program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f0000000100)={0x2, 0x40000105, 0x0, 0x0})
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xae01, 0x8)
r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_CPUID2(r3, 0x4048aecb, &(0x7f0000000480)={0x7, 0x0, [{0xa, 0xffffffff, 0x1, 0xffffff89, 0x800, 0x6, 0x48d4}, {0x40000000, 0x4, 0x1, 0x7, 0x7, 0x7, 0x5}, {0x8000000e, 0x8, 0x1, 0x3ff, 0x7ffffdff, 0x8005, 0xffff}, {0x80000019, 0x2, 0x1, 0x7, 0xdf1, 0x2, 0x80000001}, {0x80000000, 0x2bb, 0x1, 0xd, 0x3, 0x7ff, 0x8}, {0x80000000, 0x100, 0x4, 0x6, 0x3, 0x2, 0x3}, {0x80000001, 0x2, 0xb, 0xfffffff7, 0xfffffff9, 0xff, 0x6}]}) (async)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
[ 109.470052][ T5288] Bluetooth: hci0: command tx timeout
[ 109.681886][ T5330] ------------[ cut here ]------------
[ 109.685470][ T5330] kvm_is_error_gpa(gpa) == kvm_is_error_hva(uhva)
[ 109.685486][ T5330] WARNING: arch/x86/kvm/../../../virt/kvm/pfncache.c:267 at __kvm_gpc_refresh+0x1510/0x1710, CPU#0: syz.0.0/5330
[ 109.694211][ T5330] Modules linked in:
[ 109.697659][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.702041][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.706738][ T5330] RIP: 0010:__kvm_gpc_refresh+0x1510/0x1710
[ 109.709598][ T5330] Code: c6 05 13 e7 db 0e 01 48 c7 c7 0a 9c fc 8d be 3c 04 00 00 48 c7 c2 80 3f c2 8b e8 4b 6b 61 00 e9 81 ee ff ff e8 21 80 85 00 90 <0f> 0b 90 bb ea ff ff ff 49 bf 00 00 00 00 00 fc ff df e9 4b f6 ff
[ 109.719402][ T5330] RSP: 0018:ffffc90007db7360 EFLAGS: 00010293
[ 109.722142][ T5330] RAX: ffffffff8140c0cf RBX: ffff888000000000 RCX: ffff88800026ca80
[ 109.725571][ T5330] RDX: 0000000000000000 RSI: ffff888000000000 RDI: ffff888000000000
[ 109.729547][ T5330] RBP: ffffc90007db74f0 R08: ffffffff9032e3f7 R09: 1ffffffff2065c7e
[ 109.733499][ T5330] R10: dffffc0000000000 R11: fffffbfff2065c7f R12: 1ffff92000fb6e80
[ 109.736979][ T5330] R13: ffff888038b412e0 R14: ffff888000000000 R15: ffffffffffffff01
[ 109.740709][ T5330] FS: 00007f25b84d66c0(0000) GS:ffff88808c81f000(0000) knlGS:0000000000000000
[ 109.745395][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 109.749091][ T5330] CR2: 00007f25b7817da0 CR3: 0000000012186000 CR4: 0000000000352ef0
[ 109.752592][ T5330] Call Trace:
[ 109.754189][ T5330]
[ 109.755519][ T5330] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 109.758047][ T5330] ? lock_acquire+0x106/0x350
[ 109.760340][ T5330] ? kvm_gpc_refresh+0x31/0x110
[ 109.762549][ T5330] ? __pfx___kvm_gpc_refresh+0x10/0x10
[ 109.765135][ T5330] ? kvm_xen_set_evtchn+0x11e/0x220
[ 109.767730][ T5330] kvm_gpc_refresh+0xe1/0x110
[ 109.769859][ T5330] ? kvm_xen_set_evtchn+0x11e/0x220
[ 109.772298][ T5330] kvm_xen_set_evtchn+0x14f/0x220
[ 109.774504][ T5330] kvm_xen_inject_timer_irqs+0xfd/0x200
[ 109.777356][ T5330] vcpu_run+0x979/0x77d0
[ 109.779704][ T5330] ? __pfx_vcpu_run+0x10/0x10
[ 109.781965][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 109.784486][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 109.787061][ T5330] ? fpu_swap_kvm_fpstate+0xcb/0x510
[ 109.789392][ T5330] kvm_arch_vcpu_ioctl_run+0x1193/0x2070
[ 109.792442][ T5330] ? __pfx_stack_trace_save+0x10/0x10
[ 109.795560][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 109.798173][ T5330] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[ 109.800929][ T5330] ? lockdep_unlock+0x5d/0xd0
[ 109.802966][ T5330] ? __lock_acquire+0x13e8/0x2cf0
[ 109.805404][ T5330] ? do_raw_write_lock+0x11d/0x260
[ 109.808035][ T5330] kvm_vcpu_ioctl+0xa61/0xfd0
[ 109.810391][ T5330] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 109.812673][ T5330] ? hook_file_ioctl+0x1f0/0x5f0
[ 109.814751][ T5330] ? __fget_files+0x2a/0x420
[ 109.817157][ T5330] ? __fget_files+0x2a/0x420
[ 109.819604][ T5330] ? __fget_files+0x3a2/0x420
[ 109.821934][ T5330] ? __fget_files+0x2a/0x420
[ 109.824994][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20
[ 109.827196][ T5330] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 109.829559][ T5330] __se_sys_ioctl+0xfc/0x170
[ 109.831835][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.834525][ T5330] do_syscall_64+0x174/0x580
[ 109.836822][ T5330] ? trace_irq_disable+0x3b/0x140
[ 109.839656][ T5330] ? clear_bhb_loop+0x40/0x90
[ 109.842500][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 109.845102][ T5330] RIP: 0033:0x7f25b759ce59
[ 109.847032][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 109.856074][ T5330] RSP: 002b:00007f25b84d5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 109.860913][ T5330] RAX: ffffffffffffffda RBX: 00007f25b7816090 RCX: 00007f25b759ce59
[ 109.864354][ T5330] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006
[ 109.867652][ T5330] RBP: 00007f25b7632e6f R08: 0000000000000000 R09: 0000000000000000
[ 109.871166][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 109.874612][ T5330] R13: 00007f25b7816128 R14: 00007f25b7816090 R15: 00007fff92ec5028
[ 109.878400][ T5330]
[ 109.880052][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 109.883620][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 109.887645][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 109.891955][ T5330] Call Trace:
[ 109.893376][ T5330]
[ 109.894804][ T5330] vpanic+0x56c/0xa60
[ 109.897148][ T5330] ? __pfx__printk+0x10/0x10
[ 109.900114][ T5330] ? __pfx_vpanic+0x10/0x10
[ 109.902211][ T5330] ? is_bpf_text_address+0x292/0x2b0
[ 109.904469][ T5330] ? is_bpf_text_address+0x26/0x2b0
[ 109.906707][ T5330] panic+0xc5/0xd0
[ 109.908387][ T5330] ? __pfx_panic+0x10/0x10
[ 109.910264][ T5330] __warn+0x315/0x4c0
[ 109.911956][ T5330] ? __kvm_gpc_refresh+0x1510/0x1710
[ 109.914139][ T5330] ? __kvm_gpc_refresh+0x1510/0x1710
[ 109.916385][ T5330] __report_bug+0x331/0x530
[ 109.918747][ T5330] ? check_path+0x21/0x40
[ 109.921156][ T5330] ? __kvm_gpc_refresh+0x1510/0x1710
[ 109.923745][ T5330] ? __pfx___report_bug+0x10/0x10
[ 109.926071][ T5330] ? lockdep_unlock+0x5d/0xd0
[ 109.928336][ T5330] ? __lock_acquire+0x13e8/0x2cf0
[ 109.930790][ T5330] ? __kvm_gpc_refresh+0x1510/0x1710
[ 109.933281][ T5330] report_bug+0x16a/0x220
[ 109.935302][ T5330] ? __kvm_gpc_refresh+0x1510/0x1710
[ 109.937714][ T5330] ? __kvm_gpc_refresh+0x1512/0x1710
[ 109.940295][ T5330] handle_bug+0x9c/0x200
[ 109.942186][ T5330] exc_invalid_op+0x1a/0x50
[ 109.944163][ T5330] asm_exc_invalid_op+0x1a/0x20
[ 109.946283][ T5330] RIP: 0010:__kvm_gpc_refresh+0x1510/0x1710
[ 109.949003][ T5330] Code: c6 05 13 e7 db 0e 01 48 c7 c7 0a 9c fc 8d be 3c 04 00 00 48 c7 c2 80 3f c2 8b e8 4b 6b 61 00 e9 81 ee ff ff e8 21 80 85 00 90 <0f> 0b 90 bb ea ff ff ff 49 bf 00 00 00 00 00 fc ff df e9 4b f6 ff
[ 109.958106][ T5330] RSP: 0018:ffffc90007db7360 EFLAGS: 00010293
[ 109.960663][ T5330] RAX: ffffffff8140c0cf RBX: ffff888000000000 RCX: ffff88800026ca80
[ 109.963966][ T5330] RDX: 0000000000000000 RSI: ffff888000000000 RDI: ffff888000000000
[ 109.968133][ T5330] RBP: ffffc90007db74f0 R08: ffffffff9032e3f7 R09: 1ffffffff2065c7e
[ 109.972704][ T5330] R10: dffffc0000000000 R11: fffffbfff2065c7f R12: 1ffff92000fb6e80
[ 109.976108][ T5330] R13: ffff888038b412e0 R14: ffff888000000000 R15: ffffffffffffff01
[ 109.979622][ T5330] ? __kvm_gpc_refresh+0x150f/0x1710
[ 109.982394][ T5330] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 109.985188][ T5330] ? lock_acquire+0x106/0x350
[ 109.987279][ T5330] ? kvm_gpc_refresh+0x31/0x110
[ 109.989261][ T5330] ? __pfx___kvm_gpc_refresh+0x10/0x10
[ 109.991695][ T5330] ? kvm_xen_set_evtchn+0x11e/0x220
[ 109.994075][ T5330] kvm_gpc_refresh+0xe1/0x110
[ 109.997711][ T5330] ? kvm_xen_set_evtchn+0x11e/0x220
[ 110.000612][ T5330] kvm_xen_set_evtchn+0x14f/0x220
[ 110.002793][ T5330] kvm_xen_inject_timer_irqs+0xfd/0x200
[ 110.005263][ T5330] vcpu_run+0x979/0x77d0
[ 110.007320][ T5330] ? __pfx_vcpu_run+0x10/0x10
[ 110.009390][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 110.011835][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 110.014300][ T5330] ? fpu_swap_kvm_fpstate+0xcb/0x510
[ 110.016581][ T5330] kvm_arch_vcpu_ioctl_run+0x1193/0x2070
[ 110.019113][ T5330] ? __pfx_stack_trace_save+0x10/0x10
[ 110.021741][ T5330] ? kvm_arch_vcpu_ioctl_run+0x2fa/0x2070
[ 110.024941][ T5330] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[ 110.027978][ T5330] ? lockdep_unlock+0x5d/0xd0
[ 110.030009][ T5330] ? __lock_acquire+0x13e8/0x2cf0
[ 110.032117][ T5330] ? do_raw_write_lock+0x11d/0x260
[ 110.034246][ T5330] kvm_vcpu_ioctl+0xa61/0xfd0
[ 110.036296][ T5330] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 110.038493][ T5330] ? hook_file_ioctl+0x1f0/0x5f0
[ 110.040966][ T5330] ? __fget_files+0x2a/0x420
[ 110.043604][ T5330] ? __fget_files+0x2a/0x420
[ 110.045749][ T5330] ? __fget_files+0x3a2/0x420
[ 110.047809][ T5330] ? __fget_files+0x2a/0x420
[ 110.049777][ T5330] ? bpf_lsm_file_ioctl+0x9/0x20
[ 110.051911][ T5330] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 110.054239][ T5330] __se_sys_ioctl+0xfc/0x170
[ 110.056355][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.059414][ T5330] do_syscall_64+0x174/0x580
[ 110.061704][ T5330] ? trace_irq_disable+0x3b/0x140
[ 110.063882][ T5330] ? clear_bhb_loop+0x40/0x90
[ 110.065779][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 110.068334][ T5330] RIP: 0033:0x7f25b759ce59
[ 110.070442][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 110.079422][ T5330] RSP: 002b:00007f25b84d5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 110.083599][ T5330] RAX: ffffffffffffffda RBX: 00007f25b7816090 RCX: 00007f25b759ce59
[ 110.087412][ T5330] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006
[ 110.091787][ T5330] RBP: 00007f25b7632e6f R08: 0000000000000000 R09: 0000000000000000
[ 110.095616][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 110.098991][ T5330] R13: 00007f25b7816128 R14: 00007f25b7816090 R15: 00007fff92ec5028
[ 110.102326][ T5330]
[ 110.104076][ T5330] Kernel Offset: disabled
[ 110.106095][ T5330] Rebooting in 86400 seconds..