program:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000, &(0x7f0000c00000/0x1000)=nil})
ioctl$KVM_CAP_XEN_HVM(r1, 0x4068aea3, &(0x7f0000000400)={0x26, 0x0, 0x4})
r3 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000d00)={0x0, 'syz_tun\x00', {0x4}, 0xa})
r4 = socket(0x1e, 0x1, 0x0)
getsockopt$sock_buf(r4, 0x1, 0x1c, 0x0, &(0x7f0000000280))
ioctl(r2, 0x8, &(0x7f0000000340)="010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000ab1b3e0c73d650ce436c84007608147d5e3dd2030ec70c28f22054f0e0f98c696b238d67f84463a6943e77d4cf13f747fe2920adb5d066555247d457eeb4ffddeb63639d7452b2311e2af5731e372374cbeb27eedd9a1e12095cc966")
setsockopt$inet6_int(r4, 0x29, 0x3e, &(0x7f0000000080)=0x1, 0x4)
ioctl(r1, 0x4048aec9, &(0x7f0000000200)="0100000000000000ffffffffffffffff00"/72)
ioctl(r1, 0x400caed0, &(0x7f0000000300)="0100000000000000ffffffff")
[ 95.121699][ T4641] Bluetooth: hci0: command tx timeout
[ 95.207842][ T5316] ------------[ cut here ]------------
[ 95.210747][ T5316] kvm_is_error_gpa(gpa) == kvm_is_error_hva(uhva)
[ 95.210761][ T5316] WARNING: arch/x86/kvm/../../../virt/kvm/pfncache.c:267 at __kvm_gpc_refresh+0x1510/0x1710, CPU#0: syz.0.0/5316
[ 95.218543][ T5316] Modules linked in:
[ 95.221150][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.224928][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.229186][ T5316] RIP: 0010:__kvm_gpc_refresh+0x1510/0x1710
[ 95.231612][ T5316] Code: c6 05 ab 85 21 0f 01 48 c7 c7 2c 68 44 8e be 3c 04 00 00 48 c7 c2 60 41 02 8c e8 2b 23 62 00 e9 81 ee ff ff e8 71 6b 86 00 90 <0f> 0b 90 bb ea ff ff ff 49 bf 00 00 00 00 00 fc ff df e9 4b f6 ff
[ 95.239668][ T5316] RSP: 0018:ffffc9000df271c0 EFLAGS: 00010283
[ 95.242084][ T5316] RAX: ffffffff8140c94f RBX: ffff888000000000 RCX: 0000000000100000
[ 95.245435][ T5316] RDX: ffffc9000f269000 RSI: 0000000000000353 RDI: 0000000000000354
[ 95.248579][ T5316] RBP: ffffc9000df27350 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46
[ 95.251942][ T5316] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 1ffff92001be4e4c
[ 95.255408][ T5316] R13: ffff88804f365b60 R14: ffff888000000000 R15: ffffffffffffff01
[ 95.259037][ T5316] FS: 00007f63730c16c0(0000) GS:ffff88808c30a000(0000) knlGS:0000000000000000
[ 95.262816][ T5316] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.265495][ T5316] CR2: 0000561649fda168 CR3: 0000000043f7b000 CR4: 0000000000352ef0
[ 95.268660][ T5316] Call Trace:
[ 95.269863][ T5316]
[ 95.271122][ T5316] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 95.273313][ T5316] ? lock_acquire+0x106/0x350
[ 95.275311][ T5316] ? kvm_gpc_refresh+0x31/0x110
[ 95.277529][ T5316] ? __pfx___kvm_gpc_refresh+0x10/0x10
[ 95.279575][ T5316] ? kvm_xen_set_evtchn+0x11e/0x220
[ 95.281589][ T5316] kvm_gpc_refresh+0xe1/0x110
[ 95.283297][ T5316] ? kvm_xen_set_evtchn+0x11e/0x220
[ 95.285187][ T5316] kvm_xen_set_evtchn+0x14f/0x220
[ 95.287317][ T5316] kvm_xen_hvm_evtchn_send+0x120/0x1e0
[ 95.289542][ T5316] kvm_arch_vm_ioctl+0xfad/0x1a10
[ 95.291671][ T5316] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10
[ 95.293829][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.296291][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.298290][ T5316] ? unwind_next_frame+0x8f/0x2550
[ 95.300367][ T5316] ? is_bpf_text_address+0x26/0x2b0
[ 95.302334][ T5316] ? is_bpf_text_address+0x26/0x2b0
[ 95.304636][ T5316] ? is_bpf_text_address+0x292/0x2b0
[ 95.306935][ T5316] ? kernel_text_address+0xa5/0xe0
[ 95.309143][ T5316] ? __kernel_text_address+0xd/0x30
[ 95.311339][ T5316] ? unwind_get_return_address+0x4d/0x90
[ 95.313699][ T5316] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 95.316509][ T5316] ? arch_stack_walk+0xfb/0x150
[ 95.318601][ T5316] ? stack_trace_save+0xa9/0x100
[ 95.320748][ T5316] ? __pfx_stack_trace_save+0x10/0x10
[ 95.323127][ T5316] ? kasan_save_track+0x4f/0x80
[ 95.325212][ T5316] ? stack_depot_save_flags+0x33/0x7f0
[ 95.327568][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.329639][ T5316] ? kasan_save_track+0x4f/0x80
[ 95.331769][ T5316] ? kasan_save_track+0x3e/0x80
[ 95.333862][ T5316] ? kasan_save_free_info+0x40/0x50
[ 95.336292][ T5316] ? __kasan_slab_free+0x5c/0x80
[ 95.338577][ T5316] ? kfree+0x1c5/0x640
[ 95.340339][ T5316] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 95.343115][ T5316] ? security_file_ioctl+0xc3/0x2a0
[ 95.345820][ T5316] ? __se_sys_ioctl+0x47/0x170
[ 95.348068][ T5316] ? do_syscall_64+0x166/0x520
[ 95.350278][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.352919][ T5316] kvm_vm_ioctl+0x8f7/0xd30
[ 95.354976][ T5316] ? __pfx_kvm_vm_ioctl+0x10/0x10
[ 95.357476][ T5316] ? kasan_quarantine_put+0xbb/0x1f0
[ 95.359910][ T5316] ? tomoyo_path_number_perm+0x219/0x5f0
[ 95.362348][ T5316] ? tomoyo_path_number_perm+0x219/0x5f0
[ 95.364890][ T5316] ? do_vfs_ioctl+0x116f/0x1530
[ 95.367188][ T5316] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 95.369633][ T5316] ? hook_file_ioctl+0x1f0/0x5f0
[ 95.371876][ T5316] ? __fget_files+0x2a/0x420
[ 95.373995][ T5316] ? __fget_files+0x2a/0x420
[ 95.376296][ T5316] ? __fget_files+0x3a2/0x420
[ 95.378483][ T5316] ? __fget_files+0x2a/0x420
[ 95.380566][ T5316] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.382973][ T5316] ? __pfx_kvm_vm_ioctl+0x10/0x10
[ 95.385244][ T5316] __se_sys_ioctl+0xfc/0x170
[ 95.387538][ T5316] do_syscall_64+0x166/0x520
[ 95.389582][ T5316] ? trace_irq_disable+0x3b/0x140
[ 95.391714][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.394329][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 95.396414][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.399135][ T5316] RIP: 0033:0x7f637219e0d9
[ 95.400908][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.409209][ T5316] RSP: 002b:00007f63730c0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.413145][ T5316] RAX: ffffffffffffffda RBX: 00007f6372425fa0 RCX: 00007f637219e0d9
[ 95.416789][ T5316] RDX: 0000200000000300 RSI: 00000000400caed0 RDI: 0000000000000004
[ 95.420273][ T5316] RBP: 00007f6372235024 R08: 0000000000000000 R09: 0000000000000000
[ 95.423906][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.427986][ T5316] R13: 00007f6372426038 R14: 00007f6372425fa0 R15: 00007ffe9663d188
[ 95.431445][ T5316]
[ 95.432603][ T5316] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 95.435472][ T5316] CPU: 0 UID: 0 PID: 5316 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.439516][ T5316] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.444039][ T5316] Call Trace:
[ 95.445527][ T5316]
[ 95.446896][ T5316] vpanic+0x56d/0xa60
[ 95.448643][ T5316] ? __pfx__printk+0x10/0x10
[ 95.450680][ T5316] ? __pfx_vpanic+0x10/0x10
[ 95.452624][ T5316] ? is_bpf_text_address+0x292/0x2b0
[ 95.454934][ T5316] ? is_bpf_text_address+0x26/0x2b0
[ 95.457299][ T5316] panic+0xc5/0xd0
[ 95.459001][ T5316] ? __pfx_panic+0x10/0x10
[ 95.460982][ T5316] __warn+0x315/0x4c0
[ 95.462755][ T5316] ? __kvm_gpc_refresh+0x1510/0x1710
[ 95.465081][ T5316] ? __kvm_gpc_refresh+0x1510/0x1710
[ 95.467440][ T5316] __report_bug+0x276/0x570
[ 95.469497][ T5316] ? check_path+0x21/0x40
[ 95.471306][ T5316] ? __kvm_gpc_refresh+0x1510/0x1710
[ 95.473424][ T5316] ? __pfx___report_bug+0x10/0x10
[ 95.475468][ T5316] ? lockdep_unlock+0x5c/0xd0
[ 95.477433][ T5316] ? __lock_acquire+0x13e8/0x2cf0
[ 95.479873][ T5316] ? __kvm_gpc_refresh+0x1510/0x1710
[ 95.482102][ T5316] report_bug+0x16b/0x220
[ 95.483921][ T5316] ? __kvm_gpc_refresh+0x1510/0x1710
[ 95.486189][ T5316] ? __kvm_gpc_refresh+0x1512/0x1710
[ 95.488450][ T5316] handle_bug+0x9c/0x200
[ 95.490128][ T5316] exc_invalid_op+0x1a/0x50
[ 95.491924][ T5316] asm_exc_invalid_op+0x1a/0x20
[ 95.494293][ T5316] RIP: 0010:__kvm_gpc_refresh+0x1510/0x1710
[ 95.496911][ T5316] Code: c6 05 ab 85 21 0f 01 48 c7 c7 2c 68 44 8e be 3c 04 00 00 48 c7 c2 60 41 02 8c e8 2b 23 62 00 e9 81 ee ff ff e8 71 6b 86 00 90 <0f> 0b 90 bb ea ff ff ff 49 bf 00 00 00 00 00 fc ff df e9 4b f6 ff
[ 95.505122][ T5316] RSP: 0018:ffffc9000df271c0 EFLAGS: 00010283
[ 95.507794][ T5316] RAX: ffffffff8140c94f RBX: ffff888000000000 RCX: 0000000000100000
[ 95.511182][ T5316] RDX: ffffc9000f269000 RSI: 0000000000000353 RDI: 0000000000000354
[ 95.514639][ T5316] RBP: ffffc9000df27350 R08: ffffffff9078fa37 R09: 1ffffffff20f1f46
[ 95.518116][ T5316] R10: dffffc0000000000 R11: fffffbfff20f1f47 R12: 1ffff92001be4e4c
[ 95.521444][ T5316] R13: ffff88804f365b60 R14: ffff888000000000 R15: ffffffffffffff01
[ 95.524840][ T5316] ? __kvm_gpc_refresh+0x150f/0x1710
[ 95.527076][ T5316] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0
[ 95.529467][ T5316] ? lock_acquire+0x106/0x350
[ 95.531612][ T5316] ? kvm_gpc_refresh+0x31/0x110
[ 95.533819][ T5316] ? __pfx___kvm_gpc_refresh+0x10/0x10
[ 95.536243][ T5316] ? kvm_xen_set_evtchn+0x11e/0x220
[ 95.538546][ T5316] kvm_gpc_refresh+0xe1/0x110
[ 95.540713][ T5316] ? kvm_xen_set_evtchn+0x11e/0x220
[ 95.543070][ T5316] kvm_xen_set_evtchn+0x14f/0x220
[ 95.545289][ T5316] kvm_xen_hvm_evtchn_send+0x120/0x1e0
[ 95.547683][ T5316] kvm_arch_vm_ioctl+0xfad/0x1a10
[ 95.549801][ T5316] ? __pfx_kvm_arch_vm_ioctl+0x10/0x10
[ 95.552714][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.555353][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.557959][ T5316] ? unwind_next_frame+0x8f/0x2550
[ 95.560748][ T5316] ? is_bpf_text_address+0x26/0x2b0
[ 95.563551][ T5316] ? is_bpf_text_address+0x26/0x2b0
[ 95.566300][ T5316] ? is_bpf_text_address+0x292/0x2b0
[ 95.568679][ T5316] ? kernel_text_address+0xa5/0xe0
[ 95.571241][ T5316] ? __kernel_text_address+0xd/0x30
[ 95.574066][ T5316] ? unwind_get_return_address+0x4d/0x90
[ 95.576957][ T5316] ? __pfx_stack_trace_consume_entry+0x10/0x10
[ 95.580185][ T5316] ? arch_stack_walk+0xfb/0x150
[ 95.582211][ T5316] ? stack_trace_save+0xa9/0x100
[ 95.584298][ T5316] ? __pfx_stack_trace_save+0x10/0x10
[ 95.586808][ T5316] ? kasan_save_track+0x4f/0x80
[ 95.589162][ T5316] ? stack_depot_save_flags+0x33/0x7f0
[ 95.591843][ T5316] ? __lock_acquire+0x683/0x2cf0
[ 95.594305][ T5316] ? kasan_save_track+0x4f/0x80
[ 95.596701][ T5316] ? kasan_save_track+0x3e/0x80
[ 95.599169][ T5316] ? kasan_save_free_info+0x40/0x50
[ 95.601606][ T5316] ? __kasan_slab_free+0x5c/0x80
[ 95.603818][ T5316] ? kfree+0x1c5/0x640
[ 95.605580][ T5316] ? tomoyo_path_number_perm+0x4ba/0x5f0
[ 95.608070][ T5316] ? security_file_ioctl+0xc3/0x2a0
[ 95.610397][ T5316] ? __se_sys_ioctl+0x47/0x170
[ 95.612619][ T5316] ? do_syscall_64+0x166/0x520
[ 95.614779][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.617472][ T5316] kvm_vm_ioctl+0x8f7/0xd30
[ 95.619463][ T5316] ? __pfx_kvm_vm_ioctl+0x10/0x10
[ 95.621472][ T5316] ? kasan_quarantine_put+0xbb/0x1f0
[ 95.623693][ T5316] ? tomoyo_path_number_perm+0x219/0x5f0
[ 95.626195][ T5316] ? tomoyo_path_number_perm+0x219/0x5f0
[ 95.629051][ T5316] ? do_vfs_ioctl+0x116f/0x1530
[ 95.631739][ T5316] ? __pfx_do_vfs_ioctl+0x10/0x10
[ 95.634471][ T5316] ? hook_file_ioctl+0x1f0/0x5f0
[ 95.636888][ T5316] ? __fget_files+0x2a/0x420
[ 95.639002][ T5316] ? __fget_files+0x2a/0x420
[ 95.641085][ T5316] ? __fget_files+0x3a2/0x420
[ 95.643258][ T5316] ? __fget_files+0x2a/0x420
[ 95.645320][ T5316] ? bpf_lsm_file_ioctl+0x9/0x20
[ 95.647586][ T5316] ? __pfx_kvm_vm_ioctl+0x10/0x10
[ 95.649769][ T5316] __se_sys_ioctl+0xfc/0x170
[ 95.651739][ T5316] do_syscall_64+0x166/0x520
[ 95.653682][ T5316] ? trace_irq_disable+0x3b/0x140
[ 95.655952][ T5316] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.658631][ T5316] ? clear_bhb_loop+0x70/0xc0
[ 95.660442][ T5316] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.662575][ T5316] RIP: 0033:0x7f637219e0d9
[ 95.664352][ T5316] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.671994][ T5316] RSP: 002b:00007f63730c0fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 95.675388][ T5316] RAX: ffffffffffffffda RBX: 00007f6372425fa0 RCX: 00007f637219e0d9
[ 95.678580][ T5316] RDX: 0000200000000300 RSI: 00000000400caed0 RDI: 0000000000000004
[ 95.681500][ T5316] RBP: 00007f6372235024 R08: 0000000000000000 R09: 0000000000000000
[ 95.684608][ T5316] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.687674][ T5316] R13: 00007f6372426038 R14: 00007f6372425fa0 R15: 00007ffe9663d188
[ 95.690745][ T5316]
[ 95.692356][ T5316] Kernel Offset: disabled
[ 95.693995][ T5316] Rebooting in 86400 seconds..