last executing test programs: 48m17.579329612s ago: executing program 1 (id=51): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x20}], 0x0, 0x0, 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000b80)={0x0, 0x0}, &(0x7f0000000280)=[@featur2={0x1, 0xf}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x0, 0x4, &(0x7f0000000080)=0xbced}) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x6030000000100000, &(0x7f00000001c0)=0x100000005}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f0000000140)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000000)=0x5}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) mmap$KVM_VCPU(&(0x7f0000edf000/0x3000)=nil, r8, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x20}], 0x0, 0x0, 0x0, 0x0) (async) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000b80)={0x0, 0x0}, &(0x7f0000000280)=[@featur2={0x1, 0xf}], 0x1) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x0, 0x4, &(0x7f0000000080)=0xbced}) (async) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x6030000000100000, &(0x7f00000001c0)=0x100000005}) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f0000000140)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000000)=0x5}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) (async) mmap$KVM_VCPU(&(0x7f0000edf000/0x3000)=nil, r8, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) (async) 48m9.531405466s ago: executing program 0 (id=53): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) r3 = eventfd2(0xffff10c0, 0x801) (async) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r5, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x16, 0x4, 0x1}}) (async) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000240)=[@hvc={0x32, 0x40, {0x8600ff01, [0x7, 0x9, 0x8, 0xfffffffffffffff8, 0x100]}}], 0x40}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async, rerun: 32) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000140)=[{0x0, &(0x7f00000002c0)=[@code={0xa, 0x9c, {"209687d20020b8f2c10180d2a20080d2430080d2a40180d2020000d40020002f000d9ed200a0b0f2210180d2e20080d2a30080d2840080d2020000d4e0ef96d20080b0f2a10180d2220080d2630180d2c40180d2020000d4203d9dd200e0b8f2610180d2c20080d2e30180d2040180d2020000d40000641e0008e03c000840fa008008d5007008d5"}}, @svc={0x122, 0x40, {0x84000013, [0x81, 0x3a23, 0x4, 0x0, 0x4a81]}}], 0xdc}], 0x1, 0x0, &(0x7f00000003c0)=[@featur1={0x1, 0x6}], 0x1) (async) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r6, 0x4018aee3, &(0x7f0000000000)=@attr_pvtime_ipa={0x0, 0x2, 0x0, 0x9}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000100)={0xf09, 0x8080000, 0x0, r3}) (async) r7 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000280)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}], 0x28}, 0x0, 0x0) (async) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) (async, rerun: 32) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) (rerun: 32) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) 48m8.665210307s ago: executing program 1 (id=54): r0 = eventfd2(0x0, 0x80000) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0x40049409, 0x13) (async) syz_kvm_vgic_v3_setup(r2, 0x2, 0x100) (async) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r0, 0x3}) 48m2.763105176s ago: executing program 1 (id=55): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@irq_setup={0x46, 0x18, {0x0, 0x26a}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0xd, 0xffffffffffffffff, 0x1}) openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@irq_setup={0x46, 0x18, {0x0, 0x26a}}], 0x18}, 0x0, 0x0) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0xd, 0xffffffffffffffff, 0x1}) (async) 48m2.141033904s ago: executing program 0 (id=56): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000890000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_fw={0x6030000000140002, &(0x7f0000000100)=0xc}) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2200, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x8040ae9f, 0xffffffffffffffff) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f00000002c0)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1, 0x16831, 0xffffffffffffffff, 0x0) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x5, 0x2}) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, r8, 0x0, 0x10, r7, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000890000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_fw={0x6030000000140002, &(0x7f0000000100)=0xc}) (async) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2200, 0x0) (async) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) (async) ioctl$KVM_GET_VCPU_EVENTS(r6, 0x8040ae9f, 0xffffffffffffffff) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000100)={0x7}) (async) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f00000002c0)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1, 0x16831, 0xffffffffffffffff, 0x0) (async) ioctl$KVM_IRQFD(r10, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x5, 0x2}) (async) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, r8, 0x0, 0x10, r7, 0x0) (async) 47m55.274356745s ago: executing program 1 (id=57): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000140)="38ce8347fc1e86008cfc72bb312c8659dcc9225b48cb5cb00c73b0b30800000073f7f1f493e89c859e17625ad1b19c73a7fd4ce992bfc316bd22ccc646cd69c72800", 0x0, 0x1f) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x62) 47m51.571705703s ago: executing program 0 (id=58): mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x8000000, 0x1000, 0x1}) (async) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000160006, &(0x7f0000000000)=0x8}) 47m50.071074232s ago: executing program 1 (id=59): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x40000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r2, r3, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="be00000000000000180000000000000001c8"], 0x18}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000700)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f00000007c0)=@arm64_core={0x6030000000100046, &(0x7f0000000780)=0x6e}) 47m46.486353772s ago: executing program 0 (id=60): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f00000000c0)=@arm64) r3 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000000)={0x4}) ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000d5e000/0x2000)=nil}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x3e) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000140000, &(0x7f0000000000)=0x10003}) 47m23.513547759s ago: executing program 0 (id=61): mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x1, &(0x7f0000000240)=0x104}) (async) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000001, 0x8032, r3, 0x0) 47m23.305946868s ago: executing program 1 (id=62): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = eventfd2(0xffffffff, 0x80000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x4, 0x8000000, 0x1, r3, 0xb}) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000200)={0x0, &(0x7f0000000500)=[@mrs={0xbe, 0x18, {0x6030000000138056}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x3a) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000000)=@arm64={0x0, 0x1, 0xf, '\x00', 0xfffffffffffff105}) ioctl$KVM_SET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9e, 0x7fffffff, 0x2}}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x33) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x3, 0xa0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r13, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0x9, 0xfffffffffffffff9, 0x0}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) (async, rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 47m17.264196901s ago: executing program 0 (id=63): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x3, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6e0000000000000030000000000000000000dddd0080"], 0x30}], 0x1, 0x0, 0x0, 0x0) (async) r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r12, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000080)={0x1ff, 0x401}}) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f0000000180)=@attr_arm64={0x0, 0x6, 0x3, &(0x7f0000000140)=0x7}) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x101300, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) (async) syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) r16 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r17 = ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r17, 0xc00caee0, &(0x7f0000000100)={0xa, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r18, 0x4018aee3, 0x0) (async) ioctl$KVM_HAS_DEVICE_ATTR(r18, 0x4018aee3, &(0x7f0000000040)=@attr_other={0x0, 0x1, 0x200, 0x0}) ioctl$KVM_CREATE_DEVICE(r15, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r19, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x2, &(0x7f0000000280)=0x400000080a0000}) (async) ioctl$KVM_CREATE_VCPU(r3, 0x8004b706, 0x0) 46m36.569256986s ago: executing program 32 (id=62): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = eventfd2(0xffffffff, 0x80000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x4, 0x8000000, 0x1, r3, 0xb}) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000200)={0x0, &(0x7f0000000500)=[@mrs={0xbe, 0x18, {0x6030000000138056}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400000, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x3a) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000000)=@arm64={0x0, 0x1, 0xf, '\x00', 0xfffffffffffff105}) ioctl$KVM_SET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9e, 0x7fffffff, 0x2}}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x33) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x3, 0xa0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r13, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0x9, 0xfffffffffffffff9, 0x0}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) (async, rerun: 64) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 46m29.582898014s ago: executing program 33 (id=63): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x3, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="6e0000000000000030000000000000000000dddd0080"], 0x30}], 0x1, 0x0, 0x0, 0x0) (async) r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r12, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000080)={0x1ff, 0x401}}) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f0000000180)=@attr_arm64={0x0, 0x6, 0x3, &(0x7f0000000140)=0x7}) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x101300, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) (async) syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) r16 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r17 = ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r17, 0xc00caee0, &(0x7f0000000100)={0xa, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r18, 0x4018aee3, 0x0) (async) ioctl$KVM_HAS_DEVICE_ATTR(r18, 0x4018aee3, &(0x7f0000000040)=@attr_other={0x0, 0x1, 0x200, 0x0}) ioctl$KVM_CREATE_DEVICE(r15, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r19, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x2, &(0x7f0000000280)=0x400000080a0000}) (async) ioctl$KVM_CREATE_VCPU(r3, 0x8004b706, 0x0) 40m44.201777999s ago: executing program 3 (id=72): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r4, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) ioctl$KVM_ARM_VCPU_FINALIZE(r4, 0x4004aec2, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f0000000100)={0x5, 0x18}) munmap(&(0x7f0000013000/0x2000)=nil, 0x2000) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100050, &(0x7f0000000000)=0x12}) 40m36.113989597s ago: executing program 2 (id=73): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x82880, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x101282, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, &(0x7f0000000200)}, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x10840, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000c0b000/0x1000)=nil, r5, 0x3, 0x40b2811, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 40m30.291630034s ago: executing program 3 (id=74): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3a) eventfd2(0x1, 0x68b8929d0633d56b) syz_kvm_setup_cpu$arm64(r1, 0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil, &(0x7f0000000900)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) close(r1) 40m23.731329001s ago: executing program 2 (id=75): openat$kvm(0x0, 0x0, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000000), 0x4c100, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000000), 0x4c100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x26) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0x4b47, 0xfffffffffffffffe) (async) ioctl$KVM_CHECK_EXTENSION(r2, 0x4b47, 0xfffffffffffffffe) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xd1, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000380)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r5, 0x894c, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r5, 0x894c, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0x8004b707, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (async) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r9 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r8, 0x2, 0x12, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f00000002c0)="fb016bddfb405ee52cc6a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb2070000000000000000000000c20cecfa0a97ab7800", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r11, 0xae03, 0x51) mmap$KVM_VCPU(&(0x7f0000e2a000/0x1000)=nil, r8, 0x1, 0x8010, r7, 0x0) (async) r12 = mmap$KVM_VCPU(&(0x7f0000e2a000/0x1000)=nil, r8, 0x1, 0x8010, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) 40m20.426144047s ago: executing program 3 (id=76): mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0xdc032, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)=@arm64_sve={0x60800000001501cf, &(0x7f0000000080)=0xaca}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0xf3) ioctl$KVM_RESET_DIRTY_RINGS(r1, 0xaec7) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000001c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e700", 0x0, 0x48) openat$kvm(0xffffffffffffff9c, 0x0, 0x141000, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xd7, 0x80000001}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) mmap$KVM_VCPU(&(0x7f0000d0d000/0x1000)=nil, r8, 0x2000000, 0x14012, r6, 0x0) openat$kvm(0x0, 0x0, 0x72483, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r10, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r10, 0x4010aeac, 0x0) r11 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xdddd1000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r11, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000ffb000/0x3000)=nil}) 40m10.499760506s ago: executing program 2 (id=77): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000400)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_GET_ONE_REG(r4, 0x4010aeab, &(0x7f0000000480)=@arm64_fw={0x6030000000140000, &(0x7f0000000440)=0xdd}) (async) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r10, 0x4018aee1, &(0x7f0000000040)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) (async) r11 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000b80)={0x0, &(0x7f0000000640)=[@smc={0x1e, 0x40, {0xc4000012, [0x0, 0x4, 0x0, 0x4, 0x8001]}}], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r11, 0xae80, 0x0) 40m8.631548655s ago: executing program 3 (id=78): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x22) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000140)=@arm64={0x2, 0x3, 0x1, '\x00', 0x6}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013dce0, &(0x7f0000000000)=0x43ff}) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x200000000000a) ioctl$KVM_REGISTER_COALESCED_MMIO(r8, 0x4010ae67, &(0x7f0000000240)={0x1, 0xe000, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r8, 0x4010ae67, &(0x7f0000000080)={0x3000, 0x122000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r8, 0x4010ae68, &(0x7f0000001480)={0xfdfd, 0x13000, 0x1}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = syz_kvm_vgic_v3_setup(r10, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r11, 0x4018aee2, &(0x7f0000000080)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f00000000c0)}) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x18b080, 0x0) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x1000)=nil, 0x0, 0x1000002, 0x110, 0xffffffffffffffff, 0x0) close(0x4) 39m57.231587451s ago: executing program 2 (id=79): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0, 0x37}, 0x0, 0xffffffffffffffe2) 39m51.369167687s ago: executing program 3 (id=80): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000040)={0x4, 0xffda, 0x1}}) r4 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x5edc}}], 0x20}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r4, 0xae80, 0x0) 39m47.186190798s ago: executing program 2 (id=81): munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x4019032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013dce0, &(0x7f0000000000)=0x43ff}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000280)=0x400000080a0000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_GET_ONE_REG(r11, 0x4010aeab, &(0x7f0000000040)=@arm64_fw={0x6030000000140001, &(0x7f0000000000)=0xfffffffffffffff8}) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) 39m43.316620471s ago: executing program 3 (id=82): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x6030000000100024, &(0x7f0000000140)=0x7}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r8 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r7, 0x2, 0x11, r6, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x30) ioctl$KVM_HAS_DEVICE_ATTR_vm(r10, 0x4018aee3, 0xffffffffffffffff) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) 39m31.112079639s ago: executing program 2 (id=83): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async, rerun: 32) r2 = eventfd2(0x8, 0x80800) (rerun: 32) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x1, r2, 0x2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x4, 0xd000, 0x8, r2, 0xa}) (async) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x8000, 0xdddd1000, 0x2, r2, 0x3}) (async) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x8800, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xf1) (async, rerun: 32) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000140)="38ce8347fc1e86008cfc72bb312c8659dcc9225b48cb5cb00c73b0b30800000073f7f1f493e89c859e17625ad1b19c73a7fd4ce992bfc316bd22ccc646cd69c72800", 0x0, 0x1f) (async) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) (async) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x7}) ioctl$KVM_GET_DEVICE_ATTR_vm(r6, 0x4018aee2, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x8, 0x2}}) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) syz_kvm_assert_syzos_uexit$arm64(0x0, 0xffffffffffffffff) (async, rerun: 64) ioctl$KVM_IRQ_LINE(r6, 0x4008ae61, 0x0) (rerun: 64) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) write$eventfd(r10, &(0x7f00000001c0), 0xe80) 38m55.803150485s ago: executing program 34 (id=82): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x6030000000100024, &(0x7f0000000140)=0x7}) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r8 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r7, 0x2, 0x11, r6, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x30) ioctl$KVM_HAS_DEVICE_ATTR_vm(r10, 0x4018aee3, 0xffffffffffffffff) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) 38m42.926619562s ago: executing program 35 (id=83): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async, rerun: 32) r2 = eventfd2(0x8, 0x80800) (rerun: 32) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x1, r2, 0x2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x4, 0xd000, 0x8, r2, 0xa}) (async) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x8000, 0xdddd1000, 0x2, r2, 0x3}) (async) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x8800, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xf1) (async, rerun: 32) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000140)="38ce8347fc1e86008cfc72bb312c8659dcc9225b48cb5cb00c73b0b30800000073f7f1f493e89c859e17625ad1b19c73a7fd4ce992bfc316bd22ccc646cd69c72800", 0x0, 0x1f) (async) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) (async) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000100)={0x7}) ioctl$KVM_GET_DEVICE_ATTR_vm(r6, 0x4018aee2, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x2, 0x8, 0x2}}) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) syz_kvm_assert_syzos_uexit$arm64(0x0, 0xffffffffffffffff) (async, rerun: 64) ioctl$KVM_IRQ_LINE(r6, 0x4008ae61, 0x0) (rerun: 64) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) write$eventfd(r10, &(0x7f00000001c0), 0xe80) 28m28.926923501s ago: executing program 4 (id=111): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000100)={0x5}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x29) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r7 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r6, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r6, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000000)=@arm64={0xad, 0x40, 0xcd, '\x00', 0x100}) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r11, 0xc018ae85, &(0x7f00000003c0)=@arm64_bitmap={0x6030000000160001, 0x0}) r12 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x2c) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r14, 0x4010aeac, &(0x7f0000000040)=@arm64_core={0x6030000000100018, &(0x7f0000000000)=0x7fffffffffffffff}) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000280)=@arm64_core={0x603000000010002c, &(0x7f0000000140)=0x8}) 28m13.345327436s ago: executing program 5 (id=113): munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) (async, rerun: 64) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) (rerun: 64) munmap(&(0x7f0000f7c000/0x2000)=nil, 0x2000) (async) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) (async, rerun: 32) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (async, rerun: 64) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) (rerun: 64) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r1, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x29) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) (async) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) r6 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r5, 0x2, 0x12, r4, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) (async, rerun: 64) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (rerun: 64) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000) (async) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) (async) mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0) 28m1.854434944s ago: executing program 4 (id=114): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_FINALIZE(r3, 0x4004aec2, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, 0x0) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r8, 0x4010aeab, &(0x7f0000000040)=@arm64_sys={0x603000000013c006, &(0x7f0000000000)=0x3}) syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000b80)={0x0, &(0x7f0000000100)=[@smc={0x1e, 0x40, {0x84000003, [0x99a, 0x7, 0xaca, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r14, 0xae80, 0x0) r15 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r15}) ioctl$KVM_REGISTER_COALESCED_MMIO(r10, 0x4010ae67, &(0x7f0000000000)={0x100000, 0x37d03030d7a92616}) ioctl$KVM_REGISTER_COALESCED_MMIO(r10, 0x4010ae67, &(0x7f0000000180)={0x5000}) r16 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r16, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_DEVICE_ATTR_vm(r10, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x100, 0x2}}) 28m0.035310871s ago: executing program 5 (id=115): openat$kvm(0x0, 0x0, 0x0, 0x0) r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0x4b47, 0xfffffffffffffffe) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r4, 0x2, 0x12, r3, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000002c0)="fb016bddfb405ee52cc6a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb2070000000000000000000000c20cecfa0a97ab7800", 0x0, 0x48) r6 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r9, 0x4020aeae, &(0x7f0000000100)={0x5, 0x18}) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f00000000c0)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000000080)=0x2}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, r4, 0x1, 0x2010, r9, 0x0) 27m39.659835708s ago: executing program 5 (id=116): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) (async) r4 = eventfd2(0x8, 0x80800) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) r8 = syz_kvm_vgic_v3_setup(r6, 0x1, 0x100) (async) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x5, 0x8, &(0x7f0000000280)=0x5}) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f00000000c0)={r4, 0x3}) (async, rerun: 32) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000000)={r4, 0x9, 0x3, r4}) (rerun: 32) r9 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x3, 0xa0) (async, rerun: 64) r11 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (rerun: 64) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x1}}], 0x28}, 0x0, 0x0) (async) syz_kvm_vgic_v3_setup(r12, 0x4, 0x220) (async) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) ioctl$KVM_RUN(r14, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r16, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async) mmap$KVM_VCPU(&(0x7f0000ddf000/0x1000)=nil, 0x0, 0x2, 0x110, r14, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 27m38.58623499s ago: executing program 4 (id=117): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (async) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r1, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r1, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e9d000/0x1000)=nil, 0x1000) (async) munmap(&(0x7f0000e9d000/0x1000)=nil, 0x1000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) (async) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, &(0x7f0000000240)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x100, 0x6243, 0x5}}], 0x30}, 0x0, 0x0) (async) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, &(0x7f0000000240)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x100, 0x6243, 0x5}}], 0x30}, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x2000001, 0x2010, r5, 0x0) 27m24.59893346s ago: executing program 4 (id=118): ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 27m20.587347835s ago: executing program 5 (id=119): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f00000001c0), 0x100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0x80111500, 0x20000000) close(r4) close(0x3) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xcd) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r6 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) syz_kvm_add_vcpu$arm64(0x0, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) (async) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_GET_DEVICE_ATTR(r10, 0x4018aee2, 0xffffffffffffffff) 27m13.669503421s ago: executing program 4 (id=120): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000180)={0x0, &(0x7f0000000380)=[@eret={0xe6, 0x18, 0xba3}, @irq_setup={0x46, 0x18, {0x0, 0x1f6}}], 0x30}, &(0x7f0000000300)=[@featur1={0x1, 0x86}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) (async) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async, rerun: 32) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 32) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r5, 0x4068aea3, &(0x7f0000000040)={0xe4, 0x0, 0x1000}) (async, rerun: 64) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 64) r6 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async, rerun: 32) r9 = eventfd2(0xfffffffa, 0x80001) (rerun: 32) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r9, 0xc}) (async) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 32) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x6000, 0x37d03030d7a96616}) (rerun: 32) ioctl$KVM_REGISTER_COALESCED_MMIO(r8, 0x4010ae67, &(0x7f0000000180)={0x5000}) (async) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x27) ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) (async) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r14, r15, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0a00000000000a00208099c72221382d5ff7cac87a4b9b000000000000000000"], 0x20}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r15, 0xae80, 0x0) (async) ioctl$KVM_RUN(r15, 0xae80, 0x0) (async) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x8, 0x0, 0x0}) (async, rerun: 32) r16 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) (rerun: 32) ioctl$KVM_RUN(r16, 0xae80, 0x0) 27m2.13949581s ago: executing program 5 (id=121): r0 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000280)={0x0, &(0x7f0000000000)=[@uexit={0x0, 0x18, 0x3}, @irq_setup={0x46, 0x18, {0x0, 0x3db}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x4, 0xe, 0x6, 0x5, 0x2}}, @uexit={0x0, 0x18, 0x6}, @mrs={0xbe, 0x18, {0x603000000013c032}}, @its_setup={0x82, 0x28, {0x4, 0x1, 0xbd}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x21e}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xfff4, 0x67d, 0x3}}, @hvc={0x32, 0x40, {0xc4000014, [0xe490, 0x8, 0x5, 0x1, 0x4]}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x1d8}}, @code={0xa, 0x84, {"0048c01a00b4202e007008d5007008d5402290d200a0b8f2810180d2620080d2830180d2440180d2020000d400de9ed200e0b0f2010180d2e20080d2a30080d2240080d2020000d4e0679dd20000b0f2810080d2820180d2830080d2640180d2020000d4007008d50004801a007008d5"}}, @irq_setup={0x46, 0x18, {0x1, 0x1c2}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x3, 0xb, 0x9, 0x4, 0x3}}, @memwrite={0x6e, 0x30, @generic={0x2000, 0x529, 0xfffffffffffffffd, 0x2}}, @eret={0xe6, 0x18, 0x8}], 0x27c}, &(0x7f00000002c0)=[@featur2={0x1, 0x6}], 0x1) ioctl$KVM_SET_REGS(r0, 0x4360ae82, &(0x7f0000000300)={[0x1, 0x8, 0x9, 0x1, 0x3ff, 0x9, 0x7, 0xc3, 0x3, 0x3, 0x9d, 0x7, 0x355, 0x1, 0x7, 0x9], 0x2, 0x3100}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x9) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000003c0)={0x1, 0x2, 0x4, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_SET_REGS(r0, 0x4360ae82, &(0x7f0000000400)={[0x8, 0x7f, 0x5bbc, 0x1, 0x8000000000000001, 0x8, 0x2, 0x92bf, 0x8, 0xffffffffffffffa6, 0xfffffffffffffffb, 0x3, 0x800, 0x3, 0x4, 0xf608], 0x8000000, 0x200}) ioctl$KVM_SET_SIGNAL_MASK(r0, 0x4004ae8b, &(0x7f00000004c0)={0x96, "41f34e1b80898550f5f13c81ef2f991eb2efdff22af32a5755f2a8115972fcc948897e412e44c1eeb962524417ee51acf54f121b1c23147b95a27a520fca330e5d3ee5357114daf318dfd732440e8ef04cfbfe4747ba85d5a1bd230e16761d182018f715eda5752c34ec94f846ce88a1f7c8a71beb4ce17a6eb56ae8abfa2aa089efbedb96530b664128cf2412fc98f15c143f1eb6b0"}) ioctl$KVM_ARM_PREFERRED_TARGET(r0, 0x8020aeaf, &(0x7f0000000580)) ioctl$KVM_SET_VCPU_EVENTS(r0, 0x4040aea0, &(0x7f00000005c0)=@x86={0x4, 0x87, 0x6, 0x0, 0x3ff, 0x7, 0x2, 0x5, 0x7a, 0x0, 0x81, 0x1, 0x0, 0xfff, 0xb, 0x7, 0x4, 0x7, 0x8, '\x00', 0xd, 0x1}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000600), 0x648000, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x8) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000640), 0x101100, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_SREGS(r0, 0x4000ae84, &(0x7f0000000680)={{0xdddd1000, 0xeeee8000, 0xf, 0xc8, 0xcb, 0x8, 0x7, 0x3, 0x1, 0x0, 0xf, 0x52}, {0xeeee0000, 0x100000, 0x4, 0x1, 0x8, 0x80, 0x9, 0x3, 0x2, 0x0, 0x7, 0x9}, {0xeeee8000, 0x4, 0xb, 0xff, 0x3, 0x9, 0xff, 0xc, 0x9, 0xf9, 0xe, 0x7}, {0xd000, 0x8000000, 0x9, 0x4, 0x3, 0x4, 0x2, 0x8, 0x2, 0x1, 0x0, 0x7}, {0x8000000, 0x1, 0xb, 0x5, 0x69, 0x0, 0x6, 0x2, 0x3, 0x40, 0xfb, 0xf9}, {0xdddd0000, 0x4, 0xf, 0x5, 0x8, 0x4, 0x0, 0xf0, 0xd, 0x6, 0x3, 0xfe}, {0x100000, 0x80a0000, 0xa, 0x3, 0x4, 0x40, 0x3, 0x2, 0x4, 0x2, 0xff}, {0xd000, 0x80a0000, 0x3, 0x4, 0x4, 0x4, 0x4, 0x2, 0x6, 0xe, 0x1, 0x6}, {0xeeee8000, 0x8}, {0x10000, 0xd}, 0x40000000, 0x0, 0x1, 0x20080, 0x3, 0x5000, 0x4000, [0x4, 0x7ff, 0x401, 0x5]}) ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f00000007c0)=@arm64) ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f0000000840)=@attr_other={0x0, 0xffff4c84, 0x1, &(0x7f0000000800)=0x4}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000880)={0x3, 0xffffffffffffffff, 0x1}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000008c0), 0x540, 0x0) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f0000000900)={0x8, [0x576, 0x1, 0x2, 0x401, 0xffffffffffffffff, 0x3, 0x7, 0x1]}) ioctl$KVM_SET_REGS(r0, 0x4360ae82, &(0x7f0000000980)={[0x7, 0x4, 0xd5b9, 0x0, 0x8000, 0xd, 0x9, 0x42e, 0x8000, 0x1, 0x5, 0x7fffffffffffffff, 0x1e341902, 0x6, 0xfffffffffffffffa, 0x1]}) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f0000000a40)={0x4, [0x1, 0x9, 0x7fff, 0xfffffffffffffff8]}) r6 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000a80)={0xfffffffffffffff7, 0x2cf}) ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000ac0)={0x10001, 0x0, 0x100000, 0x1000, &(0x7f0000fff000/0x1000)=nil, 0xfffffffffffffff8, r6}) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, r7, 0x300000e, 0x10, r8, 0x0) ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) openat$kvm(0xffffffffffffff9c, &(0x7f0000000b80), 0x80180, 0x0) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2d) ioctl$KVM_IOEVENTFD(r9, 0x4040ae79, &(0x7f0000000bc0)={0x3, 0x2000, 0x2, 0xffffffffffffffff, 0x5}) 26m58.295497486s ago: executing program 4 (id=122): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r4, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000000000000090000000200000001000000000000007f00000000000000050000000000000006000000000000000700000007000000517f76e02c7136cd2891193c4aa63548d78d83ca31ffcd3d77d2dc1ccb0b83d4ab1703000000000200005a1e603f5d2090bdcbfa555cd06ffae3c1a9c392b3e43b285947d084dd49aebc3818e24c443c6692270655b8349b762ead010dbf10372ccb827948d42b6fe47fcfede5f965b2d2c669174e92db55eeffb4e8b212d8783173409676a6a912467b7aab02d4ad3f8b883ffa3d3d582f1fe97ce44377b1ef7745c67da66c8d8ed346752c9a6df4cd3883a6e9c4cbfad5a095fc0509283201a8636a3a3a272952035f8f2a07a369ffeac10d77de7dd42843199b7b5bdbc7e6c3e2fb8f93b0d6df882a86389cd4a761f2a2a0640bfbf0"]) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = eventfd2(0xeffffffb, 0x80800) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000000)={0x200, 0x4000, 0x4, r11, 0x1}) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x2, r11, 0x3}) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x2, r11, 0xb}) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x31) r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r15, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x603000000010002a, &(0x7f00000000c0)=0xc}) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r8, 0x4068aea3, &(0x7f00000001c0)={0xdf, 0x0, 0xd000}) 26m43.720023299s ago: executing program 5 (id=123): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000000c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x7, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000180)=@attr_arm64={0x0, 0x4, 0x2, &(0x7f0000000080)=0xd450}) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000100)={0x3, 0x21a}) 26m11.201986745s ago: executing program 36 (id=122): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) close(r2) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r4, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000000000000090000000200000001000000000000007f00000000000000050000000000000006000000000000000700000007000000517f76e02c7136cd2891193c4aa63548d78d83ca31ffcd3d77d2dc1ccb0b83d4ab1703000000000200005a1e603f5d2090bdcbfa555cd06ffae3c1a9c392b3e43b285947d084dd49aebc3818e24c443c6692270655b8349b762ead010dbf10372ccb827948d42b6fe47fcfede5f965b2d2c669174e92db55eeffb4e8b212d8783173409676a6a912467b7aab02d4ad3f8b883ffa3d3d582f1fe97ce44377b1ef7745c67da66c8d8ed346752c9a6df4cd3883a6e9c4cbfad5a095fc0509283201a8636a3a3a272952035f8f2a07a369ffeac10d77de7dd42843199b7b5bdbc7e6c3e2fb8f93b0d6df882a86389cd4a761f2a2a0640bfbf0"]) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = eventfd2(0xeffffffb, 0x80800) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000000)={0x200, 0x4000, 0x4, r11, 0x1}) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x2, r11, 0x3}) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x2, r11, 0xb}) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x31) r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r15, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x603000000010002a, &(0x7f00000000c0)=0xc}) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r8, 0x4068aea3, &(0x7f00000001c0)={0xdf, 0x0, 0xd000}) 25m53.371872163s ago: executing program 37 (id=123): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000000c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x7, 0x0, 0x1000, &(0x7f0000fff000/0x1000)=nil}) ioctl$KVM_HAS_DEVICE_ATTR(r2, 0x4018aee3, &(0x7f0000000180)=@attr_arm64={0x0, 0x4, 0x2, &(0x7f0000000080)=0xd450}) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000100)={0x3, 0x21a}) 15m50.120926482s ago: executing program 6 (id=141): syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (async) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r3, r4, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$arm64(r3, r4, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000140000, &(0x7f0000000000)=0x2}) mmap$KVM_VCPU(&(0x7f0000c58000/0x1000)=nil, r1, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) r7 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r6, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000040)=[{0x0, &(0x7f00000001c0)=[@uexit={0x0, 0x18}], 0x18}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000040)=[{0x0, &(0x7f00000001c0)=[@uexit={0x0, 0x18}], 0x18}], 0x1, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 15m33.649915925s ago: executing program 6 (id=143): mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x2132, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000180)=[@code={0xa, 0x9c, {"00dc83d200a0b8f2410180d2820180d2230180d2c40080d2020000d4800793d200c0b0f2210080d2e20180d2830180d2440180d2020000d4007008d50000029e009c005f0000589ea0d78ad200a0b0f2010080d2a20180d2c30080d2a40180d2020000d4007008d500d282d20020b8f2010180d2420080d2c30080d2440180d2020000d40080204e"}}, @irq_setup={0x46, 0x18, {0x3, 0x26e}}, @code={0xa, 0x54, {"007008d5007008d5000008d5007008d5007008d5008080c8002b86d20040b0f2810080d2220180d2430080d2640180d2020000d4008008d5007008d50040611e"}}, @hvc={0x32, 0x40, {0x0, [0x6, 0x3, 0x9, 0x9, 0x5]}}, @eret={0xe6, 0x18, 0x4}, @its_send_cmd={0xaa, 0x28, {0xe, 0x1, 0x3, 0x2, 0x9, 0x4, 0x1}}, @msr={0x14, 0x20, {0x603000000013c807, 0xffff}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xffe8, 0x5, 0x8}}, @uexit={0x0, 0x18, 0x6}, @code={0xa, 0x84, {"00a396d20080b0f2a10080d2020180d2630180d2a40180d2020000d400804088008008d50000000c008008d50000201e80e887d20000b0f2610080d2420080d2e30180d2c40080d2020000d4007008d5e05190d20020b0f2e10080d2c20080d2030180d2240080d2020000d4000008d5"}}, @svc={0x122, 0x40, {0x84000010, [0x7, 0x81, 0xf2, 0x27, 0xf3]}}, @smc={0x1e, 0x40, {0xffff, [0x3, 0xb77b, 0x6, 0xffffffffffffffff, 0x4]}}, @code={0xa, 0x6c, {"0020c09a000008d5204290d20000b8f2610080d2420080d2430080d2c40180d2020000d40050000e20cd91d200a0b8f2e10180d2c20080d2830080d2640180d2020000d4007c00135f2003d5007008d5007008d50000208a"}}, @mrs={0xbe, 0x18, {0x603000000013f528}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x2, 0x5, 0x74, 0x7, 0x1}}, @irq_setup={0x46, 0x18, {0x2, 0x61}}, @svc={0x122, 0x40, {0x4000005f, [0x6741575a, 0x1000, 0x0, 0x7fffffffffffffff, 0x1709]}}, @msr={0x14, 0x20, {0x603000000013d920, 0x3}}], 0x418}, &(0x7f00000005c0)=[@featur1={0x1, 0x4c}], 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x27) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0xfffffffe, 0x0, 0x6, 0x0, 0x20000004}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r5, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, r2, 0x5, 0x20010, r3, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r10, 0x4020aeae, 0x0) r11 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r13, 0x4010aeab, &(0x7f0000000040)=@arm64_sys={0x603000000013c006, &(0x7f0000000000)=0x3}) syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) r14 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_SET_MP_STATE(r14, 0x4004ae99, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) 15m25.861527872s ago: executing program 7 (id=144): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r4 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, r3, 0xc87aa115a6669ceb, 0x20010, r2, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) write$eventfd(r5, &(0x7f0000000200)=0x8, 0x8) syz_memcpy_off$KVM_EXIT_MMIO(r4, 0x20, &(0x7f0000000040)="eed74e7cb2572f4879e2130f8a4140dc1cf076fd0ea06ae8", 0x0, 0x18) r6 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x68e800, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae03, 0xbb) syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000bff000/0x400000)=nil) r13 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) syz_kvm_setup_cpu$arm64(r13, 0xffffffffffffffff, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000140)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r13, 0x4068aea3, &(0x7f0000000000)={0xe4, 0x0, 0x7}) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) r16 = ioctl$KVM_CREATE_VCPU(r15, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r15, r16, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r16, 0x4010aeac, &(0x7f0000000080)=@arm64_core={0x6030000000100016, &(0x7f0000000100)=0xc5c5}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r9, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000080)={0x4, 0x80a, 0x1}}) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4000ae8d, &(0x7f00000000c0)={0x5, 0x40}) 15m9.033214612s ago: executing program 6 (id=145): r0 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r2, r3, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f00000000c0)=@arm64_core={0x6030000000100038, &(0x7f0000000000)=0x78}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0xc3) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) 15m0.416977663s ago: executing program 7 (id=146): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) close(r1) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x4000)=nil, r9, 0x2000003, 0x11, r7, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x2000)=nil, r9, 0x2000009, 0x11, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f00006b6000/0x4000)=nil, r4, 0x6, 0x8032, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffa000/0x4000)=nil, r4, 0x8, 0x20010, 0xffffffffffffffff, 0x0) close(r2) 14m42.691397453s ago: executing program 7 (id=147): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r3, 0xae03, 0x52) r4 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, 0x0}) (async) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) (async) r8 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_GUEST_DEBUG_arm64(r8, 0x4208ae9b, &(0x7f0000000240)={0x20003, 0x0, {[0x97ab, 0x10001, 0x3, 0xc08d, 0x8, 0xffffffff00000001, 0x3b880, 0x400, 0x5, 0x2, 0x6, 0x5, 0x2, 0x8, 0x6, 0x7fff], [0x45e1, 0x8000, 0x5d2, 0xfff, 0xbb9, 0x0, 0x8, 0xe, 0x51bb, 0x8, 0x4d681830, 0x9, 0x3, 0x10000, 0x7, 0xfffffffffffffff6], [0x80000001, 0xfffffffffffffffe, 0xa3, 0x0, 0x8, 0x81, 0x6, 0xfda8, 0x401, 0x5fd6, 0x3, 0x0, 0x40, 0x4, 0xffffffff, 0x9], [0x3, 0x6, 0xe99, 0xe, 0x9, 0x7, 0x8, 0x0, 0xb, 0x2, 0x10, 0x4, 0x9, 0x9, 0xc, 0x6]}}) (async) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0x2, 0xc) 14m40.915240558s ago: executing program 6 (id=148): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000ae2000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000000100)=@arm64_ccsidr={0x6020000080110003, 0x0}) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000003c0)=@arm64={0xd2, 0x3, 0x1}) syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000440)=[@featur1={0x1, 0x2a}], 0x1) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x100000c, 0x16831, 0xffffffffffffffff, 0x0) 14m25.729788024s ago: executing program 7 (id=149): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) close(r1) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r2, 0x3, 0x390) (async) close(r2) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) 14m22.532895337s ago: executing program 6 (id=150): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x600900, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000bde000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r6, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r7 = openat$kvm(0x0, 0x0, 0x2002, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) syz_kvm_vgic_v3_setup(r5, 0x0, 0x80) syz_kvm_setup_cpu$arm64(r1, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffefd) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x28) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) ioctl$KVM_RUN(r13, 0xae80, 0x0) r14 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=[@featur1={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r14, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r15 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@msr={0x14, 0x20, {0x603000000013e6d3, 0x2000f}}], 0x20}, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) 14m10.172822651s ago: executing program 7 (id=151): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000240)={0x0, &(0x7f00000000c0)=[@mrs={0xbe, 0x18, {0x603000000013c00a}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000100)={0x5, 0x18}) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000140)=@arm64_sys={0x603000000013df64, &(0x7f0000000000)=0x1}) 13m58.225332951s ago: executing program 6 (id=152): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x12) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = eventfd2(0x40000000, 0x80000) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000001340)={0x0, 0x0, 0x2, r7, 0x3}) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000080)={0x5, 0x0, 0x2, r7, 0xa}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000000)={r7, 0x6, 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 13m50.862043973s ago: executing program 7 (id=153): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x28) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur1={0x1, 0x75}], 0x1) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=[@featur1={0x1, 0x2}], 0x1) r6 = eventfd2(0x101, 0x800) write$eventfd(r6, &(0x7f0000000080)=0xfffffffffffffff7, 0x8) ioctl$KVM_RUN(r5, 0xae80, 0x0) 13m9.98182065s ago: executing program 38 (id=152): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x12) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = eventfd2(0x40000000, 0x80000) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000001340)={0x0, 0x0, 0x2, r7, 0x3}) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000080)={0x5, 0x0, 0x2, r7, 0xa}) ioctl$KVM_IRQFD(r4, 0x4020ae76, &(0x7f0000000000)={r7, 0x6, 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 13m0.463182761s ago: executing program 39 (id=153): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x28) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur1={0x1, 0x75}], 0x1) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=[@featur1={0x1, 0x2}], 0x1) r6 = eventfd2(0x101, 0x800) write$eventfd(r6, &(0x7f0000000080)=0xfffffffffffffff7, 0x8) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2m54.614196926s ago: executing program 8 (id=160): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000280)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x603000000010004c, &(0x7f0000000100)=0x401}) r4 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000300)={0x0, &(0x7f0000000480)}, &(0x7f00000001c0)=[@featur1={0x1, 0xc}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) munmap(&(0x7f0000584000/0x800000)=nil, 0x800000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2m52.092574075s ago: executing program 9 (id=161): mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) (async) r0 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r2, r3, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f00000001c0)=@arm64_sys={0x603000000013c01c, 0x0}) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x27) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@smc={0x1e, 0x40, {0x86000001, [0x1, 0x401, 0x5, 0x1, 0x2]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 2m34.213069904s ago: executing program 9 (id=162): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) munmap(&(0x7f00006a4000/0x1000)=nil, 0x1000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r2, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e9d000/0x1000)=nil, 0x1000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r6 = ioctl$KVM_CREATE_VM(r5, 0x894c, 0x0) eventfd2(0x50, 0x80000) ioctl$KVM_CREATE_VCPU(r6, 0x8004b708, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r8, r9, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_ARM_VCPU_FINALIZE(r9, 0x4004aec2, &(0x7f0000000000)=0x4) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r4, 0x4010ae74, &(0x7f00000000c0)={0xe, 0xb1, 0x2}) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) mmap$KVM_VCPU(&(0x7f0000c58000/0x1000)=nil, r0, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x0, 0x23ac5f9b426e84b2, 0xffffffffffffffff, 0x0) 2m31.08121367s ago: executing program 8 (id=163): r0 = eventfd2(0x0, 0x0) r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r4}) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r6, r7, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_ARM_VCPU_FINALIZE(r7, 0x4004aec2, &(0x7f0000000000)=0x4) r8 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x1000004, 0x11, r0, 0x0) eventfd2(0x0, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) write$eventfd(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) eventfd2(0xfffffffa, 0x80001) (async) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r4}) (async) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) (async) syz_kvm_setup_cpu$arm64(r6, r7, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_ARM_VCPU_FINALIZE(r7, 0x4004aec2, &(0x7f0000000000)=0x4) (async) syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x1000004, 0x11, r0, 0x0) (async) 2m9.009303251s ago: executing program 8 (id=164): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r0, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000100)=ANY=[], 0x30}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) ioctl$KVM_RUN(r0, 0xae80, 0x0) (async, rerun: 32) close(0xffffffffffffffff) (async) close(r0) 2m6.441935807s ago: executing program 9 (id=165): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610f3ff67521cd66f8f1f447d35b20700000000000000000000000100", 0x0, 0x48) munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) r4 = mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r4, 0x20, &(0x7f0000000080)="97b993d9fd5b71320d3d72aa29981b15aa7be4a5b5f068ea", 0x0, 0x18) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xb00f2, 0x0) r5 = openat$kvm(0x0, &(0x7f00000001c0), 0x2083, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000073000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r10 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013c2a4}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) 1m52.105767646s ago: executing program 8 (id=166): r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@msr={0x14, 0x20, {0x603000000013df62, 0xc00000}}], 0x20}, &(0x7f0000000280)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2c) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2d) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000a74000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000040)=@arm64_core={0x6030000000100018, &(0x7f0000000000)=0x7fffffffffffffff}) 1m39.838383177s ago: executing program 9 (id=167): r0 = openat$kvm(0x0, &(0x7f0000000000), 0xc000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0xffffffffffffffff) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x1, 0xfffffffffffffffc, &(0x7f0000000080)=0x1ff}) ioctl$KVM_SIGNAL_MSI(r1, 0x4020aea5, 0xfffffffffffffffe) 1m22.415152948s ago: executing program 9 (id=168): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xb8000, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x2f) r3 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) syz_memcpy_off$KVM_EXIT_MMIO(r3, 0x20, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) r6 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r5, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r8, 0xae03, 0x24) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x82880, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) openat$kvm(0x0, &(0x7f0000000140), 0x101282, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r12 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r11, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fb707cd24b7eebb20700000000000000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r11, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) 1m19.363510511s ago: executing program 8 (id=169): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x100000c, 0x6832, 0xffffffffffffffff, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000eed000/0x4000)=nil, 0x4000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000000)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r1, 0x4010aeb5, &(0x7f0000000080)={0xa3, 0x3}) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013c807, &(0x7f0000000280)=0x1}) 56.806613566s ago: executing program 9 (id=170): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x42400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000000)={0x0, 0x0}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x20}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) 54.649638647s ago: executing program 8 (id=171): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x3, 0x800) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) r6 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f00000000c0)=@arm64_core={0x6030000000100026, &(0x7f0000000000)=0xffffffffffffff36}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x5, 0x6c, &(0x7f00000002c0)=0x2c172c22}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x1ff, 0x1000, 0x2, r2, 0x1}) r7 = eventfd2(0x8001, 0x800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000001340)={0x0, 0x0, 0x2, r7, 0x3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x203, 0x0, 0x2, r7, 0xf}) 8.048082244s ago: executing program 40 (id=170): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x42400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000000)={0x0, 0x0}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x20}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000001c0)=0x3) 0s ago: executing program 41 (id=171): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x3, 0x800) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) r6 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_GET_ONE_REG(r0, 0x4010aeab, &(0x7f00000000c0)=@arm64_core={0x6030000000100026, &(0x7f0000000000)=0xffffffffffffff36}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x5, 0x6c, &(0x7f00000002c0)=0x2c172c22}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x1ff, 0x1000, 0x2, r2, 0x1}) r7 = eventfd2(0x8001, 0x800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000001340)={0x0, 0x0, 0x2, r7, 0x3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x203, 0x0, 0x2, r7, 0xf}) kernel console output (not intermixed with test programs): [ 378.898461][ T3155] 8021q: adding VLAN 0 to HW filter on device bond0 [ 431.488799][ T3155] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:65006' (ED25519) to the list of known hosts. [ 591.233397][ T25] audit: type=1400 audit(590.440:61): avc: denied { name_bind } for pid=3311 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 592.188662][ T25] audit: type=1400 audit(591.400:62): avc: denied { execute } for pid=3312 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 592.213380][ T25] audit: type=1400 audit(591.420:63): avc: denied { execute_no_trans } for pid=3312 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 614.794821][ T25] audit: type=1400 audit(614.000:64): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 614.828366][ T25] audit: type=1400 audit(614.030:65): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 614.909539][ T3312] cgroup: Unknown subsys name 'net' [ 614.958899][ T25] audit: type=1400 audit(614.160:66): avc: denied { unmount } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 615.443303][ T3312] cgroup: Unknown subsys name 'cpuset' [ 615.624862][ T3312] cgroup: Unknown subsys name 'rlimit' [ 616.708569][ T25] audit: type=1400 audit(615.910:67): avc: denied { setattr } for pid=3312 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 616.732585][ T25] audit: type=1400 audit(615.940:68): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 616.751465][ T25] audit: type=1400 audit(615.950:69): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 617.921145][ T3315] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 617.943899][ T25] audit: type=1400 audit(617.150:70): avc: denied { relabelto } for pid=3315 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 617.963551][ T25] audit: type=1400 audit(617.170:71): avc: denied { write } for pid=3315 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 618.140131][ T25] audit: type=1400 audit(617.350:72): avc: denied { read } for pid=3312 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 618.159226][ T25] audit: type=1400 audit(617.360:73): avc: denied { open } for pid=3312 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 618.202649][ T3312] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 668.067836][ T25] audit: type=1400 audit(667.230:74): avc: denied { execmem } for pid=3316 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 672.664012][ T25] audit: type=1400 audit(671.870:75): avc: denied { read } for pid=3318 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 672.684420][ T25] audit: type=1400 audit(671.890:76): avc: denied { open } for pid=3318 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 672.769809][ T25] audit: type=1400 audit(671.970:77): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 673.032837][ T25] audit: type=1400 audit(672.240:78): avc: denied { module_request } for pid=3318 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 674.173591][ T25] audit: type=1400 audit(673.380:79): avc: denied { sys_module } for pid=3319 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 699.376855][ T3319] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 699.819353][ T3319] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 699.905004][ T3318] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 700.465069][ T3318] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 715.567364][ T3319] hsr_slave_0: entered promiscuous mode [ 715.599008][ T3319] hsr_slave_1: entered promiscuous mode [ 716.030732][ T3318] hsr_slave_0: entered promiscuous mode [ 716.052785][ T3318] hsr_slave_1: entered promiscuous mode [ 716.068455][ T3318] debugfs: 'hsr0' already exists in 'hsr' [ 716.077133][ T3318] Cannot create hsr debugfs directory [ 721.758064][ T25] audit: type=1400 audit(720.960:80): avc: denied { create } for pid=3319 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 721.784992][ T25] audit: type=1400 audit(720.990:81): avc: denied { write } for pid=3319 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 721.834684][ T25] audit: type=1400 audit(721.030:82): avc: denied { read } for pid=3319 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 721.982539][ T3319] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 722.433273][ T3319] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 722.673909][ T3319] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 723.011697][ T3319] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 724.540204][ T3318] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 724.674540][ T3318] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 724.870400][ T3318] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 725.021138][ T3318] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 737.243586][ T3319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 739.698190][ T3318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 795.200300][ T3319] veth0_vlan: entered promiscuous mode [ 795.679669][ T3319] veth1_vlan: entered promiscuous mode [ 797.784370][ T3319] veth0_macvtap: entered promiscuous mode [ 797.850057][ T3318] veth0_vlan: entered promiscuous mode [ 798.284862][ T3319] veth1_macvtap: entered promiscuous mode [ 798.611229][ T3318] veth1_vlan: entered promiscuous mode [ 800.338793][ T3328] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.366888][ T3328] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.370599][ T3328] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 800.422290][ T49] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 801.334010][ T3318] veth0_macvtap: entered promiscuous mode [ 801.890065][ T3318] veth1_macvtap: entered promiscuous mode [ 803.020615][ T25] audit: type=1400 audit(802.220:83): avc: denied { mount } for pid=3319 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 803.248522][ T25] audit: type=1400 audit(802.450:84): avc: denied { mounton } for pid=3319 comm="syz-executor" path="/syzkaller.S0xhEz/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 803.398943][ T25] audit: type=1400 audit(802.600:85): avc: denied { mount } for pid=3319 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 803.731306][ T25] audit: type=1400 audit(802.940:86): avc: denied { mounton } for pid=3319 comm="syz-executor" path="/syzkaller.S0xhEz/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 803.902539][ T25] audit: type=1400 audit(803.110:87): avc: denied { mounton } for pid=3319 comm="syz-executor" path="/syzkaller.S0xhEz/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3760 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 804.292469][ T21] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.299669][ T21] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.311588][ T21] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.359702][ T21] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 804.657934][ T25] audit: type=1400 audit(803.850:88): avc: denied { unmount } for pid=3319 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 804.824472][ T25] audit: type=1400 audit(804.020:89): avc: denied { mounton } for pid=3319 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 804.943748][ T25] audit: type=1400 audit(804.130:90): avc: denied { mount } for pid=3319 comm="syz-executor" name="/" dev="gadgetfs" ino=3769 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 805.199564][ T25] audit: type=1400 audit(804.400:91): avc: denied { mount } for pid=3319 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 805.254656][ T25] audit: type=1400 audit(804.460:92): avc: denied { mounton } for pid=3319 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 806.839980][ T3319] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 816.458334][ T25] kauditd_printk_skb: 4 callbacks suppressed [ 816.467845][ T25] audit: type=1400 audit(815.630:97): avc: denied { read } for pid=3471 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 816.481328][ T25] audit: type=1400 audit(815.690:98): avc: denied { open } for pid=3471 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 816.587486][ T25] audit: type=1400 audit(815.790:99): avc: denied { ioctl } for pid=3471 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 819.116915][ T25] audit: type=1400 audit(818.310:100): avc: denied { append } for pid=3473 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 841.617476][ T25] audit: type=1400 audit(840.810:101): avc: denied { execute } for pid=3487 comm="syz.0.5" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4080 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 878.266859][ T25] audit: type=1400 audit(877.470:102): avc: denied { write } for pid=3504 comm="syz.0.11" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1030.357578][ T25] audit: type=1400 audit(1029.560:103): avc: denied { ioctl } for pid=3597 comm="syz.1.38" path="net:[4026532625]" dev="nsfs" ino=4026532625 ioctlcmd=0x5829 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1151.149989][ T3690] kvm [3690]: Failed to find VMA for hva 0x21016000 [ 1208.081751][ T3366] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1209.754046][ T3366] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1210.671392][ T3366] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1211.629177][ T3366] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1224.440176][ T3366] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1224.523888][ T3366] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1224.603990][ T3366] bond0 (unregistering): Released all slaves [ 1226.139484][ T3366] hsr_slave_0: left promiscuous mode [ 1226.178052][ T3366] hsr_slave_1: left promiscuous mode [ 1226.625854][ T3366] veth1_macvtap: left promiscuous mode [ 1226.670542][ T3366] veth0_macvtap: left promiscuous mode [ 1226.689339][ T3366] veth1_vlan: left promiscuous mode [ 1226.698324][ T3366] veth0_vlan: left promiscuous mode [ 1246.441175][ T3366] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1247.499976][ T3366] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1248.638455][ T3366] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1249.778878][ T3366] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1266.003226][ T3366] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1266.081897][ T3366] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1266.140532][ T3366] bond0 (unregistering): Released all slaves [ 1267.477534][ T3366] hsr_slave_0: left promiscuous mode [ 1267.597306][ T3366] hsr_slave_1: left promiscuous mode [ 1268.057846][ T3366] veth1_macvtap: left promiscuous mode [ 1268.061257][ T3366] veth0_macvtap: left promiscuous mode [ 1268.098218][ T3366] veth1_vlan: left promiscuous mode [ 1268.110622][ T3366] veth0_vlan: left promiscuous mode [ 1295.181597][ T3697] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1295.370490][ T3697] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1300.148643][ T3700] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1300.295026][ T3700] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1320.897506][ T3697] hsr_slave_0: entered promiscuous mode [ 1320.980294][ T3697] hsr_slave_1: entered promiscuous mode [ 1325.777703][ T3700] hsr_slave_0: entered promiscuous mode [ 1325.820235][ T3700] hsr_slave_1: entered promiscuous mode [ 1325.847100][ T3700] debugfs: 'hsr0' already exists in 'hsr' [ 1325.856439][ T3700] Cannot create hsr debugfs directory [ 1334.964032][ T3697] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1335.383952][ T3697] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1335.654297][ T3697] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1336.202920][ T3697] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1339.601254][ T3700] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1339.914360][ T3700] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1340.403983][ T3700] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1340.854107][ T3700] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1359.274718][ T3697] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1364.350058][ T3700] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1457.702690][ T3697] veth0_vlan: entered promiscuous mode [ 1458.581374][ T3697] veth1_vlan: entered promiscuous mode [ 1461.130425][ T3697] veth0_macvtap: entered promiscuous mode [ 1461.823155][ T3697] veth1_macvtap: entered promiscuous mode [ 1463.862584][ T3700] veth0_vlan: entered promiscuous mode [ 1465.280365][ T3700] veth1_vlan: entered promiscuous mode [ 1466.229770][ T3706] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1466.252122][ T3706] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1466.269512][ T3706] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1466.292535][ T3706] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1469.858528][ T3700] veth0_macvtap: entered promiscuous mode [ 1470.510854][ T3700] veth1_macvtap: entered promiscuous mode [ 1473.784928][ T3718] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1473.808480][ T51] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1474.033008][ T51] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1474.034519][ T51] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1685.489035][ T3366] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1687.649111][ T3366] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1689.451975][ T3366] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1690.993960][ T3366] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1706.990187][ T3366] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1707.093981][ T3366] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1707.218304][ T3366] bond0 (unregistering): Released all slaves [ 1708.476757][ T3366] hsr_slave_0: left promiscuous mode [ 1708.526821][ T3366] hsr_slave_1: left promiscuous mode [ 1708.852823][ T3366] veth1_macvtap: left promiscuous mode [ 1708.927023][ T3366] veth0_macvtap: left promiscuous mode [ 1708.929286][ T3366] veth1_vlan: left promiscuous mode [ 1708.941691][ T3366] veth0_vlan: left promiscuous mode [ 1730.037037][ T3366] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1731.214493][ T3366] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1731.853217][ T3366] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1733.593745][ T3366] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1755.881828][ T3366] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1755.981071][ T3366] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1756.040659][ T3366] bond0 (unregistering): Released all slaves [ 1757.528098][ T3366] hsr_slave_0: left promiscuous mode [ 1757.557980][ T3366] hsr_slave_1: left promiscuous mode [ 1757.839044][ T3366] veth1_macvtap: left promiscuous mode [ 1757.851478][ T3366] veth0_macvtap: left promiscuous mode [ 1757.868348][ T3366] veth1_vlan: left promiscuous mode [ 1757.874671][ T3366] veth0_vlan: left promiscuous mode [ 1789.880477][ T4040] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1790.179734][ T4040] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1796.987158][ T4051] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1797.289953][ T4051] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1817.393645][ T4040] hsr_slave_0: entered promiscuous mode [ 1817.452388][ T4040] hsr_slave_1: entered promiscuous mode [ 1823.984513][ T4051] hsr_slave_0: entered promiscuous mode [ 1824.023805][ T4051] hsr_slave_1: entered promiscuous mode [ 1824.044529][ T4051] debugfs: 'hsr0' already exists in 'hsr' [ 1824.097584][ T4051] Cannot create hsr debugfs directory [ 1835.349711][ T4040] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1836.014791][ T4040] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1836.390443][ T4040] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1836.774649][ T4040] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1841.461903][ T4051] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1841.991367][ T4051] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1842.509079][ T4051] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1842.927470][ T4051] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1869.491093][ T4040] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1875.551575][ T4051] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2001.490533][ T4040] veth0_vlan: entered promiscuous mode [ 2002.319734][ T4040] veth1_vlan: entered promiscuous mode [ 2006.507884][ T4040] veth0_macvtap: entered promiscuous mode [ 2006.720155][ T4051] veth0_vlan: entered promiscuous mode [ 2007.291824][ T4040] veth1_macvtap: entered promiscuous mode [ 2008.569233][ T4051] veth1_vlan: entered promiscuous mode [ 2012.292972][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2012.298389][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2012.378857][ T3366] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2012.390893][ T3839] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2014.161583][ T4051] veth0_macvtap: entered promiscuous mode [ 2015.100063][ T4051] veth1_macvtap: entered promiscuous mode [ 2019.587582][ T3366] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.600916][ T3839] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.631019][ T49] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2019.661146][ T49] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2153.043386][ T25] audit: type=1400 audit(2152.230:104): avc: denied { setattr } for pid=4361 comm="syz.4.96" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2204.873617][ T25] audit: type=1400 audit(2204.080:105): avc: denied { map } for pid=4394 comm="syz.4.102" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2204.943295][ T25] audit: type=1400 audit(2204.140:106): avc: denied { execute } for pid=4394 comm="syz.4.102" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 2449.231151][ T3368] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2452.160680][ T3368] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2453.552702][ T3368] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2455.154588][ T3368] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2477.378058][ T3368] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2477.574483][ T3368] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2477.743648][ T3368] bond0 (unregistering): Released all slaves [ 2480.859301][ T3368] hsr_slave_0: left promiscuous mode [ 2480.932119][ T3368] hsr_slave_1: left promiscuous mode [ 2481.733762][ T3368] veth1_macvtap: left promiscuous mode [ 2481.744790][ T3368] veth0_macvtap: left promiscuous mode [ 2481.764322][ T3368] veth1_vlan: left promiscuous mode [ 2481.798799][ T3368] veth0_vlan: left promiscuous mode [ 2505.303528][ T3368] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2506.503863][ T3368] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2507.769613][ T3368] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2509.968751][ T3368] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2535.823006][ T3368] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2536.110289][ T3368] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2536.228490][ T3368] bond0 (unregistering): Released all slaves [ 2537.889739][ T3368] hsr_slave_0: left promiscuous mode [ 2538.088082][ T3368] hsr_slave_1: left promiscuous mode [ 2538.648610][ T3368] veth1_macvtap: left promiscuous mode [ 2538.663854][ T3368] veth0_macvtap: left promiscuous mode [ 2538.677490][ T3368] veth1_vlan: left promiscuous mode [ 2538.699074][ T3368] veth0_vlan: left promiscuous mode [ 2578.624740][ T4516] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2578.990902][ T4516] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2594.753751][ T4526] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2595.223277][ T4526] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2611.979115][ T4516] hsr_slave_0: entered promiscuous mode [ 2612.031967][ T4516] hsr_slave_1: entered promiscuous mode [ 2627.618710][ T4526] hsr_slave_0: entered promiscuous mode [ 2627.675056][ T4526] hsr_slave_1: entered promiscuous mode [ 2627.800954][ T4526] debugfs: 'hsr0' already exists in 'hsr' [ 2627.804964][ T4526] Cannot create hsr debugfs directory [ 2631.653042][ T4516] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2632.197556][ T4516] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2632.565047][ T4516] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2633.140121][ T4516] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2651.848685][ T4526] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2652.404453][ T4526] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2652.944932][ T4526] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2653.469086][ T4526] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 2671.042531][ T4516] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2685.802314][ T4526] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2826.992504][ T4516] veth0_vlan: entered promiscuous mode [ 2828.270663][ T4516] veth1_vlan: entered promiscuous mode [ 2832.369697][ T4516] veth0_macvtap: entered promiscuous mode [ 2833.090844][ T4516] veth1_macvtap: entered promiscuous mode [ 2837.421639][ T3328] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2837.459196][ T4207] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2837.537976][ T49] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2837.552901][ T4054] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2848.621845][ T4526] veth0_vlan: entered promiscuous mode [ 2850.231625][ T4526] veth1_vlan: entered promiscuous mode [ 2854.999408][ T4526] veth0_macvtap: entered promiscuous mode [ 2855.790448][ T4526] veth1_macvtap: entered promiscuous mode [ 2860.376662][ T3706] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2860.380492][ T3706] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2860.403706][ T3706] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2860.459225][ T4064] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3238.622044][ T4532] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3241.011873][ T4532] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3243.084081][ T4532] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3245.152889][ T4532] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3271.609035][ T4532] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3271.731531][ T4532] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3271.861212][ T4532] bond0 (unregistering): Released all slaves [ 3274.301318][ T4532] hsr_slave_0: left promiscuous mode [ 3274.840238][ T4532] hsr_slave_1: left promiscuous mode [ 3276.388040][ T4532] veth1_macvtap: left promiscuous mode [ 3276.391474][ T4532] veth0_macvtap: left promiscuous mode [ 3276.409370][ T4532] veth1_vlan: left promiscuous mode [ 3276.421803][ T4532] veth0_vlan: left promiscuous mode [ 3321.941366][ T4532] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3323.469513][ T4532] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3324.954903][ T4532] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3327.140188][ T4532] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3350.542718][ T4532] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3350.769419][ T4532] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3350.912019][ T4532] bond0 (unregistering): Released all slaves [ 3353.218528][ T4532] hsr_slave_0: left promiscuous mode [ 3353.276585][ T4532] hsr_slave_1: left promiscuous mode [ 3353.812818][ T4532] veth1_macvtap: left promiscuous mode [ 3353.827482][ T4532] veth0_macvtap: left promiscuous mode [ 3353.841236][ T4532] veth1_vlan: left promiscuous mode [ 3353.868983][ T4532] veth0_vlan: left promiscuous mode [ 3406.191078][ T4942] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3406.551710][ T4942] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3416.149246][ T4947] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3416.534850][ T4947] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3446.190540][ T4942] hsr_slave_0: entered promiscuous mode [ 3446.312702][ T4942] hsr_slave_1: entered promiscuous mode [ 3456.834991][ T4947] hsr_slave_0: entered promiscuous mode [ 3456.930747][ T4947] hsr_slave_1: entered promiscuous mode [ 3456.986268][ T4947] debugfs: 'hsr0' already exists in 'hsr' [ 3456.996509][ T4947] Cannot create hsr debugfs directory [ 3471.226820][ T4942] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 3471.714565][ T4942] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 3473.051449][ T4942] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 3474.738001][ T4942] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 3485.538774][ T4947] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 3486.023754][ T4947] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 3486.701819][ T4947] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 3487.441089][ T4947] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 3517.850627][ T4942] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3527.562873][ T4947] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3702.050367][ T4942] veth0_vlan: entered promiscuous mode [ 3703.259423][ T4942] veth1_vlan: entered promiscuous mode [ 3707.254531][ T4942] veth0_macvtap: entered promiscuous mode [ 3708.051619][ T4942] veth1_macvtap: entered promiscuous mode [ 3714.028194][ T4950] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3714.039794][ T4475] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3714.068618][ T3366] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3714.248441][ T4532] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3716.389041][ T4947] veth0_vlan: entered promiscuous mode [ 3719.462023][ T4947] veth1_vlan: entered promiscuous mode [ 3726.528643][ T4947] veth0_macvtap: entered promiscuous mode [ 3727.602203][ T4947] veth1_macvtap: entered promiscuous mode [ 3733.229955][ T4945] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3733.334969][ T3366] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3733.387720][ T3366] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3733.610393][ T3366] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 4170.813482][ T5301] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 4171.689608][ T5301] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 4179.330285][ T5304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 4180.048840][ T5304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 4235.161388][ T5301] hsr_slave_0: entered promiscuous mode [ 4235.341447][ T5301] hsr_slave_1: entered promiscuous mode [ 4235.424797][ T5301] debugfs: 'hsr0' already exists in 'hsr' [ 4235.559353][ T5301] Cannot create hsr debugfs directory [ 4244.901565][ T5304] hsr_slave_0: entered promiscuous mode [ 4245.129831][ T5304] hsr_slave_1: entered promiscuous mode [ 4245.247053][ T5304] debugfs: 'hsr0' already exists in 'hsr' [ 4245.276828][ T5304] Cannot create hsr debugfs directory [ 4311.430098][ T5301] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 4313.061471][ T5301] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 4313.944409][ T5301] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 4314.620559][ T5301] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 4324.481209][ T5304] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 4325.272999][ T5304] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 4326.211851][ T5304] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 4326.944791][ T5304] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 4376.191000][ T5301] 8021q: adding VLAN 0 to HW filter on device bond0 [ 4382.732072][ T27] INFO: task syz.8.171:5278 blocked for more than 430 seconds. [ 4382.748152][ T27] Not tainted syzkaller #0 [ 4382.809545][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 4382.852651][ T27] task:syz.8.171 state:D stack:0 pid:5278 tgid:5278 ppid:4942 task_flags:0x400040 flags:0x00000019 [ 4382.991112][ T27] Call trace: [ 4383.026816][ T27] __switch_to+0x584/0xb20 (T) [ 4383.088266][ T27] __schedule+0x1eec/0x33a4 [ 4383.098558][ T27] schedule+0xac/0x27c [ 4383.099290][ T27] schedule_timeout+0x5c/0x1e4 [ 4383.099757][ T27] do_wait_for_common+0x28c/0x444 [ 4383.100146][ T27] wait_for_completion+0x44/0x5c [ 4383.100667][ T27] __synchronize_srcu+0x2a4/0x320 [ 4383.101173][ T27] synchronize_srcu+0x3cc/0x4f0 [ 4383.101648][ T27] mmu_notifier_unregister+0x320/0x42c [ 4383.102110][ T27] kvm_put_kvm+0x6a0/0xfa8 [ 4383.102538][ T27] kvm_vm_release+0x58/0x78 [ 4383.102973][ T27] __fput+0x4ac/0x980 [ 4383.103396][ T27] ____fput+0x20/0x58 [ 4383.103780][ T27] task_work_run+0x1bc/0x254 [ 4383.104190][ T27] do_notify_resume+0x1bc/0x270 [ 4383.104637][ T27] el0_svc+0xb8/0x164 SYZFAIL: failed to recv rpc [ 4383.267803][ T27] el0t_64_sync_handler+0x84/0x12c [ 4383.311839][ T27] el0t_64_sync+0x198/0x19c [ 4383.338512][ T27] [ 4383.338512][ T27] Showing all locks held in the system: [ 4383.366970][ T27] 1 lock held by khungtaskd/27: [ 4383.367567][ T27] #0: ffff800087876d18 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 [ 4383.370083][ T27] 3 locks held by kworker/u4:4/49: [ 4383.370596][ T27] 2 locks held by getty/3186: [ 4383.370932][ T27] #0: b6f0000011c4e8a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 4383.372573][ T27] #1: 15ff80008c5cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x310/0x12b8 [ 4383.374265][ T27] 3 locks held by kworker/u4:0/3328: [ 4383.374589][ T27] 3 locks held by kworker/u4:6/3366: [ 4383.374887][ T27] 3 locks held by kworker/u4:8/3718: fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 4383.557559][ T27] 3 locks held by kworker/u4:10/4054: [ 4383.558331][ T27] 2 locks held by kworker/u4:11/4064: [ 4383.558768][ T27] 3 locks held by kworker/u4:2/4945: [ 4383.559113][ T27] 2 locks held by kworker/u4:9/5106: [ 4383.559455][ T27] #0: 64f000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 4383.561187][ T27] #1: ffff80008eb67c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 4383.562855][ T27] 2 locks held by syz.9.170/5276: [ 4383.563188][ T27] 1 lock held by syz-executor/5304: [ 4383.563507][ T27] 3 locks held by kworker/u4:3/5306: [ 4383.563847][ T27] 1 lock held by modprobe/5443: [ 4383.564135][ T27] 1 lock held by dhcpcd-run-hook/5444: [ 4383.564598][ T27] [ 4383.564879][ T27] ============================================= [ 4383.564879][ T27] [ 4389.663533][ T5304] 8021q: adding VLAN 0 to HW filter on device bond0 [ 4403.849038][ T27] INFO: task syz.8.171:5278 blocked for more than 451 seconds. [ 4403.876646][ T27] Not tainted syzkaller #0 [ 4403.877431][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 4403.877739][ T27] task:syz.8.171 state:D stack:0 pid:5278 tgid:5278 ppid:4942 task_flags:0x400040 flags:0x00000019 [ 4403.878513][ T27] Call trace: [ 4403.878768][ T27] __switch_to+0x584/0xb20 (T) [ 4403.879325][ T27] __schedule+0x1eec/0x33a4 [ 4403.879816][ T27] schedule+0xac/0x27c [ 4403.880305][ T27] schedule_timeout+0x5c/0x1e4 [ 4403.880749][ T27] do_wait_for_common+0x28c/0x444 [ 4403.881153][ T27] wait_for_completion+0x44/0x5c [ 4403.881675][ T27] __synchronize_srcu+0x2a4/0x320 [ 4403.882140][ T27] synchronize_srcu+0x3cc/0x4f0 [ 4403.882619][ T27] mmu_notifier_unregister+0x320/0x42c [ 4403.883062][ T27] kvm_put_kvm+0x6a0/0xfa8 [ 4403.883488][ T27] kvm_vm_release+0x58/0x78 [ 4403.883914][ T27] __fput+0x4ac/0x980 [ 4403.884333][ T27] ____fput+0x20/0x58 [ 4403.884753][ T27] task_work_run+0x1bc/0x254 [ 4404.087948][ T27] do_notify_resume+0x1bc/0x270 [ 4404.096312][ T27] el0_svc+0xb8/0x164 [ 4404.096993][ T27] el0t_64_sync_handler+0x84/0x12c [ 4404.097493][ T27] el0t_64_sync+0x198/0x19c [ 4404.111120][ T27] [ 4404.111120][ T27] Showing all locks held in the system: [ 4404.111578][ T27] 1 lock held by khungtaskd/27: [ 4404.111919][ T27] #0: ffff800087876d18 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 [ 4404.113677][ T27] 3 locks held by kworker/u4:4/49: [ 4404.114098][ T27] 1 lock held by syslogd/3114: [ 4404.114452][ T27] 2 locks held by getty/3186: [ 4404.114750][ T27] #0: b6f0000011c4e8a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 4404.249264][ T27] #1: 15ff80008c5cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x310/0x12b8 [ 4404.250952][ T27] 3 locks held by kworker/u4:0/3328: [ 4404.251304][ T27] 3 locks held by kworker/u4:6/3366: [ 4404.251605][ T27] 2 locks held by kworker/u4:8/3718: [ 4404.251942][ T27] 3 locks held by kworker/u4:5/4532: [ 4404.252294][ T27] 3 locks held by kworker/u4:2/4945: [ 4404.252640][ T27] 2 locks held by kworker/u4:9/5106: [ 4404.252977][ T27] #0: 64f000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 4404.254613][ T27] #1: ffff80008eb67c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 4404.381795][ T27] 2 locks held by syz.9.170/5276: [ 4404.382144][ T27] 2 locks held by syz-executor/5301: [ 4404.382484][ T27] 2 locks held by syz-executor/5304: [ 4404.382774][ T27] 3 locks held by kworker/u4:15/5312: [ 4404.383080][ T27] 2 locks held by kworker/0:6/5404: [ 4404.383429][ T27] 2 locks held by kworker/u4:1/5446: [ 4404.383721][ T27] #0: 64f000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 4404.561759][ T27] #1: ffff80008e8e7c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 4404.563750][ T27] 2 locks held by modprobe/5450: [ 4404.564081][ T27] 4 locks held by modprobe/5451: [ 4404.564410][ T27] 1 lock held by rm/5453: [ 4404.564800][ T27] [ 4404.565046][ T27] ============================================= [ 4404.565046][ T27] VM DIAGNOSIS: 23:02:00 Registers: info registers vcpu 0 CPU#0 PC=ffff8000865a61ec X00=ffff800087b215a0 X01=0000000000000000 X02=0000000000000001 X03=ffff80008045cfcc X04=0000000000000001 X05=0000000000000001 X06=0000000000000000 X07=ffff800080572cd4 X08=ffff8000865a61e4 X09=0000000000010102 X10=0000000000ff0100 X11=ffff800087fe5a20 X12=f4f000000d9ba830 X13=0000000000000028 X14=0000000000006000 X15=00000000000000ff X16=ffff800080000000 X17=fff07fffeb67d000 X18=00000000000000ff X19=ffff80008c261050 X20=efff800000000000 X21=00000000000000ff X22=ffff8000877202c0 X23=0000000000000000 X24=0000000000989680 X25=ffff800080007db0 X26=ffff80008c260f00 X27=0000000000000001 X28=f4f000000d9b9d90 X29=ffff8000800077a0 X30=ffff800084acf4d8 SP=ffff8000800077a0 PSTATE=004020c9 ---- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=766c6f7365726269:6c2f343662696c2f Z01=00322e6f732e766c:6f73657262696c2f Z02=0000000000000000:fffffffffff00000 Z03=0000000000000000:0000000000000000 Z04=3333333333333333:3333333333333333 Z05=0000000000000000:000000000c000000 Z06=0000000000000000:0000000000000000 Z07=0000000000000000:0000000000000000 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000000000000000:0000000000000000 Z17=0000000000000000:0000000000000000 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000