe, 0x1, 0xf56, 0x5]}}, @code={0xa, 0x6c, {"e02a86d200c0b8f2a10080d2e20080d2830080d2640080d2020000d4203491d20020b8f2810180d2c20080d2e30080d2640080d2020000d40080c08800a4002f0080000800c0241e0000439e0060400d007008d500a4202e"}}, @svc={0x122, 0x40, {0xc400000c, [0x9, 0x10000, 0x6, 0x72, 0x2]}}, @irq_setup={0x46, 0x18, {0x3, 0x3d8}}], 0x144}, &(0x7f00000003c0)=[@featur1={0x1, 0x20}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000400)={0xe, 0xffffffffffffffff}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x36) (async) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x36) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000480)=@attr_arm64={0x0, 0x3, 0x1, &(0x7f0000000440)=0x7}) (async) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000480)=@attr_arm64={0x0, 0x3, 0x1, &(0x7f0000000440)=0x7}) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x141080, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x141080, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x40) ioctl$KVM_SET_DEVICE_ATTR_vm(r7, 0x4018aee1, &(0x7f0000000540)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000500)={0x3, 0x9}}) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000800)={0x0, &(0x7f0000000580)=[@its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x1, 0x2, 0x4, 0x1, 0x1}}, @uexit={0x0, 0x18, 0x5}, @msr={0x14, 0x20, {0x603000000013deee, 0x200}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x114}}, @code={0xa, 0x6c, {"00b0205e0024200e0000204e000080f2007008d5007008d560579cd200e0b0f2210180d2620180d2830180d2a40180d2020000d4207083d200a0b8f2210180d2820080d2830180d2840180d2020000d40038216e000008d5"}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x1400, 0xd, 0x8}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe0, 0xffffffffffffffff, 0x5}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x178}}, @uexit={0x0, 0x18, 0xc42d}, @memwrite={0x6e, 0x30, @generic={0xeeee0000, 0x790, 0x2c2}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x280, 0x100000001, 0x9}}, @msr={0x14, 0x20, {0x603000000013e729, 0x6}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x1, 0xb, 0x9, 0x3ff, 0x3}}, @eret={0xe6, 0x18, 0xeec2}], 0x254}, &(0x7f0000000840)=[@featur2={0x1, 0xb2}], 0x1) (async) r8 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000800)={0x0, &(0x7f0000000580)=[@its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x1, 0x2, 0x4, 0x1, 0x1}}, @uexit={0x0, 0x18, 0x5}, @msr={0x14, 0x20, {0x603000000013deee, 0x200}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x114}}, @code={0xa, 0x6c, {"00b0205e0024200e0000204e000080f2007008d5007008d560579cd200e0b0f2210180d2620180d2830180d2a40180d2020000d4207083d200a0b8f2210180d2820080d2830180d2840180d2020000d40038216e000008d5"}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x1400, 0xd, 0x8}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe0, 0xffffffffffffffff, 0x5}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x178}}, @uexit={0x0, 0x18, 0xc42d}, @memwrite={0x6e, 0x30, @generic={0xeeee0000, 0x790, 0x2c2}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x280, 0x100000001, 0x9}}, @msr={0x14, 0x20, {0x603000000013e729, 0x6}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x1, 0xb, 0x9, 0x3ff, 0x3}}, @eret={0xe6, 0x18, 0xeec2}], 0x254}, &(0x7f0000000840)=[@featur2={0x1, 0xb2}], 0x1) ioctl$KVM_SET_GUEST_DEBUG_arm64(r8, 0x4208ae9b, &(0x7f0000000880)={0x20001, 0x0, {[0xfffffffffffffff9, 0x62abea5a, 0x3, 0x0, 0x401, 0x2, 0x98, 0x80, 0x2, 0x7, 0x8, 0x235, 0x9, 0x200, 0x401, 0x5], [0x5, 0x6, 0x0, 0x7, 0x4, 0x8000, 0x4, 0xe, 0xff, 0x4, 0xffffffffffffff51, 0x0, 0x4, 0x9, 0x4f4, 0xffffffffffff0000], [0x4, 0xa, 0x7, 0x40, 0x4, 0x10, 0x200, 0xf54, 0x91, 0x2, 0x100000001, 0x100000000, 0xfffffffffffffffc, 0x7, 0x6, 0xb36], [0x7fffffff, 0x8, 0xfffffffffffffffb, 0x4, 0x2, 0x7, 0x2, 0xbb8, 0xeddc, 0x9, 0x7, 0xf, 0x400, 0x7d, 0x7, 0x7]}}) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r0, 0x4010ae74, &(0x7f0000000ac0)={0xffffcc29, 0x1, 0x8}) r9 = ioctl$KVM_CREATE_GUEST_MEMFD(r0, 0xc040aed4, &(0x7f0000000b00)={0x4, 0x6}) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f0000000b40)={0x10001, 0x2, 0x4000, 0x2000, &(0x7f0000ffe000/0x2000)=nil, 0x656b, r9}) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f0000000b40)={0x10001, 0x2, 0x4000, 0x2000, &(0x7f0000ffe000/0x2000)=nil, 0x656b, r9}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f0000000c40)=@attr_arm64={0x0, 0x1, 0x1, &(0x7f0000000c00)=0x1ffa}) ioctl$KVM_PRE_FAULT_MEMORY(r8, 0xc040aed5, &(0x7f0000000c80)={0x1000, 0x2000}) ioctl$KVM_SET_SIGNAL_MASK(r3, 0x4004ae8b, &(0x7f0000000cc0)={0xff, "367d9d8fbb8a6c474e986f5392336dcd576ed74dbcf96c1aea1a0dad965622db78e334696bfd9f1e7e446cd5b90e236a5f548e16f92ec3a971b72ba18903623f1e4bed6e2064078c4decf25a9a8ff907fbb57e9878f49649e45550eb916da929fb9df013cdc54e778fb442fe18b804bc8f84c022a6a2446fdaa8c082ddb1702a2249dc47385b71dcae1eec54077562472693d4453d8f3232781af0f4c82ec4f9faf2e10474a7f5ec2749608f60707edaa6773a75d0bafa4f338113ffe97cc9c70fe9c76aa105aac5cc88a3d92320c4f59bd2989e8d7897e1888ae36dee3becc82388fc32ed2d5b80f98427932cb79f77c09b3a87bcc8f46b50aec10b8cce85"}) ioctl$KVM_CAP_PTP_KVM(r7, 0x4068aea3, &(0x7f0000000e00)) ioctl$KVM_HAS_DEVICE_ATTR_vm(r5, 0x4018aee3, &(0x7f0000000ec0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000e80)={0x3d0, 0x8, 0x1}}) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r8, 0x4018aee2, &(0x7f0000000f40)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000f00)=0x1a}) 29.459999388s ago: executing program 0 (id=274): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x1, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x4, 0xa0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x27) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x8040aeb6, &(0x7f00000001c0)=@attr_other={0x0, 0x7, 0x1, 0x0}) r7 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_GET_STATS_FD_vm(r10, 0xaece) r11 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f0000000000)={0x7}) r12 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r11, 0x4040ae79, &(0x7f0000000080)={0x0, 0x0, 0x0, r12}) ioctl$KVM_REGISTER_COALESCED_MMIO(r11, 0x4010ae67, &(0x7f00000002c0)={0x0, 0x10000}) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) ioctl$KVM_GET_DIRTY_LOG(r11, 0x4010ae42, &(0x7f00000001c0)={0x10002, 0x0, &(0x7f0000e84000/0x1000)=nil}) ioctl$KVM_CHECK_EXTENSION(r13, 0xae03, 0x6) ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f00000000c0)={0x8}) ioctl$KVM_SIGNAL_MSI(r11, 0x4020aea5, &(0x7f0000000000)={0x6000}) syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x1}}], 0x28}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000000)=@attr_other={0x0, 0x5, 0xb, &(0x7f0000000200)=0xc}) 28.99593183s ago: executing program 1 (id=275): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x6030000000139828, 0x7fff}}], 0x20}, 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r6, 0x400454da, 0x1) (async) ioctl$KVM_ARM_SET_DEVICE_ADDR(r3, 0x4010aeab, &(0x7f0000000000)={0x4, 0xffff1000}) (async) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000080)=@arm64) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, 0x0) (async) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r3, 0x4018aee2, &(0x7f0000000100)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000000c0)={0x719, 0x2, 0x1}}) (async) ioctl$KVM_ASSIGN_SET_MSIX_NR(r5, 0x4008ae73, &(0x7f0000000040)={0x9, 0x8}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) 21.645854302s ago: executing program 1 (id=276): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r2, 0x4018aee1, 0xffffffffffffffff) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r5 = mmap$KVM_VCPU(&(0x7f000000d000/0x3000)=nil, 0x930, 0x3, 0x12, r4, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x408) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) 17.718460741s ago: executing program 0 (id=277): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f0000000700)=[@smc={0x1e, 0x40, {0x8400000a, [0x8, 0x7, 0x0, 0x8001, 0x800000007]}}], 0x40}, &(0x7f0000000100), 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_init) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r5, 0xffffffffffffffff) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0x40086602, 0x1) r8 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x8}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x1, 0x0, 0x0, 0x79, 0x1}}], 0xffffffffffffffcb}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r8, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) r12 = eventfd2(0x0, 0x0) ioctl$KVM_CREATE_VM(r12, 0x80111500, 0x20000000) ioctl$KVM_RUN(r10, 0xae80, 0x0) r13 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x12) ioctl$KVM_CLEAR_DIRTY_LOG(r13, 0xc018aec0, &(0x7f0000000000)={0x1ff, 0x400, 0x100, &(0x7f00000002c0)=[0x5, 0x8000000000000001, 0x3, 0x91d0, 0xde7, 0x4e, 0x7ff, 0x401, 0x4, 0xf6fd, 0x7f, 0x80, 0x6, 0x0, 0xa535, 0x9, 0x2, 0xfffffffffffffffe, 0x400, 0x3, 0x4, 0x8, 0x6, 0x5, 0x10001, 0x5, 0x7fffffff, 0x0, 0x2, 0x8, 0x100, 0x3, 0x1, 0x7, 0x31, 0x2432, 0x6, 0x9, 0x5, 0x3, 0xb, 0x8, 0x4, 0x0, 0xb, 0x2, 0x9, 0x8, 0xa, 0x4, 0x7, 0x3, 0x8, 0x9844, 0x7, 0xfffffffffffff592, 0x600, 0x2207, 0x9, 0x10000, 0x5, 0xf, 0x6, 0x9, 0x7ff, 0x1, 0x5, 0xffffffffffffffff, 0x5, 0x4db0, 0xe6, 0x50, 0xd0f, 0x5, 0x1, 0x4, 0x7, 0x6, 0x10000, 0xfff, 0x7d66, 0x9, 0xe, 0x6, 0x84, 0x5, 0x7, 0x8000000000000001, 0x2b73, 0x5, 0x4c1d, 0x9, 0x3, 0x9, 0x17b, 0x2, 0x1ff, 0x8, 0x7, 0x3, 0x6, 0x4e0, 0x81, 0xa, 0x6, 0x2cf5f95, 0xa796, 0x7fffffff, 0x2, 0x0, 0x7e54, 0x5, 0x3, 0x80000001, 0xa01, 0x8, 0x7fff, 0xfffffffffffffff7, 0x5, 0x0, 0xac7, 0xffffffff, 0x751a, 0x98, 0xffffffff, 0x401, 0x216d, 0xe5]}) 11.321201126s ago: executing program 1 (id=278): mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x5f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000f99000/0x3000)=nil, 0x930, 0x1000002, 0x4f832, 0xffffffffffffffff, 0x0) 7.419600922s ago: executing program 0 (id=279): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8521, 0x0) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) (async, rerun: 32) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async) r4 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) syz_kvm_assert_reg(r7, 0x603000000013df1a, 0x8000) (async) r8 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce5, 0x7fff}}, @msr={0x14, 0x20, {0x603000000013dce8, 0x8000}}, @msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x60}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) r9 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000e31000/0x2000)=nil, 0x930, 0xa, 0x2012, r11, 0x40000) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r14, 0x401c5820, 0x8000000000000001) (async) ioctl$KVM_IOEVENTFD(r13, 0x4040ae79, &(0x7f0000000040)={0x0, 0x5000, 0x0, 0xffffffffffffffff, 0xc}) r15 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x28) ioctl$KVM_CREATE_IRQCHIP(r13, 0xae60) (async) ioctl$KVM_CHECK_EXTENSION(r9, 0xae03, 0x4) r16 = syz_kvm_setup_syzos_vm$arm64(r15, &(0x7f0000a97000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) (async) eventfd2(0x6f9, 0x800) (async) r17 = syz_kvm_add_vcpu$arm64(r16, &(0x7f0000000240)={0x0, &(0x7f0000000380)=[@hvc={0x32, 0x40, {0x30000000, [0x2, 0x3e, 0x7fff, 0x2]}}, @smc={0x1e, 0x40, {0x8600ff01, [0x7, 0x9, 0xfff, 0x9, 0x5]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x3000, 0x8, 0x2}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x300, 0xfffffffffffffffb, 0x2}}, @msr={0x14, 0x20, {0x603000000013c4c8, 0x9}}, @memwrite={0x6e, 0x30, @generic={0x2, 0xc3d, 0x1}}, @hvc={0x32, 0x40, {0xc4000005, [0x6, 0x2, 0xfffffffffffffffd, 0x3000000, 0x50b]}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x1, 0x2, 0xb, 0x2, 0x4, 0x2}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x80, 0x800, 0x3}}, @smc={0x1e, 0x40, {0x100, [0x0, 0x9, 0x101, 0x3, 0x7fff]}}], 0x208}, &(0x7f0000000280)=[@featur2={0x1, 0x1}], 0x1) ioctl$KVM_GET_MP_STATE(r17, 0x8004ae98, &(0x7f00000002c0)) 6.919926208s ago: executing program 1 (id=280): r0 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000500)={0x0, &(0x7f0000000000)=[@eret={0xe6, 0x18, 0x67}, @msr={0x14, 0x20, {0x603000000013df7d, 0xffff}}, @code={0xa, 0xcc, {"0020601e0004005e20f395d20020b8f2810080d2c20180d2630080d2840180d2020000d4a08d91d20000b8f2c10180d2020180d2a30080d2440080d2020000d4a04e9cd200e0b0f2010180d2220080d2a30180d2240080d2020000d4a0899ed200a0b8f2210080d2e20080d2a30180d2640180d2020000d4e0aa90d200e0b8f2210080d2220180d2430180d2640180d2020000d40000202b60be80d20060b8f2810080d2c20180d2030080d2a40080d2020000d4007008d5"}}, @irq_setup={0x46, 0x18, {0x2, 0x362}}, @svc={0x122, 0x40, {0x80003fff, [0x1, 0x1, 0x8, 0x1000, 0x40000]}}, @msr={0x14, 0x20, {0x603000000013c03a}}, @svc={0x122, 0x40, {0x3f000000, [0x2, 0xa2, 0x9, 0x4, 0x7]}}, @memwrite={0x6e, 0x30, @generic={0xf000, 0x481, 0x7fff}}, @svc={0x122, 0x40, {0x8400000f, [0x6, 0x80000001, 0x9d, 0x7, 0x9]}}, @smc={0x1e, 0x40, {0x2000, [0x7, 0xd86c, 0x3ff, 0x4, 0x8001]}}, @mrs={0xbe, 0x18, {0x603000000013c112}}, @svc={0x122, 0x40, {0x3000000, [0xee2, 0x7, 0x7fffffff, 0x990e, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x1, 0xb, 0x0, 0x2, 0x3}}, @code={0xa, 0x84, {"008008d5002a85d200a0b8f2a10080d2a20080d2c30080d2840180d2020000d4000028d5007008d5007a93d20020b8f2810180d2620080d2430080d2440080d2020000d4000008d5008008d560948fd200a0b8f2810180d2020180d2a30080d2640080d2020000d400c8a12e007008d5"}}, @uexit={0x0, 0x18, 0x10001}, @smc={0x1e, 0x40, {0x5000000, [0x80000000, 0x4, 0x2, 0x7e6, 0x7]}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x3, 0x9, 0x4, 0x2, 0x1}}, @hvc={0x32, 0x40, {0x84000007, [0x6, 0xfffffffffffffffe, 0x7, 0x0, 0x1]}}, @hvc={0x32, 0x40, {0x8, [0x7, 0x7fffffff, 0x100000000, 0xe, 0x4]}}, @mrs={0xbe, 0x18, {0x603000000013801a}}, @eret={0xe6, 0x18, 0x3}, @hvc={0x32, 0x40, {0x4000000, [0xffffffffffff5e8b, 0xe, 0xfffffffffffffffd, 0x4, 0x6]}}], 0x4e0}, &(0x7f0000000540)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000580)={0x2, 0x10000}) ioctl$KVM_SET_ONE_REG(r0, 0x4010aeac, &(0x7f0000000600)=@arm64_extra={0x603000000013c026, &(0x7f00000005c0)=0xcdf}) ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000640)={0x3, 0x100000}) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f00000006c0)=@arm64_ccsidr={0x6020000000110007, &(0x7f0000000680)=0x4c0}) r1 = ioctl$KVM_GET_STATS_FD_cpu(r0, 0xaece) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000700), 0x40, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2d) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f0000000780)=@arm64_fp={0x604000000010006b, &(0x7f0000000740)=0x1}) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r3, 0x4068aea3, &(0x7f00000007c0)={0xe4, 0x0, 0xc}) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bff000/0x400000)=nil) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000840), 0x486000, 0x0) r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000880)) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000940)=@arm64_fw={0x6030000000140000, &(0x7f0000000900)=0x7d00000}) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2c) syz_kvm_setup_cpu$arm64(r7, r0, &(0x7f0000ba6000/0x400000)=nil, &(0x7f0000000b40)=[{0x0, &(0x7f0000000980)=[@svc={0x122, 0x40, {0x1000000, [0x6, 0x7, 0x36aedd8c, 0x5, 0x1]}}, @eret={0xe6, 0x18, 0x1}, @svc={0x122, 0x40, {0x8400000e, [0x7, 0x4, 0x0, 0x9, 0xbb03]}}, @smc={0x1e, 0x40, {0x84000013, [0x0, 0x0, 0x4, 0x4, 0x8000]}}, @hvc={0x32, 0x40, {0xc4000014, [0x532, 0x6, 0x7, 0x400, 0x3]}}, @mrs={0xbe, 0x18, {0x6030000000138046}}, @eret={0xe6, 0x18, 0x4}, @uexit={0x0, 0x18}, @uexit={0x0, 0x18, 0x6697}, @irq_setup={0x46, 0x18, {0x0, 0x186}}], 0x190}], 0x1, 0x0, &(0x7f0000000b80)=[@featur1={0x1, 0x64}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000bc0)={0x3, 0x1, 0xffff1000, 0x1000, &(0x7f0000eb0000/0x1000)=nil}) r8 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000001180)={0x0, &(0x7f0000000c00)=[@msr={0x14, 0x20, {0x603000000013e6d4, 0xb7}}, @hvc={0x32, 0x40, {0x8600ff01, [0x0, 0x1, 0x2, 0x1, 0x6]}}, @its_setup={0x82, 0x28, {0x2, 0x100000000, 0x182}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0xb0, 0x4, 0x1}}, @code={0xa, 0xb4, {"e00893d20020b0f2410180d2a20180d2e30180d2e40180d2020000d4007008d5207684d20060b8f2c10180d2c20080d2a30180d2040080d2020000d4000028d50090807f405993d200e0b0f2810080d2620080d2030080d2040080d2020000d4e0108ad20080b8f2810080d2e20080d2030080d2440080d2020000d400699ad200e0b8f2c10080d2220080d2430080d2a40080d2020000d4000008d5df3003d5"}}, @smc={0x1e, 0x40, {0x4, [0x2, 0x10000, 0x8000000000000001, 0xfffffffffffffffe, 0x4]}}, @msr={0x14, 0x20, {0x603000000013e088, 0xfffffffffffffffb}}, @mrs={0xbe, 0x18, {0x603000000013c2a1}}, @mrs={0xbe, 0x18, {0x6030000000138047}}, @irq_setup={0x46, 0x18, {0x3, 0xeb}}, @uexit={0x0, 0x18, 0x3}, @svc={0x122, 0x40, {0x4000000, [0x3ff, 0x1, 0x4, 0x6, 0x1ff]}}, @smc={0x1e, 0x40, {0x86000001, [0x7, 0x4, 0x6, 0x9]}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x4, 0x5, 0x3, 0x9, 0x1}}, @code={0xa, 0x54, {"00040038606e81d200a0b0f2e10080d2820080d2830180d2e40180d2020000d400000088000028d5007008d5007008d5007008d5007008d5007008d5003c4093"}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x1, 0x8, 0xe, 0xc}}, @its_setup={0x82, 0x28, {0x4, 0x4, 0xea}}, @code={0xa, 0xb4, {"20678cd20000b0f2410180d2020080d2a30180d2840180d2020000d4000008d5c0b186d20080b0f2e10180d2020080d2c30080d2040080d2020000d4608698d20080b8f2610080d2020180d2030180d2440180d2020000d440f09cd20020b0f2c10080d2c20080d2e30180d2a40180d2020000d4606d93d20000b0f2410180d2220080d2a30080d2a40080d2020000d4008008d5007008d50000ae9e007ca09b"}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x1, 0xe, 0x9, 0xdb, 0x1}}, @svc={0x122, 0x40, {0x2, [0x1, 0x100, 0x3, 0x9, 0xffffffffffff0000]}}, @uexit={0x0, 0x18, 0x8}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x80, 0x6, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013801d}}, @irq_setup={0x46, 0x18, {0x1, 0x329}}, @its_setup={0x82, 0x28, {0x2, 0x3, 0x2d5}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x90, 0x2, 0x3}}], 0x564}, &(0x7f00000011c0)=[@featur2], 0x1) ioctl$KVM_RUN(r8, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000f52000/0x2000)=nil, r6, 0x1, 0x40a0030, r0, 0x0) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r7, 0x4010ae74, &(0x7f0000001200)={0x7, 0x7, 0x4}) syz_kvm_setup_cpu$arm64(r3, r8, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000001640)=[{0x0, &(0x7f0000001240)=[@svc={0x122, 0x40, {0x84000006, [0x5, 0xe4c, 0x7, 0x6, 0x7fff]}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x2, 0x4, 0x8, 0x7fff, 0x3}}, @msr={0x14, 0x20, {0x603000000013df7b, 0xa}}, @irq_setup={0x46, 0x18, {0x0, 0x1ec}}, @smc={0x1e, 0x40, {0x55, [0x0, 0x2000000000000000, 0x7326238d, 0x4, 0x1]}}, @uexit={0x0, 0x18, 0x4}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe8, 0x200, 0x2}}, @smc={0x1e, 0x40, {0xc4000011, [0x0, 0x0, 0x0, 0x100000000]}}, @mrs={0xbe, 0x18, {0x603000000013de96}}, @uexit={0x0, 0x18, 0x6}, @smc={0x1e, 0x40, {0x8600ff01, [0x5c, 0x600000000000000, 0x7, 0x10, 0x2]}}, @eret={0xe6, 0x18, 0x4}, @uexit={0x0, 0x18, 0x4}, @svc={0x122, 0x40, {0x80008000, [0x400, 0x0, 0xc, 0x2, 0x6]}}, @svc={0x122, 0x40, {0x84000005, [0x4, 0x9, 0x8, 0x3, 0x3]}}, @smc={0x1e, 0x40, {0x30000000, [0x9, 0x7fff, 0x9, 0x8, 0x409]}}, @code={0xa, 0x9c, {"c0e792d200a0b0f2010080d2220080d2430180d2040080d2020000d4000008d5c02695d200c0b8f2810080d2a20180d2030180d2840180d2020000d4803582d20040b0f2810080d2a20080d2430080d2e40080d2020000d4c04882d20080b8f2810080d2420180d2e30080d2440080d2020000d4007008d5007008d5000028d5009c006f007008d5"}}, @hvc={0x32, 0x40, {0x44005fef, [0x6, 0x8, 0x3, 0x5, 0xffffffffffffffc0]}}, @uexit={0x0, 0x18, 0x2}, @svc={0x122, 0x40, {0x84000006, [0x1, 0x3, 0x7fffffffffffffff, 0x9, 0x10001]}}], 0x3fc}], 0x1, 0x0, &(0x7f0000001680)=[@featur1={0x1, 0x161}], 0x1) r9 = syz_kvm_vgic_v3_setup(r7, 0x4, 0x0) r10 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000001e00)={0x0, &(0x7f00000016c0)=[@msr={0x14, 0x20, {0x603000000013def1, 0x4}}, @code={0xa, 0x9c, {"a07f87d200e0b8f2010080d2620180d2e30180d2640080d2020000d4001b9dd20060b8f2210180d2c20080d2e30080d2040080d2020000d4c04c87d20000b8f2c10180d2820080d2630080d2e40180d2020000d4000028d5000028d5007008d50048217e000008d5c00e8dd20020b0f2610180d2e20080d2830180d2240080d2020000d4000028d5"}}, @msr={0x14, 0x20, {0x603000000013dee2, 0x1}}, @code={0xa, 0x84, {"0000421e007008d500cf92d20080b8f2810080d2e20080d2e30080d2e40180d2020000d40020e00d0020004f007008d5007008d50024c09a20e98bd200e0b8f2c10180d2420180d2630080d2640180d2020000d480ea8ed200e0b0f2a10080d2420180d2230080d2440180d2020000d4"}}, @svc={0x122, 0x40, {0xc400000e, [0x401, 0x8, 0x4, 0x1, 0x1]}}, @smc={0x1e, 0x40, {0x40000000, [0x8000, 0x0, 0xe, 0x6, 0x1]}}, @svc={0x122, 0x40, {0x0, [0xff, 0x4, 0x10000, 0x8]}}, @svc={0x122, 0x40, {0x84000002, [0xa2, 0x2, 0x800, 0x8, 0x2]}}, @irq_setup={0x46, 0x18, {0x1, 0x2fd}}, @its_setup={0x82, 0x28, {0x2, 0x0, 0x1a8}}, @uexit={0x0, 0x18, 0x1}, @hvc={0x32, 0x40, {0x1000000, [0xb, 0x1, 0x3, 0xdfa8, 0x30000000000]}}, @hvc={0x32, 0x40, {0xc4000011, [0x7, 0x5, 0x5, 0x6, 0x8]}}, @code={0xa, 0x54, {"607398d20080b0f2010180d2020080d2830080d2440180d2020000d4000028d50000001b000028d5000c00f8000028d50000208a007008d5000400b80000259e"}}, @irq_setup={0x46, 0x18, {0x2, 0x39f}}, @smc={0x1e, 0x40, {0x84000009, [0x2, 0xd1, 0x5, 0xe000]}}, @hvc={0x32, 0x40, {0x84000002, [0x1, 0x1, 0x5, 0x6f, 0x1ff]}}, @its_setup={0x82, 0x28, {0x3, 0x3, 0xe}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x3, 0x2, 0x6, 0x3, 0x3}}, @mrs={0xbe, 0x18, {0x6030000000138026}}, @svc={0x122, 0x40, {0x8400000b, [0x80, 0x8, 0x4, 0x5]}}, @irq_setup={0x46, 0x18, {0xffff7fff, 0x378}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x4, 0xb, 0xa, 0x15b, 0x1}}, @hvc={0x32, 0x40, {0x2000003, [0x2, 0x4, 0x565, 0x0, 0x7fffffffffffffff]}}, @code={0xa, 0x9c, {"007008d5bf2003d5c00295d20080b0f2810180d2620180d2e30180d2440180d2020000d400b8a17e401690d200e0b0f2c10180d2220180d2c30180d2e40180d2020000d40014002fa08e88d20020b0f2410080d2020180d2830080d2640080d2020000d4000008d5007008d5e0348ed200e0b0f2c10180d2420180d2830080d2440080d2020000d4"}}, @eret={0xe6, 0x18, 0x7}, @its_setup={0x82, 0x28, {0x2, 0x0, 0x256}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x1, 0x1, 0xf, 0xf7, 0xcd8, 0x3}}, @code={0xa, 0x9c, {"008008d50040601e007008d5007008d5a0ae80d200c0b8f2010180d2220080d2030080d2c40080d2020000d4007008d5209092d200e0b8f2410080d2020180d2630080d2a40180d2020000d4607494d200c0b8f2a10180d2e20080d2630180d2a40080d2020000d4c08385d20080b8f2e10180d2220080d2c30080d2640080d2020000d4008008d5"}}, @msr={0x14, 0x20, {0x603000000013c213, 0x9}}], 0x70c}, &(0x7f0000001e40)=[@featur2={0x1, 0x20}], 0x1) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f0000001ec0)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000001e80)=0x84}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_GUEST_DEBUG_arm64(r0, 0x4208ae9b, &(0x7f0000001f00)={0x20000, 0x0, {[0x7fffffffffffffff, 0x2, 0x0, 0x0, 0x67, 0x8, 0x4, 0x7, 0x3, 0x9f0d, 0x0, 0x0, 0x9, 0x9, 0x3b3, 0x65c], [0x5, 0x2, 0x6, 0x1, 0x4, 0x8, 0x9ea, 0xffffffffffffffff, 0x8000000000000001, 0x7, 0x6, 0x8, 0xfffffffffffffffe, 0x7, 0xfffffffffffffff8], [0x0, 0x1b8, 0x29e05f10, 0x1ff, 0x8, 0x2, 0x6, 0x5, 0x10000, 0x8000000000000001, 0x200, 0x0, 0x5, 0x2, 0x1, 0x5], [0x247e, 0x7, 0x77, 0x7, 0x9, 0xfffffffffffffff8, 0xffffffffffffc07d, 0x1, 0x81, 0xbf, 0x40, 0x401, 0x2, 0x37e6, 0xe2af, 0x7]}}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000002180)=@attr_other={0x0, 0x7ff, 0x5, &(0x7f0000002140)=0xffffffff}) munmap(&(0x7f0000cce000/0x1000)=nil, 0x1000) 0s ago: executing program 0 (id=281): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f000000f000/0x1000)=nil, 0x1000) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): [ 381.229879][ T3144] 8021q: adding VLAN 0 to HW filter on device bond0 [ 417.183472][ T3144] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:32317' (ED25519) to the list of known hosts. [ 595.595148][ T25] audit: type=1400 audit(594.780:61): avc: denied { name_bind } for pid=3300 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 596.565271][ T25] audit: type=1400 audit(595.750:62): avc: denied { execute } for pid=3301 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 596.602362][ T25] audit: type=1400 audit(595.780:63): avc: denied { execute_no_trans } for pid=3301 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 619.280180][ T25] audit: type=1400 audit(618.470:64): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 619.315931][ T25] audit: type=1400 audit(618.500:65): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 619.400332][ T3301] cgroup: Unknown subsys name 'net' [ 619.449502][ T25] audit: type=1400 audit(618.640:66): avc: denied { unmount } for pid=3301 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 619.839793][ T3301] cgroup: Unknown subsys name 'cpuset' [ 619.939768][ T3301] cgroup: Unknown subsys name 'rlimit' [ 620.850480][ T25] audit: type=1400 audit(620.040:67): avc: denied { setattr } for pid=3301 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 620.869979][ T25] audit: type=1400 audit(620.050:68): avc: denied { mounton } for pid=3301 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 620.899396][ T25] audit: type=1400 audit(620.090:69): avc: denied { mount } for pid=3301 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 622.494091][ T3304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 622.515504][ T25] audit: type=1400 audit(621.700:70): avc: denied { relabelto } for pid=3304 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 622.544398][ T25] audit: type=1400 audit(621.730:71): avc: denied { write } for pid=3304 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 622.735909][ T25] audit: type=1400 audit(621.920:72): avc: denied { read } for pid=3301 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 622.754275][ T25] audit: type=1400 audit(621.940:73): avc: denied { open } for pid=3301 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 622.799737][ T3301] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 673.036130][ T25] audit: type=1400 audit(672.200:74): avc: denied { execmem } for pid=3305 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 677.615018][ T25] audit: type=1400 audit(676.790:75): avc: denied { read } for pid=3307 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 677.632758][ T25] audit: type=1400 audit(676.820:76): avc: denied { open } for pid=3307 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 677.690735][ T25] audit: type=1400 audit(676.880:77): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 677.959806][ T25] audit: type=1400 audit(677.150:78): avc: denied { module_request } for pid=3308 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 677.976717][ T25] audit: type=1400 audit(677.170:79): avc: denied { module_request } for pid=3307 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 679.070661][ T25] audit: type=1400 audit(678.260:80): avc: denied { sys_module } for pid=3307 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 706.997867][ T3308] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 707.793030][ T3308] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 708.885173][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 709.068281][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 720.708480][ T3308] hsr_slave_0: entered promiscuous mode [ 720.736927][ T3308] hsr_slave_1: entered promiscuous mode [ 721.580032][ T3307] hsr_slave_0: entered promiscuous mode [ 721.627314][ T3307] hsr_slave_1: entered promiscuous mode [ 721.663369][ T3307] debugfs: 'hsr0' already exists in 'hsr' [ 721.674330][ T3307] Cannot create hsr debugfs directory [ 727.119875][ T25] audit: type=1400 audit(726.310:81): avc: denied { create } for pid=3308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 727.176986][ T25] audit: type=1400 audit(726.370:82): avc: denied { write } for pid=3308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 727.253501][ T25] audit: type=1400 audit(726.440:83): avc: denied { read } for pid=3308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 727.357149][ T3308] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 727.620579][ T3308] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 728.024443][ T3308] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 728.386412][ T3308] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 729.839255][ T3307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 730.095266][ T3307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 730.276511][ T3307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 730.415648][ T3307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 743.068557][ T3308] 8021q: adding VLAN 0 to HW filter on device bond0 [ 745.354237][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 801.338863][ T3308] veth0_vlan: entered promiscuous mode [ 801.805790][ T3308] veth1_vlan: entered promiscuous mode [ 803.932800][ T3307] veth0_vlan: entered promiscuous mode [ 804.225855][ T3308] veth0_macvtap: entered promiscuous mode [ 804.525852][ T3308] veth1_macvtap: entered promiscuous mode [ 804.656686][ T3307] veth1_vlan: entered promiscuous mode [ 806.868640][ T3345] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.887554][ T3345] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.888819][ T3345] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.889635][ T3345] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 807.380136][ T3307] veth0_macvtap: entered promiscuous mode [ 807.789875][ T3307] veth1_macvtap: entered promiscuous mode [ 809.456188][ T25] audit: type=1400 audit(808.650:84): avc: denied { mount } for pid=3308 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 809.636552][ T25] audit: type=1400 audit(808.810:85): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/syzkaller.lhld8S/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 809.840224][ T25] audit: type=1400 audit(809.020:86): avc: denied { mount } for pid=3308 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 810.229523][ T25] audit: type=1400 audit(809.420:87): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/syzkaller.lhld8S/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 810.440500][ T25] audit: type=1400 audit(809.630:88): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/syzkaller.lhld8S/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3763 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 810.600428][ T3388] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.630253][ T3388] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.672862][ T3388] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.685449][ T3388] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 811.120331][ T25] audit: type=1400 audit(810.290:89): avc: denied { unmount } for pid=3308 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 811.338107][ T25] audit: type=1400 audit(810.530:90): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 811.460340][ T25] audit: type=1400 audit(810.650:91): avc: denied { mount } for pid=3308 comm="syz-executor" name="/" dev="gadgetfs" ino=3774 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 811.767762][ T25] audit: type=1400 audit(810.940:92): avc: denied { mount } for pid=3308 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 811.908289][ T25] audit: type=1400 audit(811.100:93): avc: denied { mounton } for pid=3308 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 813.205484][ T3308] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 825.154124][ T25] kauditd_printk_skb: 4 callbacks suppressed [ 825.159156][ T25] audit: type=1400 audit(824.340:98): avc: denied { read } for pid=3460 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 825.247575][ T25] audit: type=1400 audit(824.440:99): avc: denied { open } for pid=3460 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 826.226637][ T25] audit: type=1400 audit(825.420:100): avc: denied { ioctl } for pid=3460 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 832.030364][ T3463] kvm [3463]: Failed to find VMA for hva 0x20c01000 [ 841.222093][ T25] audit: type=1400 audit(840.330:101): avc: denied { execute } for pid=3472 comm="syz.0.4" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=3992 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 863.257286][ T25] audit: type=1400 audit(862.440:102): avc: denied { write } for pid=3480 comm="syz.1.5" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 867.182885][ T25] audit: type=1400 audit(866.370:103): avc: denied { append } for pid=3481 comm="syz.0.6" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 919.598111][ T3509] debugfs: 'vgic-its-state@8080000' already exists in '3509-7' [ 931.348176][ T25] audit: type=1400 audit(930.510:104): avc: denied { ioctl } for pid=3513 comm="syz.0.16" path="net:[4026532624]" dev="nsfs" ino=4026532624 ioctlcmd=0xb702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1258.420557][ T25] audit: type=1400 audit(1257.610:105): avc: denied { setattr } for pid=3687 comm="syz.1.71" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1276.686410][ T3701] debugfs: 'vgic-its-state@8080000' already exists in '3701-4' [ 1444.902747][ T25] audit: type=1400 audit(1444.080:106): avc: denied { map } for pid=3815 comm="syz.0.106" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1593.085792][ T3911] kvm [3911]: Failed to find VMA for hva 0x20c01000 [ 1849.818924][ T4058] kvm [4058]: Failed to find VMA for hva 0x20de9000 [ 1982.597502][ T4153] kvm [4153]: Failed to find VMA for hva 0x21016000 [ 2054.992062][ T25] audit: type=1400 audit(2054.140:107): avc: denied { map } for pid=4194 comm="syz.0.220" path="pipe:[2780]" dev="pipefs" ino=2780 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 2397.390840][ T4389] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5fddf [ 2397.453620][ T4389] flags: 0x1ffd94000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x65) [ 2397.466032][ T4389] raw: 01ffd94000000000 ffffc1ffc07f7788 ffffc1ffc07f6d08 0000000000000000 [ 2397.509885][ T4389] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 2397.550491][ T4389] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 2397.575509][ T4389] ------------[ cut here ]------------ [ 2397.575766][ T4389] kernel BUG at ./include/linux/mm.h:1036! [ 2397.579377][ T4389] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 2397.584338][ T4389] Modules linked in: [ 2397.586514][ T4389] CPU: 0 UID: 0 PID: 4389 Comm: syz.1.280 Not tainted syzkaller #0 PREEMPT [ 2397.588119][ T4389] Hardware name: linux,dummy-virt (DT) [ 2397.589403][ T4389] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2397.590765][ T4389] pc : kvm_s2_put_page+0x374/0x3a0 [ 2397.593100][ T4389] lr : kvm_s2_put_page+0x374/0x3a0 [ 2397.594079][ T4389] sp : ffff80008ec07570 [ 2397.594839][ T4389] x29: ffff80008ec07570 x28: 1bf000001fdb4000 x27: 1bf000001fdb4000 [ 2397.596524][ T4389] x26: 00000000000000ff x25: ffff80008734e000 x24: ffffc1ffc0000000 [ 2397.597967][ T4389] x23: ffffc1ffc07f77c8 x22: 0000000000000000 x21: ffffc1ffc07f77f4 [ 2397.599389][ T4389] x20: 0000000000000000 x19: ffffc1ffc07f77c0 x18: 00000000d898d404 [ 2397.600840][ T4389] x17: 0000000005522104 x16: 00000000d898a63c x15: 00000000d356d3e7 [ 2397.602230][ T4389] x14: ffffffffffffffff x13: fff000001e1b1d88 x12: 0000000000000001 [ 2397.603655][ T4389] x11: 0000000000080000 x10: 00000000000561ec x9 : 58ca12b363c6ce00 [ 2397.605226][ T4389] x8 : 58ca12b363c6ce00 x7 : ffff80008039fbc8 x6 : 0000000000000000 [ 2397.606656][ T4389] x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008074aff8 [ 2397.608044][ T4389] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e [ 2397.609686][ T4389] Call trace: [ 2397.610638][ T4389] kvm_s2_put_page+0x374/0x3a0 (P) [ 2397.612029][ T4389] stage2_free_walker+0x1b0/0x264 [ 2397.613154][ T4389] __kvm_pgtable_walk+0x7d8/0xa68 [ 2397.614189][ T4389] kvm_pgtable_walk+0x294/0x468 [ 2397.615176][ T4389] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 2397.616322][ T4389] kvm_free_stage2_pgd+0x198/0x28c [ 2397.617272][ T4389] kvm_uninit_stage2_mmu+0x20/0x38 [ 2397.618288][ T4389] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 2397.619354][ T4389] kvm_mmu_notifier_release+0x48/0xa8 [ 2397.620400][ T4389] mmu_notifier_unregister+0x128/0x42c [ 2397.621431][ T4389] kvm_put_kvm+0x6a0/0xfa8 [ 2397.622312][ T4389] kvm_vcpu_release+0x70/0x9c [ 2397.623273][ T4389] __fput+0x4ac/0x980 [ 2397.624104][ T4389] ____fput+0x20/0x58 [ 2397.624913][ T4389] task_work_run+0x1bc/0x254 [ 2397.625796][ T4389] get_signal+0x13ec/0x1554 [ 2397.626700][ T4389] do_signal+0x23c/0x4dd0 [ 2397.627637][ T4389] do_notify_resume+0xb0/0x270 [ 2397.628587][ T4389] el0_svc+0xb8/0x164 [ 2397.629443][ T4389] el0t_64_sync_handler+0x84/0x12c [ 2397.630425][ T4389] el0t_64_sync+0x198/0x19c [ 2397.631990][ T4389] Code: d0037581 91251821 aa1303e0 97f9c9f2 (d4210000) [ 2397.633932][ T4389] ---[ end trace 0000000000000000 ]--- [ 2397.635535][ T4389] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 2397.637588][ T4389] Kernel Offset: disabled [ 2397.638324][ T4389] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 2397.639423][ T4389] Memory Limit: none [ 2397.641180][ T4389] Rebooting in 86400 seconds.. VM DIAGNOSIS: 09:31:32 Registers: info registers vcpu 0 CPU#0 PC=ffff80008048fe7c X00=0000000000000001 X01=0000000000000000 X02=0000000000000001 X03=ffff80008048c8ac X04=0000000000000000 X05=0000000000000000 X06=ffff80008048ab34 X07=ffff800080015834 X08=00000000000574a5 X09=03ff80008f0a9000 X10=00000000000574a4 X11=0000000000080000 X12=0000000000000000 X13=00000000ffffffff X14=0000000000000002 X15=ffff800087f83a20 X16=0000000000000000 X17=0000000005522104 X18=00000000d898d404 X19=00000000000003cb X20=efff800000000000 X21=ffff80008795f110 X22=00000000000003ca X23=00000000000000ff X24=ffff80008795f110 X25=00000000000003ca X26=77f000001e1b1d90 X27=00000000000003c0 X28=ffff800087735000 X29=ffff80008ec06fd0 X30=ffff80008048fe7c SP=ffff80008ec06f90 PSTATE=804023c9 N--- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=0a0a0a0a0a0a0a0a:0a0a0a0a0a0a0a0a Z01=3030303030300000:2930203d3d202965 Z02=635f6665725f6567:617028454741505f Z03=000000000000ffff:0000000000000000 Z04=0000000000000000:000000ff00000000 Z05=5f65676170284547:41505f4e4f5f4755 Z06=3a746e756f637061:6d20303a746e756f Z07=3030303030303a67:6e697070616d2030 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffcedb0af0:0000ffffcedb0af0 Z17=ffffff80ffffffd8:0000ffffcedb0ac0 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000