last executing test programs:

40m50.53064837s ago: executing program 0 (id=244):
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x82880, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
openat$kvm(0x0, 0x0, 0x101282, 0x0)
r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r4, r5, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_ARM_SET_COUNTER_OFFSET(r4, 0x4010aeb5, &(0x7f0000000140)={0xfbd})
ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013df1a, &(0x7f00000000c0)=0x3})
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000200)=[@mrs={0xbe, 0x18, {0x603000000013c523}}], 0x18}, 0x0, 0x0)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
r7 = syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=[@msr={0x14, 0x20, {0x603000000013deb7}}, @svc={0x122, 0x40, {0xc4000007, [0x3, 0x1, 0x1, 0x4, 0x2]}}, @mrs={0xbe, 0x18, {0x603000000013df67}}, @msr={0x14, 0x20, {0x603000000013e66a, 0x10000}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x384}}, @irq_setup={0x46, 0x18, {0x2, 0xd}}, @smc={0x1e, 0x40, {0x2000000, [0xe, 0x6, 0xffffffffffff144f, 0x8, 0x7fff]}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x3, 0x2, 0xd, 0x3, 0x4}}, @irq_setup={0x46, 0x18, {0x0, 0x228}}, @uexit={0x0, 0x18, 0xffffffff}, @uexit={0x0, 0x18, 0x5}, @uexit={0x0, 0x18, 0xe}, @svc={0x122, 0x40, {0x4001, [0x3, 0x1ff, 0x3, 0xd, 0x6]}}, @hvc={0x32, 0x40, {0x84000051, [0x88, 0x1, 0x2, 0x0, 0x4]}}, @hvc={0x32, 0x40, {0x84000009, [0x0, 0x3, 0x44d3, 0x5, 0x4000000000000017]}}, @its_setup={0x82, 0x28, {0x3, 0x3, 0x175}}], 0x288}, 0x0, 0x0)
openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x400000000c)
r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil)
r10 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil)
r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000180)={0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013c4f2}}], 0x18}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r13, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init)
ioctl$KVM_RUN(r13, 0xae80, 0x0)
r14 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f0000000000)={0x1, 0x58})
ioctl$KVM_RUN(r14, 0xae80, 0x0)
ioctl$KVM_GET_ONE_REG(r14, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013c807, &(0x7f0000000280)=0x1})
ioctl$KVM_SET_REGS(r6, 0x4360ae82, &(0x7f0000000100)={[0x6, 0x7, 0x4, 0xffffffffffffffff, 0xff, 0x10001, 0x4, 0x0, 0x7fffffffffffffff, 0xfffffffffffffff2, 0x8000, 0x9, 0x1, 0x5, 0x200, 0x7], 0x4000, 0x40001})
ioctl$KVM_RUN(r7, 0xae80, 0x0)
ioctl$KVM_GET_VCPU_EVENTS(0xffffffffffffffff, 0x8040ae9f, &(0x7f00000001c0)=@arm64)

40m31.895860191s ago: executing program 0 (id=246):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000007, 0x4f833, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000800000/0x800000)=nil, 0x800000)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000680)=[@its_setup={0x82, 0x28, {0x3, 0x0, 0x16f}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x2, 0x8, 0x8, 0x100}}], 0x50}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r1, 0x44, 0x220)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, <r4=>0xffffffffffffffff})
r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4040aea0, &(0x7f0000000240)=@arm64={0x5, 0xbf, 0x10, '\x00', 0x12000000})
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b656cf3f1, 0xffffffffffffffff, 0x20000000)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x10000, 0x3, 0x40000004}}], 0x50}, 0x0, 0x0)
ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_HAS_DEVICE_ATTR_vm(r1, 0x4018aee3, &(0x7f0000000040)=@attr_other={0x0, 0x6, 0x8, &(0x7f0000000000)=0x4})

40m31.789262716s ago: executing program 1 (id=247):
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
openat$kvm(0xffffffffffffff9c, 0x0, 0x181900, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x2, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x3, 0x10000, 0x0, 0x100, 0x2}}], 0x50}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r0, 0x1, 0x100)
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000180)={0x8})
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, 0x0, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000200)=@arm64_fw={0x6030000000140000, &(0x7f0000000240)=0x10001})
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d1, 0x110c230004)

40m20.434059908s ago: executing program 1 (id=248):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async)
r3 = eventfd2(0xfffffffa, 0x80001)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000080)={0x4, 0x80a0000, 0x4, r3}) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21)
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async, rerun: 64)
r5 = openat$kvm(0x0, &(0x7f0000000100), 0x80402, 0x0) (rerun: 64)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2c)
r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil)
r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async, rerun: 32)
r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (rerun: 32)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000000)={0x1ff, 0x1, 0x4000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0xdddd1000, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) (async, rerun: 64)
ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000040)=@arm64_sys={0x603000000013c021, &(0x7f0000000140)=0x9}) (rerun: 64)
r11 = eventfd2(0xffff10c0, 0x801) (async)
r12 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1d)
ioctl$KVM_IRQFD(r12, 0x4020ae76, &(0x7f0000000040)={r11, 0x6, 0x1, r11})
r13 = eventfd2(0x0, 0x0)
write$eventfd(r13, 0xffffffffffffffff, 0x0) (async)
ioctl$KVM_IOEVENTFD(r4, 0x4020ae46, &(0x7f00000000c0)={0x8001, 0xb000, 0x0, r11, 0x4})

40m19.502810473s ago: executing program 0 (id=249):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
r4 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r3, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r3, 0x0)
r5 = eventfd2(0x0, 0x0)
close(r5)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01)
write$eventfd(r5, &(0x7f0000000180)=0x5, 0xfffffde3)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0)
write$eventfd(r5, 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000)
munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000075a000/0xb000)=nil, 0xb000)
munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000e1d000/0x1000)=nil, 0x1000)
r6 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[@code={0xa, 0x9c, {"00809f0dc04790d20020b0f2810180d2a20180d2630180d2040180d2020000d4009692d20000b0f2a10080d2c20080d2830180d2a40180d2020000d4000028d5000c007c007008d5e08f98d20020b0f2010080d2e20180d2230180d2240180d2020000d4201596d200c0b8f2210180d2420180d2630080d2040180d2020000d40000008a008008d5"}}, @irq_setup={0x46, 0x18, {0x4, 0x58}}, @mrs={0xbe, 0x18, {0x603000000013deb7}}, @msr={0x14, 0x20, {0x603000000013dee8, 0x2}}, @memwrite={0x6e, 0x30, @generic={0xe6ef0000, 0xa69, 0xc, 0x6}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x18, 0x3, 0xa}}, @smc={0x1e, 0x40, {0x84000003, [0x4, 0x6, 0xfff, 0xeed, 0x4]}}, @uexit={0x0, 0x18, 0x1}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x1c00, 0x46, 0x4}}, @smc={0x1e, 0x40, {0x84000013, [0x8, 0xfffffffffffffffa, 0x8000, 0x8000, 0x2]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x4, 0x0, 0x4}}, @uexit={0x0, 0x18, 0x9}, @svc={0x122, 0x40, {0x84000050, [0x3, 0x9, 0x0, 0x7f, 0x43]}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x386}}, @eret={0xe6, 0x18, 0x7fff}, @irq_setup={0x46, 0x18, {0x2, 0x28a}}, @irq_setup={0x46, 0x18, {0x0, 0x377}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x0, 0x6, 0x1, 0x7, 0x1}}, @smc={0x1e, 0x40, {0x80000000, [0xc, 0x9, 0x6, 0x7, 0x6]}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x1, 0x2, 0x0, 0x2, 0x3, 0x3}}, @memwrite={0x6e, 0x30, @generic={0x9000, 0x247, 0x7, 0x6}}, @svc={0x122, 0x40, {0x84000000, [0xffffffffffffffff, 0x7, 0x5, 0x5, 0x4]}}, @hvc={0x32, 0x40, {0x86000001, [0x8, 0xfff, 0x0, 0x0, 0x3ff]}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x2, 0xb, 0x10001, 0x0, 0x2}}, @its_setup={0x82, 0x28, {0x0, 0x0, 0x80}}, @code={0xa, 0x9c, {"e0d792d20060b0f2610080d2820080d2c30080d2440180d2020000d40000c0ac60189dd20020b8f2210180d2020180d2230080d2440180d2020000d40004407c000008d5000028d5007008d5000028d5808d88d20080b0f2010180d2e20080d2630180d2e40180d2020000d4e0e589d20080b8f2810180d2420080d2830080d2440080d2020000d4"}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x0, 0x3, 0x4, 0xe387, 0x1}}, @uexit={0x0, 0x18, 0x7fff}], 0x578}, &(0x7f0000000040)=[@featur2={0x1, 0xa1}], 0x1)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, r6, 0x0)
munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000)
mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000800000/0x800000)=nil, 0x800000)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)

40m8.553092727s ago: executing program 1 (id=250):
mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2e)
ioctl$KVM_CAP_DIRTY_LOG_RING(r0, 0x4068aea3, &(0x7f00000001c0)={0xc0, 0x0, 0xc000})
r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f0000000000))
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x6030000000100014, &(0x7f00000000c0)=0x7ff})
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2)
r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000a5a000/0x400000)=nil)
r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000b80)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000012, [0xffffffff, 0x100080001, 0x5, 0x101, 0x13]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r10, 0xae80, 0x0)
ioctl$KVM_KVMCLOCK_CTRL(r6, 0xaead)
r11 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r11, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)

40m2.715018772s ago: executing program 0 (id=251):
r0 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r0, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000000)=0x7f})
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0x50fa, 0x8})
r2 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x3000)=nil, 0x0, 0x1000000, 0x4010, r0, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000000c0)="f482f94ed36a71eb5e5245f883eb0e416f2f6e8cddd9f7c1178833aa8c4180e6a44e8ca17c2d6b3cc8c6503a7c2d577352d0ede0160b3c51af986c325653ca5f59e8e0289a05780d", 0x0, 0x48)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r3, 0x3000004, 0x110, r1, 0x0)
ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f0000000140))
r4 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f0000000180)={0xa, [0x7ff, 0x2, 0x8000000000000001, 0x8000, 0x800, 0x7, 0x0, 0x7fff, 0x3, 0x7]})
eventfd2(0x9, 0x80801)
ioctl$KVM_GET_VCPU_EVENTS(r0, 0x8040ae9f, &(0x7f0000000200))
ioctl$KVM_RUN(r0, 0xae80, 0x0)
r5 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000280)=@riscv64_sbi_fwft={0x803000000a010000, &(0x7f0000000240)=0x2})
r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f00000002c0)={0x7, <r7=>0xffffffffffffffff, 0x1})
ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000340)=@riscv64_v={0x8030000009000004, &(0x7f0000000300)=0x2})
munmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000380)={0x1, 0xffffffffffffffff, 0x1})
r8 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000bff000/0x400000)=nil)
ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f00000003c0)={0x1ff, 0x22346fff, 0x0, r6, 0xa})
ioctl$KVM_INTERRUPT(r0, 0x4004ae86, &(0x7f0000000400)=0x2)
ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f0000000480)=@attr_arm64={0x0, 0x5, 0x0, &(0x7f0000000440)=0x2})
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000680)={0x0, &(0x7f00000004c0)=[@svc={0x122, 0x40, {0x84000006, [0xfffffffffffffff4, 0xda6, 0x972, 0x3, 0x4]}}, @its_setup={0x82, 0x28, {0x2, 0x0, 0x31d}}, @msr={0x14, 0x20, {0x603000000013debc, 0x5}}, @smc={0x1e, 0x40, {0xc4000011, [0x4424, 0x10000, 0x9, 0x40, 0x81]}}, @msr={0x14, 0x20, {0x603000000013e289, 0x4f86cf95}}, @uexit={0x0, 0x18, 0x5e}, @mrs={0xbe, 0x18, {0x6030000000138034}}, @irq_setup={0x46, 0x18, {0x1, 0x372}}, @irq_setup={0x46, 0x18, {0x0, 0x394}}, @hvc={0x32, 0x40, {0x84000051, [0xfffffffffffffff9, 0x9, 0x9, 0x4, 0x10000]}}], 0x188}, &(0x7f00000006c0)=[@featur1={0x1, 0x21}], 0x1)
ioctl$KVM_SET_REGS(r9, 0x4360ae82, &(0x7f0000000700)={[0xe, 0x5, 0x4, 0x0, 0x40, 0x4, 0x100000001, 0x7b6, 0x2, 0x1, 0x4, 0x2, 0x9, 0x1, 0x1, 0xffffffffffff66ac], 0x60000})
ioctl$KVM_GET_ONE_REG(r4, 0x4010aeab, &(0x7f0000000800)=@arm64_bitmap={0x6030000000160000, &(0x7f00000007c0)=0x97b})
ioctl$KVM_SIGNAL_MSI(r6, 0x4020aea5, &(0x7f0000000840)={0x2, 0x1000, 0xfffffff6, 0x0, 0x7})

39m58.053809881s ago: executing program 1 (id=252):
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
openat$kvm(0xffffffffffffff9c, 0x0, 0x181900, 0x0)
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r1 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x2, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x3, 0x10000, 0x0, 0x100, 0x2}}], 0x50}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r0, 0x1, 0x100)
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000180)={0x8})
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000280)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, 0x0)
r6 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d1, 0x110c230004)

39m57.735322576s ago: executing program 0 (id=253):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000040)={0x7, <r3=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r3, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x3, 0x0})
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000eed000/0x4000)=nil, 0x4000)
r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, r5, 0x2000003, 0x80b1, r6, 0x0)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r8, 0x100000d, 0x32, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000140)={0x4, <r11=>0xffffffffffffffff})
close(r11)
mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)

39m49.214985194s ago: executing program 1 (id=254):
ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f00000001c0)={0x1, 0x0, [{0x101, 0x1, 0x1, 0x0, @msi={0x3, 0xfffffeff, 0x28a, 0x3}}]})
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x39)
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000040)={0x6, 0xffffffffffffffff, 0x1}) (async)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) (async)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1})
r3 = eventfd2(0x8, 0x80800)
write$eventfd(r3, &(0x7f0000000000)=0x7fffdff, 0x8)

39m47.020646782s ago: executing program 0 (id=255):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x400000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xae)
r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x33)
r6 = syz_kvm_vgic_v3_setup(r5, 0x1, 0x100)
r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x14)
syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000bff000/0x400000)=nil)
ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x1, 0x84, &(0x7f0000000080)=0xfffffffffffffff7})
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, <r8=>0xffffffffffffffff})
r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
ioctl$KVM_CAP_DIRTY_LOG_RING(r10, 0x4068aea3, &(0x7f0000000500))
ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x4})

39m43.00021858s ago: executing program 1 (id=256):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x300, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x4000)=nil, 0x930, 0x3, 0x13, 0xffffffffffffffff, 0x0)
openat$kvm(0x0, &(0x7f0000000040), 0x22200, 0x0)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04)
r4 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, r3, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04)
mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, r6, 0x3000002, 0x8a031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
ioctl$KVM_CHECK_EXTENSION(r1, 0x4020940d, 0x20)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000100)={0x8, <r9=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x8, 0x2, &(0x7f0000000180)=0x100000001})
r10 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000100)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r12, 0x4010aeab, &(0x7f00000000c0)=@arm64_bitmap={0x6030000000160000, &(0x7f0000000180)=0x2})
ioctl$KVM_SET_ONE_REG(r12, 0x4010aeac, &(0x7f00000001c0)=@riscv64_sbi_fwft={0x803000000a010000, &(0x7f0000000140)=0x2036})

39m0.233263378s ago: executing program 32 (id=255):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x400000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xae)
r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0)
r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x33)
r6 = syz_kvm_vgic_v3_setup(r5, 0x1, 0x100)
r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x14)
syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000bff000/0x400000)=nil)
ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x1, 0x84, &(0x7f0000000080)=0xfffffffffffffff7})
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, <r8=>0xffffffffffffffff})
r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
ioctl$KVM_CAP_DIRTY_LOG_RING(r10, 0x4068aea3, &(0x7f0000000500))
ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x4})

38m55.98341775s ago: executing program 33 (id=256):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x300, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x4000)=nil, 0x930, 0x3, 0x13, 0xffffffffffffffff, 0x0)
openat$kvm(0x0, &(0x7f0000000040), 0x22200, 0x0)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04)
r4 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, r3, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04)
mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, r6, 0x3000002, 0x8a031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
ioctl$KVM_CHECK_EXTENSION(r1, 0x4020940d, 0x20)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f0000000100)={0x8, <r9=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x8, 0x2, &(0x7f0000000180)=0x100000001})
r10 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000100)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r12, 0x4010aeab, &(0x7f00000000c0)=@arm64_bitmap={0x6030000000160000, &(0x7f0000000180)=0x2})
ioctl$KVM_SET_ONE_REG(r12, 0x4010aeac, &(0x7f00000001c0)=@riscv64_sbi_fwft={0x803000000a010000, &(0x7f0000000140)=0x2036})

27m16.113858228s ago: executing program 2 (id=301):
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2)
r4 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r3, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x930, 0x1, 0x13, r3, 0x0)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r5, 0x80086601, 0x20000000)
r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
r8 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r7, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r7, 0x0)
r9 = eventfd2(0x0, 0x0)
close(r9)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01)
write$eventfd(r9, &(0x7f0000000180)=0x5, 0xfffffde3)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0)
write$eventfd(r9, 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)

27m1.755395256s ago: executing program 2 (id=303):
r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) (async)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x28)
ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r5, 0x4068aea3, &(0x7f0000000280)={0xdf, 0x0, 0x2000})
ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f00000001c0)={0x10003, 0x0, &(0x7f0000c82000/0x4000)=nil}) (async)
r6 = eventfd2(0xd, 0x1)
close(r6) (async)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) (async)
write$eventfd(r6, 0x0, 0x500) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) (async)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0xe0000, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=[@featur1={0x1, 0xa1}], 0x1)
syz_kvm_add_vcpu$arm64(r9, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=[@featur1={0x1, 0x4}], 0x1)
r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000003, [0x5, 0x100000003, 0x5, 0x101, 0x3]}}], 0x40}, &(0x7f0000000080)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r10, 0xae80, 0x0)

26m53.940079006s ago: executing program 3 (id=304):
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x16)
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000000)={0x9})
r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2)
ioctl$KVM_ARM_VCPU_INIT(r1, 0x4020aeae, &(0x7f0000000040)={0x2, 0x12})
r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1a)
r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000bff000/0x400000)=nil)
ioctl$KVM_CAP_DIRTY_LOG_RING(r0, 0x4068aea3, &(0x7f0000000080)={0xc0, 0x0, 0x12000})
ioctl$KVM_GET_DEVICE_ATTR_vcpu(r1, 0x4018aee2, &(0x7f0000000100)=@attr_pvtime_ipa={0x0, 0x2, 0x0, 0x2})
ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000140)={0x5, 0xffffffffffffffff, 0x1})
munmap(&(0x7f0000f8b000/0x2000)=nil, 0x2000)
r4 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1)
ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000180)={0x4, 0x7000})
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r1, 0x4018aee3, &(0x7f0000000200)=@attr_other={0x0, 0x7ff, 0x5b, &(0x7f00000001c0)=0x3})
ioctl$KVM_ARM_VCPU_FINALIZE(r4, 0x4004aec2, &(0x7f0000000240)=0x5)
ioctl$KVM_CHECK_EXTENSION_VM(r2, 0xae03, 0xe0000000000000)
r5 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
ioctl$KVM_ARM_PREFERRED_TARGET(r6, 0x8020aeaf, &(0x7f0000000280))
r7 = ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece)
ioctl$KVM_IRQ_LINE(r7, 0x4008ae61, &(0x7f00000002c0)={0x60, 0x81})
ioctl$KVM_ARM_VCPU_FINALIZE(r5, 0x4004aec2, &(0x7f0000000300)=0x6)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000340)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000003c0)=@attr_other={0x0, 0x200, 0x5d8d, &(0x7f0000000380)})
ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x2, 0x2, 0xb000, 0x1000, &(0x7f0000e2f000/0x1000)=nil})
ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000440)={0xdddd1000, 0x102000, 0x1})
ioctl$KVM_CAP_ARM_INJECT_SERROR_ESR(r2, 0x4068aea3, &(0x7f0000000480))
r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04)
r10 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000c40)={0x0, &(0x7f0000000500)=[@irq_setup={0x46, 0x18, {0x0, 0x93}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x8000, 0x3, 0xa}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x1, 0x3, 0x5, 0x0, 0x8, 0x4}}, @smc={0x1e, 0x40, {0x1000000, [0xfe1, 0xba64, 0x8000000000000001, 0x0, 0x7d6]}}, @hvc={0x32, 0x40, {0x1000000, [0x6, 0x7, 0x3, 0x6, 0x7]}}, @mrs={0xbe, 0x18, {0x603000000013def7}}, @code={0xa, 0xcc, {"401a9dd20060b0f2410080d2220080d2430080d2440080d2020000d40030000f1f0000ea000008d5408784d200c0b8f2610180d2a20080d2a30180d2040180d2020000d420629dd200a0b8f2410080d2c20080d2230080d2840180d2020000d4c0be8ed20080b0f2210080d2c20180d2e30080d2840080d2020000d40090802f009285d20000b8f2410080d2a20080d2230080d2840080d2020000d4c09b89d20080b0f2810080d2620080d2430080d2840080d2020000d4"}}, @its_setup={0x82, 0x28, {0x3, 0x3, 0xd6}}, @mrs={0xbe, 0x18, {0x603000000013df06}}, @code={0xa, 0x6c, {"40e580d20000b8f2c10180d2220080d2a30080d2040080d2020000d400a4200d008008d5a00b83d20060b8f2e10180d2820180d2a30080d2240180d2020000d4020000d41f0000310070c00c000008d5007008d500a8215e"}}, @code={0xa, 0x84, {"00c0e21e0020005e601690d200c0b0f2e10080d2e20080d2230180d2a40180d2020000d4007008d540d79dd20080b0f2410180d2820180d2830080d2240080d2020000d40048c01a008008d5007c202ec0a88bd200e0b0f2010080d2620180d2030080d2240080d2020000d4007008d5"}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x2, 0x7, 0x10, 0x6, 0x4}}, @memwrite={0x6e, 0x30, @generic={0xb000, 0x1aa, 0x1, 0x8}}, @smc={0x1e, 0x40, {0x2ddad74fc5bf9d60, [0xffffffff, 0xffff, 0x2e, 0x100000000, 0xb976]}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x1, 0x2, 0x2, 0x66, 0x1}}, @code={0xa, 0xcc, {"0074000f00c8a10ea0b696d20020b0f2c10180d2a20080d2230180d2640180d2020000d440828ad20000b8f2010180d2020080d2c30180d2040180d2020000d4604d82d20020b0f2e10180d2220080d2630080d2e40180d2020000d440008fd20060b0f2e10180d2020180d2430180d2a40080d2020000d400cf87d20000b0f2a10080d2a20180d2a30180d2e40180d2020000d400a4006f00a0400c605c9cd200a0b0f2610080d2020180d2230080d2240180d2020000d4"}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x1c0, 0x0, 0x9}}, @svc={0x122, 0x40, {0x40008029, [0x71, 0x5, 0x1, 0x3d, 0x40000000000000]}}, @eret={0xe6, 0x18, 0x8}, @msr={0x14, 0x20, {0x0, 0x3b68}}, @msr={0x14, 0x20, {0x603000000013c00f, 0x3ff}}, @its_setup={0x82, 0x28, {0x0, 0x8000000000000000, 0x177}}, @svc={0x122, 0x40, {0x0, [0x3, 0xffffffffffff04dd, 0x7, 0x7fffffffffffffff, 0x96be]}}, @uexit={0x0, 0x18, 0xc5f}, @its_send_cmd={0xaa, 0x28, {0xd, 0x1, 0x4, 0x5, 0x0, 0x7, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x4, 0x0, 0x6, 0x3, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x80, 0x9ef7, 0x8}}, @smc={0x1e, 0x40, {0xb300000d, [0x47a, 0x2, 0xf, 0x672, 0x7]}}, @msr={0x14, 0x20, {0x603000000013804d, 0x81}}, @svc={0x122, 0x40, {0x84000003, [0x7, 0xd0e9, 0x5e2a, 0x1000000000000000, 0x8]}}, @memwrite={0x6e, 0x30, @generic={0x40000, 0xa5c, 0x32, 0xc}}, @irq_setup={0x46, 0x18, {0x2, 0x303}}], 0x740}, &(0x7f0000000c80)=[@featur1={0x1, 0x40}], 0x1)
mmap$KVM_VCPU(&(0x7f0000ced000/0x3000)=nil, r9, 0x4, 0x110, r10, 0x0)
ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000cc0)={0x1000, 0x1})

26m50.185240772s ago: executing program 2 (id=305):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x181900, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000140)={0x4, <r4=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r4, 0x400454ce, 0x7fffffffffffffff)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000001c0)="f21bc75509bf71c9d70236fc044842567fec4d8dbb02aa8b7d52f1a16a2c00000000000000000000000000000000008f64000200", 0x0, 0x48)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, <r5=>0xffffffffffffffff, 0x1})
write$eventfd(r5, &(0x7f00000001c0)=0xffffff7f, 0xff25)

26m45.727069897s ago: executing program 3 (id=306):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2)
r3 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r2, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48)
r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0)
r7 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r6, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r6, 0x0)
r8 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0)
r9 = eventfd2(0x0, 0x80000)
r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil)
r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000200)={0x0, &(0x7f0000000500)=[@mrs={0xbe, 0x18, {0x6030000000138056}}], 0x18}, 0x0, 0x0)
ioctl$KVM_RUN(r13, 0xae80, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r13, 0x4040aea0, &(0x7f0000000000)=@x86={0x7, 0x4, 0x4, 0x0, 0x8, 0x3, 0x34, 0xa, 0xfa, 0x8, 0x7, 0xfb, 0x0, 0x4, 0xb, 0x9, 0x8, 0xba, 0xd2, '\x00', 0x7, 0x6})
ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18})
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, 0x930, 0x0, 0x110, r9, 0x0)
ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x1, 0xffffffffffffffff, 0x3})
ioctl$KVM_CREATE_VM(r8, 0x401c5820, 0x20000001)
ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000280)=@other={0x1, &(0x7f0000000180)=0x8})
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r2, 0x0)
syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000000)={0x0, &(0x7f0000000cc0)=[@irq_setup={0x46, 0x18, {0x4, 0xce}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x280, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x10, 0x4, 0xf}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x14}}, @irq_setup={0x46, 0x18, {0x2, 0x10b}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x3, 0xc, 0xd, 0x6}}, @code={0xa, 0x6c, {"c05c88d20020b8f2610080d2220180d2830180d2c40180d2020000d4e00300cb00002088a08089d200c0b0f2810080d2a20080d2a30080d2440080d2020000d400a0a00d000008d5007008d5007008d50068210e007c209b"}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x4, 0xc, 0x7, 0xca5}}, @uexit={0x0, 0x18, 0x2}, @its_setup={0x82, 0x28, {0x3, 0x2, 0x168}}, @uexit={0x0, 0x18, 0x800}, @svc={0x122, 0x40, {0x84000013, [0xffffffffffffffff, 0x84, 0x2, 0x7fffffffffffffff, 0x4]}}, @mrs={0xbe, 0x18, {0x603000000013c4ca}}, @code={0xa, 0x9c, {"800a97d20000b8f2810080d2820080d2e30080d2640080d2020000d4000c40f8000028d5e07d85d20000b0f2e10080d2e20080d2430080d2640080d2020000d4000860f8000008d540cc98d20020b0f2c10180d2220080d2e30180d2a40180d2020000d4000008d5007008d5406095d200e0b8f2a10080d2020180d2030180d2240180d2020000d4"}}, @irq_setup={0x46, 0x18, {0x3, 0x17b}}, @mrs={0xbe, 0x18, {0x603000000013e6c0}}, @mrs={0xbe, 0x18, {0x603000000013801a}}, @uexit={0x0, 0x18, 0x200}, @its_setup={0x82, 0x28, {0x2, 0x3, 0x172}}, @hvc={0x32, 0x40, {0xc400000c, [0x7ff, 0xffffffffffff0001, 0x7ff, 0x1, 0x6]}}, @svc={0x122, 0x40, {0x84000014, [0x1, 0xfffffffffffffffd, 0xb92f, 0x8001, 0xff]}}, @its_setup={0x82, 0x28, {0x1, 0x2, 0x177}}, @irq_setup={0x46, 0x18, {0x3, 0x95}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x80, 0x4, 0x9}}, @hvc={0x32, 0x40, {0x84000011, [0x0, 0x7fff, 0x577, 0x9, 0x8]}}], 0x478}, &(0x7f0000000080)=[@featur2={0x1, 0x7}], 0x1)
syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000700)=[@uexit={0x0, 0x18, 0x9}, @smc={0x1e, 0x40, {0x3f000000, [0x3, 0x1, 0x6, 0x3, 0x5d5]}}, @mrs={0xbe, 0x18, {0x603000000013e706}}, @mrs={0xbe, 0x18, {0x603000000013e722}}, @mrs={0xbe, 0x18, {0x20b9}}, @eret={0xe6, 0x18, 0xfffffffffffffffa}, @msr={0x14, 0x20, {0x603000000013dee7, 0x1}}, @smc={0x1e, 0x40, {0x4000079, [0xffff, 0x42, 0xfffffffffffffeff, 0x80000000, 0xffffffff]}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x31b}}, @its_setup={0x82, 0x28, {0x8, 0x4, 0x2e2}}, @uexit={0x0, 0x18, 0x80000001}, @code={0xa, 0xcc, {"20df98d200c0b0f2210080d2820080d2830080d2640180d2020000d40078214e208b9bd200a0b8f2810180d2e20080d2a30080d2e40080d2020000d4e0b482d20040b0f2c10080d2220080d2630180d2040180d2020000d4000840fa606494d200e0b8f2a10080d2a20180d2630080d2040180d2020000d40070206e000008d5606796d200c0b8f2610180d2e20180d2830080d2c40080d2020000d4006986d20000b8f2610180d2820080d2030080d2440180d2020000d4"}}, @hvc={0x32, 0x40, {0xc4000003, [0x80000000, 0xf1, 0x4, 0x6, 0x9]}}, @uexit={0x0, 0x18, 0x8}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x6e}}, @uexit={0x0, 0x18, 0x2}, @eret={0xe6, 0x18, 0x2}, @smc={0x1e, 0x40, {0x80000000, [0x4, 0x261, 0x3, 0x9, 0x1]}}, @uexit={0x0, 0x18, 0xf5e}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x2, 0xd, 0xfffffff8, 0x3, 0x4}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x0, 0x3, 0x6, 0x1, 0x1}}, @uexit={0x0, 0x18, 0x1}, @uexit={0x0, 0x18, 0x2}, @its_send_cmd={0xaa, 0x28, {0x11, 0x0, 0x2, 0xc, 0x3e8, 0x5, 0x2}}, @smc={0x1e, 0x40, {0x1000000, [0x800, 0xf47, 0x3, 0x3, 0x4]}}, @smc={0x1e, 0x40, {0x84000053, [0x0, 0xff, 0xb]}}, @mrs={0xbe, 0x18, {0x603000000013def7}}, @code={0xa, 0x9c, {"0000c00c00a8a12e000028d520f793d20040b8f2c10180d2820080d2030180d2440080d2020000d4007008d5a03981d20000b0f2410180d2220180d2830080d2640080d2020000d400a8a15e007008d560e995d200c0b0f2210180d2620080d2830080d2640180d2020000d400258fd20040b8f2810080d2e20080d2230180d2c40080d2020000d4"}}, @irq_setup={0x46, 0x18, {0x1, 0x223}}, @eret={0xe6, 0x18, 0x3}], 0x560}, &(0x7f0000000140)=[@featur2={0x1, 0x5}], 0x1)

26m37.6666517s ago: executing program 2 (id=307):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_vgic_v3_setup(r1, 0xa00000001, 0x320)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1)
r5 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000080)={0xfffffffffffffffa, 0x2, 0x4, 0xffffffffffffffff, 0x8a4fa382f1515d0b})
r7 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
r10 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f00000001c0)={0x8, <r12=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000380)})
ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f00000000c0)={0x5, 0x1, 0x0, 0x1000, &(0x7f0000000000/0x1000)=nil})
ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000002c0)=@attr_other={0x0, 0x8, 0x108, &(0x7f0000000000)=0xc000000000000000})
ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x4, 0x2, 0x0})
ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil)
mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000000)={0x10201, 0x2, 0x1, 0x2000, &(0x7f0000f31000/0x2000)=nil})
r13 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil)
r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_RUN(r15, 0xae80, 0x0)
ioctl$KVM_GET_ONE_REG(r15, 0x4010aeab, &(0x7f0000000040)=@arm64_extra={0x603000000013c036, &(0x7f0000000100)=0x78b})
ioctl$KVM_SET_GUEST_DEBUG_arm64(r4, 0x4208ae9b, 0x0)

26m22.58564957s ago: executing program 3 (id=308):
r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5)
r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r3, 0x2, 0x12, r2, 0x0)
mmap$KVM_VCPU(&(0x7f0000010000/0x4000)=nil, r3, 0x100000a, 0x12, r2, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
mmap$KVM_VCPU(&(0x7f0000cba000/0x4000)=nil, r3, 0x0, 0x20010, r4, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x0)

25m57.057158176s ago: executing program 3 (id=309):
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013c000, 0x8000}}, @msr={0x14, 0x20, {0x603000000013809c, 0x8000}}, @mrs={0xbe, 0x18, {0x603000000013dce6}}], 0x58}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

25m53.265429185s ago: executing program 2 (id=310):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1)
r5 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r4, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fb707cd24b7eebb20700000000000000000000000100", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x3e)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0)
r10 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000)
ioctl$KVM_IRQ_LINE_STATUS(r11, 0xc008ae67, 0x0)
r12 = ioctl$KVM_CREATE_GUEST_MEMFD(r9, 0xc040aed4, &(0x7f0000000040)={0x1000200001fe0000, 0x1})
ioctl$KVM_SET_USER_MEMORY_REGION2(r9, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0x2000, &(0x7f0000ffc000/0x2000)=nil, 0x100000000000000, r12})
close(r12)
ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f0000000100)={0x26eb, 0x7, 0x80a0000, 0x1000, &(0x7f0000e8f000/0x1000)=nil, 0x65, r12})
ioctl$KVM_CREATE_VM(r6, 0x40305839, 0x19)
r13 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r1, r13, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r13, 0x4010aeac, &(0x7f00000002c0)=@arm64_sys={0x603000000013df11, &(0x7f0000000280)=0x3})
ioctl$KVM_RUN(r13, 0xae80, 0x0)

25m46.09190114s ago: executing program 3 (id=311):
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xd7, 0x80000001}) (async)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r2 = eventfd2(0x10000, 0x1)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x7fffffffffffffff, 0xdddd0000, 0x0, r2, 0x2})
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x8, <r3=>0xffffffffffffffff, 0x1})
mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x13, r3, 0x0)

25m41.19388789s ago: executing program 2 (id=312):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r4, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
r6 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = eventfd2(0x8, 0x80800)
ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x1, r9, 0x3})
ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000000)=@arm64_sys={0xf0780000002e2172, 0x0})
ioctl$KVM_CREATE_VM(r6, 0x401c5820, 0x20000001)
r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r1, r10, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100042, &(0x7f0000000000)=0x17})

25m36.880770048s ago: executing program 3 (id=313):
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x30)
r1 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece)
ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f0000000000)={0x1, 0xc}) (async)
ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f0000000000)={0x1, 0xc})
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000040)={0x3000, 0x15000}) (async)
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000040)={0x3000, 0x15000})
ioctl$KVM_CAP_ARM_INJECT_SERROR_ESR(r0, 0x4068aea3, &(0x7f0000000080))
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) (async)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34)
ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000100)=0xfffffffb)
ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000140)={0x2, 0x4}) (async)
ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000140)={0x2, 0x4})
r3 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece)
syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfd000/0x400000)=nil)
r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1)
ioctl$KVM_IRQ_LINE(r4, 0x4008ae61, &(0x7f0000000180)={0xffff7fff, 0x2})
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3b) (async)
r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3b)
ioctl$KVM_IRQ_LINE(r5, 0x4008ae61, &(0x7f00000001c0)={0x200, 0xb}) (async)
ioctl$KVM_IRQ_LINE(r5, 0x4008ae61, &(0x7f00000001c0)={0x200, 0xb})
r6 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x102, 0x0)
ioctl$KVM_CAP_ARM_USER_IRQ(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240))
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000002c0)={0x3, 0x1})
ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000300)={0x7, 0x0, [{0x6, 0x1, 0x1, 0x0, @sint={0x3, 0x9}}, {0x8, 0x6, 0x1, 0x0, @sint={0x40, 0xa9}}, {0x380000, 0x5, 0x1, 0x0, @adapter={0x6, 0x37, 0x2, 0x8, 0xcf}}, {0x2, 0x1, 0x2, 0x0, @msi={0x4a6, 0xd, 0x7}}, {0x3, 0x4, 0x1, 0x0, @irqchip={0x5, 0x8}}, {0x3, 0x1, 0x0, 0x0, @sint={0x6555, 0x2}}, {0x9, 0x5, 0x0, 0x0, @sint={0x7, 0x3}}]})
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f00000004c0)=@riscv64_core={0x8030000000200020, &(0x7f0000000480)=0x4})
ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f0000000500)={0x10001, 0x0, &(0x7f0000fe9000/0x4000)=nil})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000540)={0xffff1000, 0x8000})
ioctl$KVM_ARM_SET_COUNTER_OFFSET(r0, 0x4010aeb5, &(0x7f0000000580)={0x52, 0x7}) (async)
ioctl$KVM_ARM_SET_COUNTER_OFFSET(r0, 0x4010aeb5, &(0x7f0000000580)={0x52, 0x7})
ioctl$KVM_CAP_ARM_SYSTEM_SUSPEND(0xffffffffffffffff, 0x4068aea3, &(0x7f00000005c0))
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x32) (async)
r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x32)
syz_kvm_setup_cpu$arm64(r9, r3, &(0x7f0000bfd000/0x400000)=nil, &(0x7f0000000a40)=[{0x0, &(0x7f0000000640)=[@irq_setup={0x46, 0x18, {0x1, 0xed}}, @uexit={0x0, 0x18, 0x517}, @mrs={0xbe, 0x18, {0x603000000013df6d}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x1, 0x7, 0x401, 0x7fff, 0x3}}, @hvc={0x32, 0x40, {0xc4000012, [0x7, 0x8, 0x1f0, 0xfffffffffffffffe]}}, @irq_setup={0x46, 0x18, {0x4, 0x185}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x63}}, @msr={0x14, 0x20, {0x603000000013c016, 0x5}}, @smc={0x1e, 0x40, {0x84000003, [0x1, 0xffffffffffffffff, 0x0, 0x8000, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x1, 0x7, 0x4a, 0x2, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c65f}}, @eret={0xe6, 0x18, 0xf2e1}, @hvc={0x32, 0x40, {0x4, [0x825, 0x80, 0x200, 0xfffffffffffff527]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0x9, 0x7fffffffffffffff, 0x81, 0xb5a]}}, @uexit={0x0, 0x18, 0x7f}, @uexit={0x0, 0x18, 0xd1fc}, @code={0xa, 0x84, {"0000c03d00c0221e80e69ad200c0b8f2010080d2020080d2a30180d2840180d2020000d4406e8bd200e0b0f2810080d2220180d2830180d2640080d2020000d4000028d50000389e0000403900d4200e000c8bd20080b8f2610080d2820080d2430080d2040080d2020000d4007008d5"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x2ae}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x5, 0x9, 0x0, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xc0, 0x4, 0x2}}, @code={0xa, 0x84, {"803490d20020b8f2410080d2620180d2e30080d2040180d2020000d40004803c000028d5003c000e007008d5007c9bd20000b8f2e10180d2e20080d2830180d2240080d2020000d4000008d500b0005f608584d20020b8f2810080d2e20180d2230080d2240180d2020000d4007008d5"}}], 0x3e0}], 0x1, 0x0, &(0x7f0000000a80)=[@featur2={0x1, 0x2c}], 0x1) (async)
syz_kvm_setup_cpu$arm64(r9, r3, &(0x7f0000bfd000/0x400000)=nil, &(0x7f0000000a40)=[{0x0, &(0x7f0000000640)=[@irq_setup={0x46, 0x18, {0x1, 0xed}}, @uexit={0x0, 0x18, 0x517}, @mrs={0xbe, 0x18, {0x603000000013df6d}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x1, 0x7, 0x401, 0x7fff, 0x3}}, @hvc={0x32, 0x40, {0xc4000012, [0x7, 0x8, 0x1f0, 0xfffffffffffffffe]}}, @irq_setup={0x46, 0x18, {0x4, 0x185}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x63}}, @msr={0x14, 0x20, {0x603000000013c016, 0x5}}, @smc={0x1e, 0x40, {0x84000003, [0x1, 0xffffffffffffffff, 0x0, 0x8000, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x1, 0x7, 0x4a, 0x2, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c65f}}, @eret={0xe6, 0x18, 0xf2e1}, @hvc={0x32, 0x40, {0x4, [0x825, 0x80, 0x200, 0xfffffffffffff527]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0x9, 0x7fffffffffffffff, 0x81, 0xb5a]}}, @uexit={0x0, 0x18, 0x7f}, @uexit={0x0, 0x18, 0xd1fc}, @code={0xa, 0x84, {"0000c03d00c0221e80e69ad200c0b8f2010080d2020080d2a30180d2840180d2020000d4406e8bd200e0b0f2810080d2220180d2830180d2640080d2020000d4000028d50000389e0000403900d4200e000c8bd20080b8f2610080d2820080d2430080d2040080d2020000d4007008d5"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x2ae}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x5, 0x9, 0x0, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xc0, 0x4, 0x2}}, @code={0xa, 0x84, {"803490d20020b8f2410080d2620180d2e30080d2040180d2020000d40004803c000028d5003c000e007008d5007c9bd20000b8f2e10180d2e20080d2830180d2240080d2020000d4000008d500b0005f608584d20020b8f2810080d2e20180d2230080d2240180d2020000d4007008d5"}}], 0x3e0}], 0x1, 0x0, &(0x7f0000000a80)=[@featur2={0x1, 0x2c}], 0x1)
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000b00)=@riscv64_sbi_sta={0x803000000a000001, &(0x7f0000000ac0)=0xb}) (async)
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000b00)=@riscv64_sbi_sta={0x803000000a000001, &(0x7f0000000ac0)=0xb})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x100, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION2(r9, 0x40a0ae49, &(0x7f0000000b80)={0x4, 0x2, 0xeeef0000, 0x2000, &(0x7f0000d89000/0x2000)=nil, 0x2, r8})

24m55.031870879s ago: executing program 34 (id=312):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r4, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
r6 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
r9 = eventfd2(0x8, 0x80800)
ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x1, r9, 0x3})
ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000000)=@arm64_sys={0xf0780000002e2172, 0x0})
ioctl$KVM_CREATE_VM(r6, 0x401c5820, 0x20000001)
r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r1, r10, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100042, &(0x7f0000000000)=0x17})

24m48.993877133s ago: executing program 35 (id=313):
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x30)
r1 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece)
ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f0000000000)={0x1, 0xc}) (async)
ioctl$KVM_IRQ_LINE_STATUS(r0, 0xc008ae67, &(0x7f0000000000)={0x1, 0xc})
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000040)={0x3000, 0x15000}) (async)
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r0, 0x4010ae68, &(0x7f0000000040)={0x3000, 0x15000})
ioctl$KVM_CAP_ARM_INJECT_SERROR_ESR(r0, 0x4068aea3, &(0x7f0000000080))
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34) (async)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x34)
ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000100)=0xfffffffb)
ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000140)={0x2, 0x4}) (async)
ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000140)={0x2, 0x4})
r3 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece)
syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfd000/0x400000)=nil)
r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1)
ioctl$KVM_IRQ_LINE(r4, 0x4008ae61, &(0x7f0000000180)={0xffff7fff, 0x2})
ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3b) (async)
r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3b)
ioctl$KVM_IRQ_LINE(r5, 0x4008ae61, &(0x7f00000001c0)={0x200, 0xb}) (async)
ioctl$KVM_IRQ_LINE(r5, 0x4008ae61, &(0x7f00000001c0)={0x200, 0xb})
r6 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x102, 0x0)
ioctl$KVM_CAP_ARM_USER_IRQ(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000240))
r8 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000002c0)={0x3, 0x1})
ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000300)={0x7, 0x0, [{0x6, 0x1, 0x1, 0x0, @sint={0x3, 0x9}}, {0x8, 0x6, 0x1, 0x0, @sint={0x40, 0xa9}}, {0x380000, 0x5, 0x1, 0x0, @adapter={0x6, 0x37, 0x2, 0x8, 0xcf}}, {0x2, 0x1, 0x2, 0x0, @msi={0x4a6, 0xd, 0x7}}, {0x3, 0x4, 0x1, 0x0, @irqchip={0x5, 0x8}}, {0x3, 0x1, 0x0, 0x0, @sint={0x6555, 0x2}}, {0x9, 0x5, 0x0, 0x0, @sint={0x7, 0x3}}]})
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f00000004c0)=@riscv64_core={0x8030000000200020, &(0x7f0000000480)=0x4})
ioctl$KVM_GET_DIRTY_LOG(r5, 0x4010ae42, &(0x7f0000000500)={0x10001, 0x0, &(0x7f0000fe9000/0x4000)=nil})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, &(0x7f0000000540)={0xffff1000, 0x8000})
ioctl$KVM_ARM_SET_COUNTER_OFFSET(r0, 0x4010aeb5, &(0x7f0000000580)={0x52, 0x7}) (async)
ioctl$KVM_ARM_SET_COUNTER_OFFSET(r0, 0x4010aeb5, &(0x7f0000000580)={0x52, 0x7})
ioctl$KVM_CAP_ARM_SYSTEM_SUSPEND(0xffffffffffffffff, 0x4068aea3, &(0x7f00000005c0))
ioctl$KVM_CREATE_VM(r7, 0xae01, 0x32) (async)
r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x32)
syz_kvm_setup_cpu$arm64(r9, r3, &(0x7f0000bfd000/0x400000)=nil, &(0x7f0000000a40)=[{0x0, &(0x7f0000000640)=[@irq_setup={0x46, 0x18, {0x1, 0xed}}, @uexit={0x0, 0x18, 0x517}, @mrs={0xbe, 0x18, {0x603000000013df6d}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x1, 0x7, 0x401, 0x7fff, 0x3}}, @hvc={0x32, 0x40, {0xc4000012, [0x7, 0x8, 0x1f0, 0xfffffffffffffffe]}}, @irq_setup={0x46, 0x18, {0x4, 0x185}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x63}}, @msr={0x14, 0x20, {0x603000000013c016, 0x5}}, @smc={0x1e, 0x40, {0x84000003, [0x1, 0xffffffffffffffff, 0x0, 0x8000, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x1, 0x7, 0x4a, 0x2, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c65f}}, @eret={0xe6, 0x18, 0xf2e1}, @hvc={0x32, 0x40, {0x4, [0x825, 0x80, 0x200, 0xfffffffffffff527]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0x9, 0x7fffffffffffffff, 0x81, 0xb5a]}}, @uexit={0x0, 0x18, 0x7f}, @uexit={0x0, 0x18, 0xd1fc}, @code={0xa, 0x84, {"0000c03d00c0221e80e69ad200c0b8f2010080d2020080d2a30180d2840180d2020000d4406e8bd200e0b0f2810080d2220180d2830180d2640080d2020000d4000028d50000389e0000403900d4200e000c8bd20080b8f2610080d2820080d2430080d2040080d2020000d4007008d5"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x2ae}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x5, 0x9, 0x0, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xc0, 0x4, 0x2}}, @code={0xa, 0x84, {"803490d20020b8f2410080d2620180d2e30080d2040180d2020000d40004803c000028d5003c000e007008d5007c9bd20000b8f2e10180d2e20080d2830180d2240080d2020000d4000008d500b0005f608584d20020b8f2810080d2e20180d2230080d2240180d2020000d4007008d5"}}], 0x3e0}], 0x1, 0x0, &(0x7f0000000a80)=[@featur2={0x1, 0x2c}], 0x1) (async)
syz_kvm_setup_cpu$arm64(r9, r3, &(0x7f0000bfd000/0x400000)=nil, &(0x7f0000000a40)=[{0x0, &(0x7f0000000640)=[@irq_setup={0x46, 0x18, {0x1, 0xed}}, @uexit={0x0, 0x18, 0x517}, @mrs={0xbe, 0x18, {0x603000000013df6d}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x1, 0x7, 0x401, 0x7fff, 0x3}}, @hvc={0x32, 0x40, {0xc4000012, [0x7, 0x8, 0x1f0, 0xfffffffffffffffe]}}, @irq_setup={0x46, 0x18, {0x4, 0x185}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x63}}, @msr={0x14, 0x20, {0x603000000013c016, 0x5}}, @smc={0x1e, 0x40, {0x84000003, [0x1, 0xffffffffffffffff, 0x0, 0x8000, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x1, 0x7, 0x4a, 0x2, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c65f}}, @eret={0xe6, 0x18, 0xf2e1}, @hvc={0x32, 0x40, {0x4, [0x825, 0x80, 0x200, 0xfffffffffffff527]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0x9, 0x7fffffffffffffff, 0x81, 0xb5a]}}, @uexit={0x0, 0x18, 0x7f}, @uexit={0x0, 0x18, 0xd1fc}, @code={0xa, 0x84, {"0000c03d00c0221e80e69ad200c0b8f2010080d2020080d2a30180d2840180d2020000d4406e8bd200e0b0f2810080d2220180d2830180d2640080d2020000d4000028d50000389e0000403900d4200e000c8bd20080b8f2610080d2820080d2430080d2040080d2020000d4007008d5"}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x2ae}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x5, 0x9, 0x0, 0x3}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xc0, 0x4, 0x2}}, @code={0xa, 0x84, {"803490d20020b8f2410080d2620180d2e30080d2040180d2020000d40004803c000028d5003c000e007008d5007c9bd20000b8f2e10180d2e20080d2830180d2240080d2020000d4000008d500b0005f608584d20020b8f2810080d2e20180d2230080d2240180d2020000d4007008d5"}}], 0x3e0}], 0x1, 0x0, &(0x7f0000000a80)=[@featur2={0x1, 0x2c}], 0x1)
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000b00)=@riscv64_sbi_sta={0x803000000a000001, &(0x7f0000000ac0)=0xb}) (async)
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000b00)=@riscv64_sbi_sta={0x803000000a000001, &(0x7f0000000ac0)=0xb})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x100, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION2(r9, 0x40a0ae49, &(0x7f0000000b80)={0x4, 0x2, 0xeeef0000, 0x2000, &(0x7f0000d89000/0x2000)=nil, 0x2, r8})

14m18.516459789s ago: executing program 4 (id=335):
r0 = openat$kvm(0x0, &(0x7f0000000280), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, &(0x7f00000002c0)=[@hvc={0x32, 0x40, {0x84000004, [0x80000000, 0x6, 0x3, 0x7f, 0x800]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) (async)
r9 = eventfd2(0x8, 0x80800)
ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0xdddd1000, 0x0, r9})
close(r8) (async)
r10 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece)
ioctl$KVM_IOEVENTFD(r8, 0x4040ae79, &(0x7f0000000100)={0x5, 0x8000000, 0xa, r10}) (async)
r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil)
r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000b80)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r14, 0x4010aeac, &(0x7f0000000140)=@arm64_fw={0x6030000000140000, &(0x7f0000000200)=0x2}) (async)
ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000040)={0x5})
ioctl$KVM_RUN(r2, 0xae80, 0x0) (async)
ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f0000000080)={0xb6, 0x0, 0x2})
openat$kvm(0x0, 0x0, 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)

13m55.162735688s ago: executing program 4 (id=337):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_ASSIGN_SET_MSIX_NR(r1, 0x4008ae73, &(0x7f0000000000)={0x3717, 0x3})
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8}) (async)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8})
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x2e)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x6)
syz_kvm_setup_cpu$arm64(r3, r4, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f00000002c0)=@arm64_sve={0x60800000001501a7, &(0x7f00000000c0)=0x3})
syz_kvm_vgic_v3_setup(r1, 0x1, 0x20)
close(0x4) (async)
close(0x4)
close(0x5) (async)
close(0x5)

13m50.103360676s ago: executing program 5 (id=338):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x6030000000100040, &(0x7f0000000000)=0x1})
openat$kvm(0x0, &(0x7f00000001c0), 0x200000, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x240000, 0x0)
openat$kvm(0xffffffffffffff9c, 0x0, 0x101000, 0x0)
r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x4, <r5=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000200)=@attr_arm64={0x0, 0x1, 0x1, &(0x7f0000000000)=0x3})
r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x400002000000005)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000180)={0x8, <r8=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000})
syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000280)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
r11 = syz_kvm_vgic_v3_setup(r10, 0x4, 0x100)
ioctl$KVM_CREATE_GUEST_MEMFD(r10, 0xc040aed4, &(0x7f0000000040)={0x5, 0xde})
ioctl$KVM_GET_DEVICE_ATTR(r11, 0x4018aee2, &(0x7f00000000c0)=@attr_arm64={0x0, 0x3, 0x5})
ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0xeeee0000, 0x1000, &(0x7f0000fff000/0x1000)=nil})
r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r13, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1})
syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000bfe000/0x400000)=nil)

13m38.567789538s ago: executing program 4 (id=339):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29)
r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000040)={0x1000200001fe0000, 0x3})
ioctl$KVM_SET_USER_MEMORY_REGION2(r1, 0x40a0ae49, &(0x7f0000000180)={0x4, 0x4, 0x6000, 0x2000, &(0x7f0000ffc000/0x2000)=nil, 0x100000000000000, r3})
r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) (async)
r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
mmap$KVM_VCPU(&(0x7f00001e8000/0x3000)=nil, r7, 0x8, 0x11, r6, 0x0) (async)
syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000009000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async)
ioctl$KVM_RUN(r6, 0xae80, 0x0)

13m24.554011618s ago: executing program 5 (id=340):
openat$kvm(0x0, &(0x7f0000000040), 0x101800, 0x0)
r0 = openat$kvm(0x0, &(0x7f0000000000), 0x2, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) (async, rerun: 32)
mmap$KVM_VCPU(&(0x7f0000c58000/0x1000)=nil, r2, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) (async, rerun: 32)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x0, 0x23ac5f9b426e84b2, 0xffffffffffffffff, 0x0)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) (async)
r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
mmap$KVM_VCPU(&(0x7f0000e31000/0x2000)=nil, r5, 0x1, 0x2012, r4, 0x0) (async)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x2000001, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x0) (async)
r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x7)
ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) (async)
ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000700)={0x1, <r7=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x4, 0x0, 0x0})
ioctl$KVM_GET_DEVICE_ATTR(r7, 0x4018aee2, &(0x7f0000000340)=@attr_other={0x0, 0x5, 0x8, &(0x7f0000000000)=0xcb1})

13m18.247719951s ago: executing program 4 (id=341):
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000eed000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1})
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000380)={0x2, 0x25000, 0x1})
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000240)={0xffff1000, 0xa000})
ioctl$KVM_CREATE_VM(r0, 0x801c581f, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil})
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000bc2000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_RUN(r6, 0xae80, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0)

13m6.530499209s ago: executing program 5 (id=342):
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
r2 = eventfd2(0xfffffffa, 0x80001)
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r2})
syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616})
ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0x4, 0x80a0000, 0x4, r2})
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

12m53.105819973s ago: executing program 5 (id=343):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xf4)
r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x29241, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8521, 0x0)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r7, 0xc0189436, 0x100000000000000)
ioctl$KVM_CREATE_VM(r6, 0x5452, 0x3a)
r8 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2)
r10 = syz_kvm_vgic_v3_setup(r8, 0x20000004, 0x60)
ioctl$KVM_GET_DEVICE_ATTR(r10, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x1, 0x800000000208, &(0x7f00000004c0)=0x1})
r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r11, 0x40049409, 0x13)
r12 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, &(0x7f0000000000)=[@hvc={0x32, 0x40, {0x80000001, [0xfffffffffffffde5, 0x3ff, 0x1, 0x4, 0x9]}}], 0x40}, 0x0, 0x0)
ioctl$KVM_RUN(r12, 0xae80, 0x0)
r13 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r13, 0xc00caee0, &(0x7f0000000180)={0x4})
ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f00000001c0)=@arm64_ccsidr={0x6020000000110000, &(0x7f00000000c0)=0x1})
ioctl$KVM_INTERRUPT(r12, 0x4004ae86, &(0x7f0000000200))
ioctl$KVM_CREATE_DEVICE(r13, 0xc00caee0, &(0x7f0000000000)={0x4})

12m48.43352695s ago: executing program 4 (id=344):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x17)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2)
r5 = syz_kvm_vgic_v3_setup(r4, 0x4, 0x40)
ioctl$KVM_GET_DEVICE_ATTR(r5, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x1, 0x800000000208, &(0x7f00000004c0)=0x1})
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x25)
ioctl$KVM_CAP_HALT_POLL(r7, 0x4068aea3, &(0x7f0000000240)={0xb6, 0x0, 0x800000000000001})
r8 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init)
r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
r11 = eventfd2(0x6, 0x0)
ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r11, 0x8})
ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000200)={0x8000000008000800, 0x0, 0x2, r11, 0x2})
ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r11, 0x2})
ioctl$KVM_RUN(r8, 0xae80, 0x0)
r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r14, 0xc00caee0, &(0x7f0000000100)={0x4, <r15=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x1, 0x2, 0x0})
r16 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0)
ioctl$KVM_CAP_ARM_MTE(r16, 0x4068aea3, &(0x7f0000000140)={0xb1})
ioctl$KVM_RUN(r8, 0xae80, 0x0)
syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

12m28.254587899s ago: executing program 5 (id=345):
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400000, 0x0)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@smc={0x1e, 0x40, {0x84000051, [0x80000000000, 0x106, 0xf1, 0x1, 0x1]}}], 0x40}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

12m23.571023631s ago: executing program 4 (id=346):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x7, <r2=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0x4, 0x1c0000, 0x0}) (async)
openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async)
r3 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1)
r6 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r5, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f0000000240)="04198bd844c9e8a7b82d748f0f0244293d28bd9400bfc2ed44db9969759357abeb8d85c8e856a4606c2e979f98d67e4ff39fb6df9547f6a9506c610dc37b175c3ad3c9952305abf0", 0x0, 0x48) (async, rerun: 32)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32)
r8 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 32)
r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (rerun: 32)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r11 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, &(0x7f00000004c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0xffffffffffffffff}}], 0x20}, &(0x7f00000000c0)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r11, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) (async)
ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000240)=@arm64_sys={0x603000000013dce0, &(0x7f0000000200)=0x6}) (async)
ioctl$KVM_RUN(r11, 0xae80, 0x0) (async)
r12 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) (async)
ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f00000002c0)={0x4, 0x0, [{0x10001, 0x4, 0x1, 0x0, @adapter={0x0, 0xb0, 0x80000000, 0xebf2, 0x6}}, {0x5, 0x4, 0x0, 0x0, @msi={0x4, 0x2000000, 0xc08, 0xfffffff7}}, {0x9, 0x4, 0x0, 0x0, @msi={0x7, 0xa, 0x718c, 0x8}}, {0x101, 0x4, 0x1, 0x0, @irqchip={0x1ff, 0x84}}]}) (async)
r13 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r14, 0xc00caee0, &(0x7f0000000180)={0x8, <r15=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async)
ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f0000000240)=@attr_other={0x0, 0x8, 0x8, &(0x7f0000000140)=0x4}) (async, rerun: 64)
r16 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) (rerun: 64)
syz_kvm_add_vcpu$arm64(r16, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_IRQ_LINE(r12, 0x4008ae61, &(0x7f0000000000)={0x0, 0x2})

12m11.077240126s ago: executing program 5 (id=347):
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bc2000/0x400000)=nil)
r1 = syz_kvm_add_vcpu$arm64(r0, 0x0, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0)
r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000080)=@arm64_sys={0x603000000013c4f1, &(0x7f00000001c0)=0x3})
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0)
r9 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r8, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r8, 0x0)
r10 = eventfd2(0x0, 0x0)
close(r10)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01)
write$eventfd(r10, &(0x7f0000000180)=0x5, 0xfffffde3)
write$eventfd(r10, 0x0, 0x0)
syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000100)=[@featur1={0x1, 0x83}], 0x1)
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xa)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)

11m35.233466867s ago: executing program 36 (id=346):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x7, <r2=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0x4, 0x1c0000, 0x0}) (async)
openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async)
r3 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1)
r6 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r5, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f0000000240)="04198bd844c9e8a7b82d748f0f0244293d28bd9400bfc2ed44db9969759357abeb8d85c8e856a4606c2e979f98d67e4ff39fb6df9547f6a9506c610dc37b175c3ad3c9952305abf0", 0x0, 0x48) (async, rerun: 32)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async, rerun: 32)
r8 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 32)
r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (rerun: 32)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r11 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, &(0x7f00000004c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0xffffffffffffffff}}], 0x20}, &(0x7f00000000c0)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r11, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) (async)
ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000240)=@arm64_sys={0x603000000013dce0, &(0x7f0000000200)=0x6}) (async)
ioctl$KVM_RUN(r11, 0xae80, 0x0) (async)
r12 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) (async)
ioctl$KVM_SET_GSI_ROUTING(r4, 0x4008ae6a, &(0x7f00000002c0)={0x4, 0x0, [{0x10001, 0x4, 0x1, 0x0, @adapter={0x0, 0xb0, 0x80000000, 0xebf2, 0x6}}, {0x5, 0x4, 0x0, 0x0, @msi={0x4, 0x2000000, 0xc08, 0xfffffff7}}, {0x9, 0x4, 0x0, 0x0, @msi={0x7, 0xa, 0x718c, 0x8}}, {0x101, 0x4, 0x1, 0x0, @irqchip={0x1ff, 0x84}}]}) (async)
r13 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r14, 0xc00caee0, &(0x7f0000000180)={0x8, <r15=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async)
ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f0000000240)=@attr_other={0x0, 0x8, 0x8, &(0x7f0000000140)=0x4}) (async, rerun: 64)
r16 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) (rerun: 64)
syz_kvm_add_vcpu$arm64(r16, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_IRQ_LINE(r12, 0x4008ae61, &(0x7f0000000000)={0x0, 0x2})

11m21.217041345s ago: executing program 37 (id=347):
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bc2000/0x400000)=nil)
r1 = syz_kvm_add_vcpu$arm64(r0, 0x0, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0)
ioctl$KVM_RUN(r1, 0xae80, 0x0)
r2 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0)
r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur1={0x1, 0x8}], 0x1)
ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000080)=@arm64_sys={0x603000000013c4f1, &(0x7f00000001c0)=0x3})
r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0)
r9 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r8, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r8, 0x0)
r10 = eventfd2(0x0, 0x0)
close(r10)
openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01)
write$eventfd(r10, &(0x7f0000000180)=0x5, 0xfffffde3)
write$eventfd(r10, 0x0, 0x0)
syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000100)=[@featur1={0x1, 0x83}], 0x1)
ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xa)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)

2m45.594800534s ago: executing program 6 (id=348):
openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x240000, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0x80111500, 0x20000000)
ioctl$KVM_CREATE_VM(r3, 0x5761, 0x2000001c)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x101000, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000})
ioctl$KVM_CHECK_EXTENSION_VM(r5, 0xae03, 0x4000000000009)
ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x8, 0x4, &(0x7f0000000040)=0xe0a7})
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000ff1000/0x3000)=nil, 0x0, 0x100000d, 0x32, 0xffffffffffffffff, 0x0)
ioctl$KVM_CHECK_EXTENSION(r4, 0x40086602, 0x110e02ffff)
r6 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, &(0x7f0000000000)=[@smc={0x1e, 0x40, {0x84000053, [0x0, 0x8ebb, 0xc752, 0x1, 0x3]}}], 0x40}, &(0x7f0000000100)=[@featur2={0x1, 0x6}], 0x1)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r8, 0x2, 0x10000000000000)
r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, 0x0)
ioctl$KVM_ARM_VCPU_FINALIZE(0xffffffffffffffff, 0x4004aec2, 0x0)
ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, 0x0)
r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_setup_cpu$arm64(r10, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0, 0x310}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000140)=@attr_other={0x0, 0x3, 0x3931, &(0x7f00000000c0)=0xfffffffffffffff8})
openat$kvm(0x0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r7, 0xae80, 0x0)

2m35.603569049s ago: executing program 7 (id=349):
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000647000/0x1000)=nil, 0x1000) (async)
munmap(&(0x7f0000fde000/0x4000)=nil, 0x4000)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) (async)
munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) (async)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x100, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_vgic_v3_setup(r1, 0x5, 0xc0)
ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000080)=@attr_other={0x0, 0x9, 0x5, 0xffffffffffffffff})
r3 = openat$kvm(0x0, &(0x7f0000000140), 0xc51fb06bd98372a5, 0x0) (async)
r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async)
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0x57) (async)
r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r7 = ioctl$KVM_CREATE_GUEST_MEMFD(r6, 0xc040aed4, &(0x7f00000000c0)={0x200001fe0000, 0x1})
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r7, 0x0) (async, rerun: 32)
r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (rerun: 32)
r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil)
r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000180)={0x0, &(0x7f0000000000)=[@hvc={0x32, 0x40, {0x80000001, [0xfffffffffffffde5, 0x3ff, 0x1, 0x4, 0x9]}}], 0x40}, 0x0, 0x0)
ioctl$KVM_RUN(r10, 0xae80, 0x0) (async)
munmap(&(0x7f000075a000/0xb000)=nil, 0xb000)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0)

2m17.21273216s ago: executing program 6 (id=350):
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async, rerun: 32)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) (async, rerun: 32)
mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) (async, rerun: 64)
mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) (async, rerun: 64)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r2, r3, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1400000000000000200000000000000000c6130000003060e0fefefe000000007e3e85a5c688f2dc7f87917d337fb44d75d3eaf1569972194b1c95b8e17b1a53eb7a5b0c0c65b16a9c0ae7ec01e989caffe4464cad9b442fb7ba8625678c927a507d477df294665213efd46795c47cf8b72a223006d4d95c5791328ddcf6aa424d4a9866eab593a0fc2a044c7842f3d2f16c5b1a159a7b5aa4f788fe91c57f2833a969d1"], 0x20}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 64)
ioctl$KVM_RUN(r3, 0xae80, 0x0) (async, rerun: 64)
ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x603000000010002a, &(0x7f00000001c0)=0x8})
r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) (async)
syz_kvm_vgic_v3_setup(r4, 0x3, 0xa0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0xb) (async, rerun: 64)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (rerun: 64)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f00000001c0)={0x1, 0x1, 0xeeee8000, 0x1000, &(0x7f0000f95000/0x1000)=nil}) (async)
r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000515000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x1}}], 0x28}, 0x0, 0x0) (async)
ioctl$KVM_RUN(r6, 0xae80, 0x0) (async)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x8, <r10=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async)
ioctl$KVM_RUN(r6, 0xae80, 0x0)
ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x4, 0x0}) (async)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)

2m13.067887255s ago: executing program 7 (id=351):
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x5e6)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1})
ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)=@arm64_sys={0x603000000013c01a, &(0x7f0000000000)=0x2})
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0xb, 0x30d2a4fbfbfad6b8, 0xffffffffffffffff, 0x0)

1m58.026803083s ago: executing program 6 (id=352):
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x440800, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async)
r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x300, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x28) (async, rerun: 64)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (rerun: 64)
r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) (async)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async, rerun: 64)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) (async, rerun: 64)
munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000)
munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async)
munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) (async)
munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) (async)
munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000) (async)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0) (async)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000) (async)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) (async)
mmap$KVM_VCPU(&(0x7f0000e31000/0x2000)=nil, 0x930, 0xa, 0x11, r5, 0x40000)
syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000000)="b160e3204cf49a6d6465b4dfaf425b5c000000ca6753bd29fc4090017e193ad96c199643bc3560bdce99750535909442000000002ad4b83ad4da1b871763d668d500", 0x0, 0x48) (async)
r6 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x2}}], 0x28}, 0x0, 0x0) (async)
syz_kvm_vgic_v3_setup(r2, 0x1, 0x100) (async)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000180)={0x8}) (async)
openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)

1m54.973987059s ago: executing program 7 (id=353):
r0 = openat$kvm(0x0, &(0x7f0000000000), 0x28402, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000280)={0x14, 0xff}})

1m36.644071315s ago: executing program 6 (id=354):
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3)
ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8})
ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f00000002c0)=@arm64_sys={0x603000000013df61, &(0x7f00000001c0)=0x10000008})
ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013dce0, &(0x7f0000000000)=0x43ff})
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_init)
ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000040)=@arm64)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2000002, 0x10, r2, 0x0)
mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000040)={0x7, <r5=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x3, 0x0})
ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x1, 0x3, &(0x7f0000000080)=0x1})

1m34.183793409s ago: executing program 7 (id=355):
r0 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) (async)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2)
mmap$KVM_VCPU(&(0x7f0000ffa000/0x3000)=nil, 0x0, 0x2, 0x10, r1, 0x0) (async)
r2 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32)

1m14.951931804s ago: executing program 7 (id=356):
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, 0x930, 0x3000008, 0x4f832, 0xffffffffffffffff, 0x1000000)
mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000)

1m8.059686408s ago: executing program 6 (id=357):
openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x709000, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e)
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000240)={0xffffffff, 0x14000})
openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x709000, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) (async)
ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000240)={0xffffffff, 0x14000}) (async)

56.183669921s ago: executing program 7 (id=358):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2c)
r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000040)=@arm64_core={0x603000000010002a, 0x0})
r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil)
r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r9, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000800000/0x800000)=nil, 0x800000)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r10, 0xae03, 0xb6)
r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x1)
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r13, 0x4018aee3, &(0x7f0000000100)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0})
ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000140)=@arm64_fp={0x6040000000100087, &(0x7f0000000000)=0x7})

54.994017965s ago: executing program 6 (id=359):
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000eed000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0x801c581f, 0x0)
mmap$KVM_VCPU(&(0x7f0000d33000/0x4000)=nil, 0x0, 0xb, 0x110, 0xffffffffffffffff, 0x0) (async)
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) (async)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bc2000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2], 0x6)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) (async)
ioctl$KVM_RUN(r5, 0xae80, 0x0) (async)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x800, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f0000000140)=@arm64_sve={0x60800000001504bc, 0x0}) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil)
r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000240)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r13, 0x4010aeab, &(0x7f0000000100)=@arm64_fp_extra={0x60200004001000d4, &(0x7f0000000180)=0x4}) (async)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

9.194646962s ago: executing program 38 (id=358):
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2c)
r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000040)=@arm64_core={0x603000000010002a, 0x0})
r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil)
r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r9, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000800000/0x800000)=nil, 0x800000)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CHECK_EXTENSION(r10, 0xae03, 0xb6)
r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0)
r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x1)
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r13, 0x4018aee3, &(0x7f0000000100)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0})
ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000140)=@arm64_fp={0x6040000000100087, &(0x7f0000000000)=0x7})

0s ago: executing program 39 (id=359):
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000eed000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async)
ioctl$KVM_CREATE_VM(r0, 0x801c581f, 0x0)
mmap$KVM_VCPU(&(0x7f0000d33000/0x4000)=nil, 0x0, 0xb, 0x110, 0xffffffffffffffff, 0x0) (async)
munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) (async)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bc2000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2], 0x6)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000040)="68d3d4a6759ba655d47872b6bf881ba5dbca1c84a0779749", 0x0, 0x18) (async)
ioctl$KVM_RUN(r5, 0xae80, 0x0) (async)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x800, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f0000000140)=@arm64_sve={0x60800000001504bc, 0x0}) (async)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async)
r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil)
r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000240)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r13, 0x4010aeab, &(0x7f0000000100)=@arm64_fp_extra={0x60200004001000d4, &(0x7f0000000180)=0x4}) (async)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

kernel console output (not intermixed with test programs):

[  394.802850][   T25] audit: type=1400 audit(394.010:60): avc:  denied  { read } for  pid=3170 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1
[  413.654062][ T3170] 8021q: adding VLAN 0 to HW filter on device bond0
[  467.308215][ T3170] eql: remember to turn off Van-Jacobson compression on your slave devices
Warning: Permanently added '[localhost]:3964' (ED25519) to the list of known hosts.
[  633.789124][   T25] audit: type=1400 audit(633.010:61): avc:  denied  { name_bind } for  pid=3330 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1
[  634.688630][   T25] audit: type=1400 audit(633.910:62): avc:  denied  { execute } for  pid=3331 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1
[  634.723407][   T25] audit: type=1400 audit(633.940:63): avc:  denied  { execute_no_trans } for  pid=3331 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1
[  666.435399][   T25] audit: type=1400 audit(665.660:64): avc:  denied  { mounton } for  pid=3331 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1
[  666.495925][   T25] audit: type=1400 audit(665.710:65): avc:  denied  { mount } for  pid=3331 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[  666.588792][ T3331] cgroup: Unknown subsys name 'net'
[  666.664399][   T25] audit: type=1400 audit(665.890:66): avc:  denied  { unmount } for  pid=3331 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1
[  667.134013][ T3331] cgroup: Unknown subsys name 'cpuset'
[  667.273299][ T3331] cgroup: Unknown subsys name 'rlimit'
[  668.245797][   T25] audit: type=1400 audit(667.470:67): avc:  denied  { setattr } for  pid=3331 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=703 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1
[  668.273335][   T25] audit: type=1400 audit(667.490:68): avc:  denied  { mounton } for  pid=3331 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1
[  668.292243][   T25] audit: type=1400 audit(667.510:69): avc:  denied  { mount } for  pid=3331 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1
[  669.349025][ T3335] SELinux:  Context root:object_r:swapfile_t is not valid (left unmapped).
[  669.372690][   T25] audit: type=1400 audit(668.590:70): avc:  denied  { relabelto } for  pid=3335 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[  669.397753][   T25] audit: type=1400 audit(668.620:71): avc:  denied  { write } for  pid=3335 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
Setting up swapspace version 1, size = 127995904 bytes
[  669.595249][   T25] audit: type=1400 audit(668.820:72): avc:  denied  { read } for  pid=3331 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[  669.611765][   T25] audit: type=1400 audit(668.830:73): avc:  denied  { open } for  pid=3331 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t"
[  669.657281][ T3331] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[  727.484846][   T25] audit: type=1400 audit(726.710:74): avc:  denied  { execmem } for  pid=3336 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1
[  731.407770][   T25] audit: type=1400 audit(730.630:75): avc:  denied  { read } for  pid=3338 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  731.422796][   T25] audit: type=1400 audit(730.640:76): avc:  denied  { read } for  pid=3339 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  731.448425][   T25] audit: type=1400 audit(730.670:77): avc:  denied  { open } for  pid=3338 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1
[  731.514767][   T25] audit: type=1400 audit(730.730:78): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1
[  731.766302][   T25] audit: type=1400 audit(730.990:79): avc:  denied  { module_request } for  pid=3339 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1
[  732.829053][   T25] audit: type=1400 audit(732.050:80): avc:  denied  { sys_module } for  pid=3338 comm="syz-executor" capability=16  scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1
[  756.107672][ T3339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  756.389358][ T3339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  756.507494][ T3338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  756.893921][ T3338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  773.155114][ T3339] hsr_slave_0: entered promiscuous mode
[  773.207134][ T3339] hsr_slave_1: entered promiscuous mode
[  775.148361][ T3338] hsr_slave_0: entered promiscuous mode
[  775.204821][ T3338] hsr_slave_1: entered promiscuous mode
[  775.251448][ T3338] debugfs: 'hsr0' already exists in 'hsr'
[  775.257283][ T3338] Cannot create hsr debugfs directory
[  781.591214][   T25] audit: type=1400 audit(780.810:81): avc:  denied  { create } for  pid=3339 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  781.712472][   T25] audit: type=1400 audit(780.860:82): avc:  denied  { write } for  pid=3339 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  781.749331][   T25] audit: type=1400 audit(780.930:83): avc:  denied  { read } for  pid=3339 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  781.982930][ T3339] netdevsim netdevsim0 netdevsim0: renamed from eth0
[  782.362511][ T3339] netdevsim netdevsim0 netdevsim1: renamed from eth1
[  782.658534][ T3339] netdevsim netdevsim0 netdevsim2: renamed from eth2
[  782.961998][ T3339] netdevsim netdevsim0 netdevsim3: renamed from eth3
[  784.566137][ T3338] netdevsim netdevsim1 netdevsim0: renamed from eth0
[  784.867494][ T3338] netdevsim netdevsim1 netdevsim1: renamed from eth1
[  785.114164][ T3338] netdevsim netdevsim1 netdevsim2: renamed from eth2
[  785.345287][ T3338] netdevsim netdevsim1 netdevsim3: renamed from eth3
[  797.616486][ T3339] 8021q: adding VLAN 0 to HW filter on device bond0
[  800.647720][ T3338] 8021q: adding VLAN 0 to HW filter on device bond0
[  857.057663][ T3339] veth0_vlan: entered promiscuous mode
[  857.563626][ T3339] veth1_vlan: entered promiscuous mode
[  859.954207][ T3339] veth0_macvtap: entered promiscuous mode
[  860.248098][ T3338] veth0_vlan: entered promiscuous mode
[  860.416482][ T3339] veth1_macvtap: entered promiscuous mode
[  861.206011][ T3338] veth1_vlan: entered promiscuous mode
[  863.062808][   T21] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  863.085083][   T21] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  863.111582][   T21] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  863.117201][   T21] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  864.903716][ T3338] veth0_macvtap: entered promiscuous mode
[  865.606735][ T3338] veth1_macvtap: entered promiscuous mode
[  865.874829][   T25] audit: type=1400 audit(865.090:84): avc:  denied  { mount } for  pid=3339 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1
[  866.172767][   T25] audit: type=1400 audit(865.390:85): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/syzkaller.PisRAD/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1
[  866.327854][   T25] audit: type=1400 audit(865.550:86): avc:  denied  { mount } for  pid=3339 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1
[  866.587708][   T25] audit: type=1400 audit(865.810:87): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/syzkaller.PisRAD/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1
[  866.756452][   T25] audit: type=1400 audit(865.980:88): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/syzkaller.PisRAD/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3756 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1
[  867.419159][   T25] audit: type=1400 audit(866.640:89): avc:  denied  { unmount } for  pid=3339 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1
[  867.943415][   T25] audit: type=1400 audit(867.110:90): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1546 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1
[  868.033894][   T25] audit: type=1400 audit(867.250:91): avc:  denied  { mount } for  pid=3339 comm="syz-executor" name="/" dev="gadgetfs" ino=3765 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1
[  868.137415][   T50] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  868.153546][   T50] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  868.157785][   T50] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  868.167482][   T50] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  868.354932][   T25] audit: type=1400 audit(867.580:92): avc:  denied  { mount } for  pid=3339 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[  868.506012][   T25] audit: type=1400 audit(867.710:93): avc:  denied  { mounton } for  pid=3339 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1
[  870.248569][ T3339] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[  871.531920][   T25] kauditd_printk_skb: 1 callbacks suppressed
[  871.534902][   T25] audit: type=1400 audit(870.740:95): avc:  denied  { read write } for  pid=3339 comm="syz-executor" name="loop0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  871.541328][   T25] audit: type=1400 audit(870.750:96): avc:  denied  { open } for  pid=3339 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=638 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  871.634964][   T25] audit: type=1400 audit(870.750:97): avc:  denied  { ioctl } for  pid=3339 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=638 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1
[  881.396021][   T25] audit: type=1400 audit(880.600:98): avc:  denied  { read write } for  pid=3488 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  881.433538][   T25] audit: type=1400 audit(880.650:99): avc:  denied  { open } for  pid=3488 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  881.835454][   T25] audit: type=1400 audit(881.060:100): avc:  denied  { ioctl } for  pid=3488 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[  883.067906][   T25] audit: type=1400 audit(882.280:101): avc:  denied  { execute } for  pid=3488 comm="syz.0.1" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=3837 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1
[ 1002.447923][   T25] audit: type=1400 audit(1001.670:102): avc:  denied  { append } for  pid=3553 comm="syz.1.21" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[ 1132.157845][   T25] audit: type=1400 audit(1131.360:103): avc:  denied  { create } for  pid=3631 comm="syz.1.45" anonclass=[kvm-gmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 1133.364244][   T25] audit: type=1400 audit(1132.580:104): avc:  denied  { map } for  pid=3631 comm="syz.1.45" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=5766 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 1133.476865][   T25] audit: type=1400 audit(1132.680:105): avc:  denied  { read } for  pid=3631 comm="syz.1.45" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=5766 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 1133.701102][   T25] audit: type=1400 audit(1132.920:106): avc:  denied  { write } for  pid=3631 comm="syz.1.45" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=5766 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1
[ 1345.421651][   T25] audit: type=1400 audit(1344.620:107): avc:  denied  { setattr } for  pid=3756 comm="syz.0.83" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[ 1460.681957][   T25] audit: type=1400 audit(1459.900:108): avc:  denied  { map } for  pid=3822 comm="syz.0.100" path="pipe:[2771]" dev="pipefs" ino=2771 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1
[ 1875.654249][   T25] audit: type=1400 audit(1874.870:109): avc:  denied  { map } for  pid=4037 comm="syz.1.166" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[ 1875.693621][   T25] audit: type=1400 audit(1874.910:110): avc:  denied  { execute } for  pid=4037 comm="syz.1.166" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1
[ 2273.446796][ T4252] debugfs: 'vgic-its-state@8080000' already exists in '4252-10'
[ 2474.026352][ T4003] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2475.331400][ T4003] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2476.478207][ T4003] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2478.315576][ T4003] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2490.933650][ T4003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 2491.037218][ T4003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 2491.113631][ T4003] bond0 (unregistering): Released all slaves
[ 2492.893791][ T4003] hsr_slave_0: left promiscuous mode
[ 2492.952526][ T4003] hsr_slave_1: left promiscuous mode
[ 2493.570825][ T4003] veth1_macvtap: left promiscuous mode
[ 2493.574858][ T4003] veth0_macvtap: left promiscuous mode
[ 2493.612259][ T4003] veth1_vlan: left promiscuous mode
[ 2493.618127][ T4003] veth0_vlan: left promiscuous mode
[ 2511.624305][ T4003] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2512.892906][ T4003] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2513.947275][ T4003] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2515.476144][ T4003] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 2534.039054][ T4003] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 2534.186433][ T4003] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 2534.274050][ T4003] bond0 (unregistering): Released all slaves
[ 2536.343093][ T4003] hsr_slave_0: left promiscuous mode
[ 2536.714393][ T4003] hsr_slave_1: left promiscuous mode
[ 2537.575313][ T4003] veth1_macvtap: left promiscuous mode
[ 2537.592664][ T4003] veth0_macvtap: left promiscuous mode
[ 2537.597456][ T4003] veth1_vlan: left promiscuous mode
[ 2537.615845][ T4003] veth0_vlan: left promiscuous mode
[ 2561.636356][ T4332] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 2561.869059][ T4332] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 2564.265768][ T4335] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 2564.475611][ T4335] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 2584.838744][ T4332] hsr_slave_0: entered promiscuous mode
[ 2584.905124][ T4332] hsr_slave_1: entered promiscuous mode
[ 2588.723365][ T4335] hsr_slave_0: entered promiscuous mode
[ 2588.804825][ T4335] hsr_slave_1: entered promiscuous mode
[ 2588.874482][ T4335] debugfs: 'hsr0' already exists in 'hsr'
[ 2588.877528][ T4335] Cannot create hsr debugfs directory
[ 2602.297383][ T4332] netdevsim netdevsim2 netdevsim0: renamed from eth0
[ 2602.856691][ T4332] netdevsim netdevsim2 netdevsim1: renamed from eth1
[ 2603.339141][ T4332] netdevsim netdevsim2 netdevsim2: renamed from eth2
[ 2603.811691][ T4332] netdevsim netdevsim2 netdevsim3: renamed from eth3
[ 2607.835516][ T4335] netdevsim netdevsim3 netdevsim0: renamed from eth0
[ 2608.286725][ T4335] netdevsim netdevsim3 netdevsim1: renamed from eth1
[ 2608.596157][ T4335] netdevsim netdevsim3 netdevsim2: renamed from eth2
[ 2608.985166][ T4335] netdevsim netdevsim3 netdevsim3: renamed from eth3
[ 2628.574056][ T4332] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2633.202379][ T4335] 8021q: adding VLAN 0 to HW filter on device bond0
[ 2732.271668][ T4332] veth0_vlan: entered promiscuous mode
[ 2733.073122][ T4332] veth1_vlan: entered promiscuous mode
[ 2737.022145][ T4335] veth0_vlan: entered promiscuous mode
[ 2737.592891][ T4332] veth0_macvtap: entered promiscuous mode
[ 2738.419347][ T4332] veth1_macvtap: entered promiscuous mode
[ 2738.914703][ T4335] veth1_vlan: entered promiscuous mode
[ 2742.755267][ T4352] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 2742.762242][ T4352] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 2742.844039][ T4352] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 2742.854164][ T4352] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 2744.423955][ T4335] veth0_macvtap: entered promiscuous mode
[ 2745.124191][ T4335] veth1_macvtap: entered promiscuous mode
[ 2750.515015][ T4342] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 2750.606904][ T4003] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 2750.608459][ T4003] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 2750.696020][ T4003] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 2811.206806][ T4599] FAULT_INJECTION: forcing a failure.
[ 2811.206806][ T4599] name fail_usercopy, interval 1, probability 0, space 0, times 1
[ 2811.342152][ T4599] CPU: 0 UID: 0 PID: 4599 Comm: syz.3.263 Not tainted syzkaller #0 PREEMPT 
[ 2811.342829][ T4599] Hardware name: linux,dummy-virt (DT)
[ 2811.343288][ T4599] Call trace:
[ 2811.343699][ T4599]  show_stack+0x2c/0x3c (C)
[ 2811.345607][ T4599]  __dump_stack+0x30/0x40
[ 2811.346009][ T4599]  dump_stack_lvl+0xd8/0x12c
[ 2811.346311][ T4599]  dump_stack+0x1c/0x28
[ 2811.346611][ T4599]  should_fail_ex+0x56c/0x6d8
[ 2811.346883][ T4599]  should_fail+0x14/0x24
[ 2811.347091][ T4599]  should_fail_usercopy+0x20/0x30
[ 2811.347366][ T4599]  simple_read_from_buffer+0xd0/0x294
[ 2811.347663][ T4599]  proc_fail_nth_read+0x184/0x214
[ 2811.347954][ T4599]  vfs_read+0x220/0x9d8
[ 2811.348169][ T4599]  ksys_read+0x108/0x1fc
[ 2811.348376][ T4599]  __arm64_sys_read+0x98/0xcc
[ 2811.348605][ T4599]  invoke_syscall+0x90/0x230
[ 2811.348906][ T4599]  el0_svc_common+0x120/0x2f4
[ 2811.349185][ T4599]  do_el0_svc+0x58/0x74
[ 2811.349455][ T4599]  el0_svc+0x5c/0x238
[ 2811.349771][ T4599]  el0t_64_sync_handler+0x84/0x12c
[ 2811.350067][ T4599]  el0t_64_sync+0x198/0x19c
[ 3364.224535][ T4867] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3366.382817][ T4867] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3368.107373][ T4867] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3371.262054][ T4867] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3374.275811][ T4832] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 3374.645161][ T4832] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 3392.628421][ T4867] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 3392.765856][ T4867] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 3392.883822][ T4867] bond0 (unregistering): Released all slaves
[ 3394.447738][ T4867] hsr_slave_0: left promiscuous mode
[ 3394.502399][ T4867] hsr_slave_1: left promiscuous mode
[ 3395.206313][ T4867] veth1_macvtap: left promiscuous mode
[ 3395.214720][ T4867] veth0_macvtap: left promiscuous mode
[ 3395.256615][ T4867] veth1_vlan: left promiscuous mode
[ 3395.272509][ T4867] veth0_vlan: left promiscuous mode
[ 3414.726474][ T4836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 3415.588831][ T4836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 3420.138106][ T4867] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3422.077868][ T4867] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3423.745458][ T4867] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3425.364852][ T4867] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 3448.817356][ T4867] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 3449.012879][ T4867] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 3449.127169][ T4867] bond0 (unregistering): Released all slaves
[ 3449.737777][ T4832] hsr_slave_0: entered promiscuous mode
[ 3449.769332][ T4832] hsr_slave_1: entered promiscuous mode
[ 3449.794781][ T4832] debugfs: 'hsr0' already exists in 'hsr'
[ 3449.797757][ T4832] Cannot create hsr debugfs directory
[ 3450.671458][ T4867] hsr_slave_0: left promiscuous mode
[ 3450.735155][ T4867] hsr_slave_1: left promiscuous mode
[ 3451.374866][ T4867] veth1_macvtap: left promiscuous mode
[ 3451.380381][ T4867] veth0_macvtap: left promiscuous mode
[ 3451.396297][ T4867] veth1_vlan: left promiscuous mode
[ 3451.416785][ T4867] veth0_vlan: left promiscuous mode
[ 3476.504005][ T4836] hsr_slave_0: entered promiscuous mode
[ 3476.553900][ T4836] hsr_slave_1: entered promiscuous mode
[ 3490.131249][ T4832] netdevsim netdevsim4 netdevsim0: renamed from eth0
[ 3491.051269][ T4832] netdevsim netdevsim4 netdevsim1: renamed from eth1
[ 3491.869330][ T4832] netdevsim netdevsim4 netdevsim2: renamed from eth2
[ 3492.496230][ T4832] netdevsim netdevsim4 netdevsim3: renamed from eth3
[ 3499.769418][ T4836] netdevsim netdevsim5 netdevsim0: renamed from eth0
[ 3500.257850][ T4836] netdevsim netdevsim5 netdevsim1: renamed from eth1
[ 3500.754859][ T4836] netdevsim netdevsim5 netdevsim2: renamed from eth2
[ 3501.372269][ T4836] netdevsim netdevsim5 netdevsim3: renamed from eth3
[ 3524.276751][ T4832] 8021q: adding VLAN 0 to HW filter on device bond0
[ 3531.038626][ T4836] 8021q: adding VLAN 0 to HW filter on device bond0
[ 3664.735147][ T4832] veth0_vlan: entered promiscuous mode
[ 3666.134353][ T4832] veth1_vlan: entered promiscuous mode
[ 3670.691588][ T4832] veth0_macvtap: entered promiscuous mode
[ 3671.698577][ T4832] veth1_macvtap: entered promiscuous mode
[ 3673.293148][ T4836] veth0_vlan: entered promiscuous mode
[ 3675.856117][ T4836] veth1_vlan: entered promiscuous mode
[ 3679.129042][ T4868] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 3679.290679][ T4487] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 3679.307434][ T4487] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 3679.429357][ T4868] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 3683.853715][ T4836] veth0_macvtap: entered promiscuous mode
[ 3685.402615][ T4836] veth1_macvtap: entered promiscuous mode
[ 3691.476043][ T4003] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 3691.518788][ T4003] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 3691.556941][ T4003] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 3691.638479][ T4003] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 4126.254927][ T4807] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4130.468154][ T4807] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4132.377186][ T4807] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4134.607059][ T4807] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4159.323250][ T4807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 4159.688511][ T4807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 4159.955609][ T4807] bond0 (unregistering): Released all slaves
[ 4163.281733][ T4807] hsr_slave_0: left promiscuous mode
[ 4163.873542][ T4807] hsr_slave_1: left promiscuous mode
[ 4165.861286][ T4807] veth1_macvtap: left promiscuous mode
[ 4165.873091][ T4807] veth0_macvtap: left promiscuous mode
[ 4165.896505][ T4807] veth1_vlan: left promiscuous mode
[ 4165.915351][ T4807] veth0_vlan: left promiscuous mode
[ 4209.358482][ T4807] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4210.957025][ T4807] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4213.764072][ T4807] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4217.335872][ T4807] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4241.867083][ T4807] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 4242.025357][ T4807] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 4242.142247][ T4807] bond0 (unregistering): Released all slaves
[ 4243.574964][ T4807] hsr_slave_0: left promiscuous mode
[ 4243.710847][ T4807] hsr_slave_1: left promiscuous mode
[ 4244.250663][ T4807] veth1_macvtap: left promiscuous mode
[ 4244.254131][ T4807] veth0_macvtap: left promiscuous mode
[ 4244.269358][ T4807] veth1_vlan: left promiscuous mode
[ 4244.294312][ T4807] veth0_vlan: left promiscuous mode
[ 4297.445617][ T5265] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 4297.755638][ T5265] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 4305.986228][ T5275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 4306.357243][ T5275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 4330.409214][ T5265] hsr_slave_0: entered promiscuous mode
[ 4330.516193][ T5265] hsr_slave_1: entered promiscuous mode
[ 4343.191932][ T5275] hsr_slave_0: entered promiscuous mode
[ 4343.286436][ T5275] hsr_slave_1: entered promiscuous mode
[ 4343.351544][ T5275] debugfs: 'hsr0' already exists in 'hsr'
[ 4343.360622][ T5275] Cannot create hsr debugfs directory
[ 4358.372155][ T5265] netdevsim netdevsim6 netdevsim0: renamed from eth0
[ 4359.741047][ T5265] netdevsim netdevsim6 netdevsim1: renamed from eth1
[ 4360.609085][ T5265] netdevsim netdevsim6 netdevsim2: renamed from eth2
[ 4361.025804][ T5265] netdevsim netdevsim6 netdevsim3: renamed from eth3
[ 4368.088444][ T5275] netdevsim netdevsim7 netdevsim0: renamed from eth0
[ 4368.599163][ T5275] netdevsim netdevsim7 netdevsim1: renamed from eth1
[ 4369.227511][ T5275] netdevsim netdevsim7 netdevsim2: renamed from eth2
[ 4369.814076][ T5275] netdevsim netdevsim7 netdevsim3: renamed from eth3
[ 4399.299157][ T5265] 8021q: adding VLAN 0 to HW filter on device bond0
[ 4408.965760][ T5275] 8021q: adding VLAN 0 to HW filter on device bond0
[ 4578.352343][ T5265] veth0_vlan: entered promiscuous mode
[ 4579.955241][ T5265] veth1_vlan: entered promiscuous mode
[ 4585.065625][ T5265] veth0_macvtap: entered promiscuous mode
[ 4587.043173][ T5265] veth1_macvtap: entered promiscuous mode
[ 4589.191462][ T5275] veth0_vlan: entered promiscuous mode
[ 4592.217669][ T5275] veth1_vlan: entered promiscuous mode
[ 4595.401868][ T5430] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 4595.425229][ T5430] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 4595.582304][ T5430] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 4595.588656][ T5430] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 4602.348602][ T5275] veth0_macvtap: entered promiscuous mode
[ 4604.004894][ T5275] veth1_macvtap: entered promiscuous mode
[ 4610.322821][ T4169] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 4610.345023][ T4169] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 4610.510935][ T4169] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 4610.804911][ T5268] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 4801.134646][ T5268] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4804.267166][ T5268] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4806.943219][ T5268] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4809.008983][ T5268] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 4849.624578][ T5268] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 4850.644961][ T5268] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 4851.074083][ T5268] bond0 (unregistering): Released all slaves
[ 4854.142349][ T5268] hsr_slave_0: left promiscuous mode
[ 4854.282500][ T5268] hsr_slave_1: left promiscuous mode
[ 4855.639321][ T5268] veth1_macvtap: left promiscuous mode
[ 4855.721486][ T5268] veth0_macvtap: left promiscuous mode
[ 4855.743218][ T5268] veth1_vlan: left promiscuous mode
[ 4855.812406][ T5268] veth0_vlan: left promiscuous mode
[ 5026.834431][ T5597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 5029.132270][ T5597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 5029.613922][ T5601] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 5032.134525][ T5601] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 5090.567949][ T5597] hsr_slave_0: entered promiscuous mode
[ 5090.728225][ T5597] hsr_slave_1: entered promiscuous mode
[ 5090.894366][ T5597] debugfs: 'hsr0' already exists in 'hsr'
[ 5090.897496][ T5597] Cannot create hsr debugfs directory
[ 5098.144871][ T5601] hsr_slave_0: entered promiscuous mode
[ 5098.293979][ T5601] hsr_slave_1: entered promiscuous mode
[ 5098.432964][ T5601] debugfs: 'hsr0' already exists in 'hsr'
[ 5098.461415][ T5601] Cannot create hsr debugfs directory
[ 5138.138631][ T5597] netdevsim netdevsim8 netdevsim0: renamed from eth0
[ 5139.871904][ T5597] netdevsim netdevsim8 netdevsim1: renamed from eth1
[ 5140.738417][ T5597] netdevsim netdevsim8 netdevsim2: renamed from eth2
[ 5141.863688][ T5597] netdevsim netdevsim8 netdevsim3: renamed from eth3
[ 5155.758926][ T5601] netdevsim netdevsim9 netdevsim0: renamed from eth0
[ 5156.698423][ T5601] netdevsim netdevsim9 netdevsim1: renamed from eth1
[ 5157.587062][ T5601] netdevsim netdevsim9 netdevsim2: renamed from eth2
[ 5158.617658][ T5601] netdevsim netdevsim9 netdevsim3: renamed from eth3
[ 5192.297745][   T27] INFO: task syz.7.358:5575 blocked for more than 430 seconds.
[ 5192.301057][   T27]       Not tainted syzkaller #0
[ 5192.304448][   T27]       Blocked by coredump.
[ 5192.304912][   T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 5192.305402][   T27] task:syz.7.358       state:D stack:0     pid:5575  tgid:5575  ppid:5275   task_flags:0x40044c flags:0x00000019
[ 5192.306580][   T27] Call trace:
[ 5192.307001][   T27]  __switch_to+0x584/0xb00 (T)
[ 5192.307618][   T27]  __schedule+0x200c/0x3428
[ 5192.308140][   T27]  schedule+0xac/0x27c
[ 5192.308612][   T27]  schedule_timeout+0x68/0x1ec
[ 5192.309119][   T27]  do_wait_for_common+0x28c/0x440
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 5192.477180][   T27]  wait_for_completion+0x44/0x5c
[ 5192.492653][   T27]  __synchronize_srcu+0x2a4/0x320
[ 5192.493348][   T27]  synchronize_srcu+0x3d0/0x4f8
[ 5192.493893][   T27]  mmu_notifier_unregister+0x320/0x428
[ 5192.494398][   T27]  kvm_put_kvm+0x698/0xbe0
[ 5192.494828][   T27]  kvm_vm_release+0x58/0x78
[ 5192.495808][   T27]  __fput+0x4ac/0x978
[ 5192.496279][   T27]  ____fput+0x20/0x58
[ 5192.496727][   T27]  task_work_run+0x1b8/0x250
[ 5192.497201][   T27]  do_exit+0x7f8/0x2378
[ 5192.497703][   T27]  do_group_exit+0x1d4/0x2ac
[ 5192.498195][   T27]  get_signal+0x1440/0x154c
[ 5192.498704][   T27]  arch_do_signal_or_restart+0x23c/0x4bac
[ 5192.499219][   T27]  exit_to_user_mode_loop+0x88/0x188
[ 5192.674203][   T27]  el0_svc+0x17c/0x238
[ 5192.692928][   T27]  el0t_64_sync_handler+0x84/0x12c
[ 5192.693687][   T27]  el0t_64_sync+0x198/0x19c
[ 5192.695738][   T27] 
[ 5192.695738][   T27] Showing all locks held in the system:
[ 5192.696267][   T27] 1 lock held by khungtaskd/27:
[ 5192.696676][   T27]  #0: ffff800087a86d08 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x0/0x44
[ 5192.699270][   T27] 2 locks held by getty/3199:
[ 5192.812016][   T27]  #0: 45f00000123628a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c
[ 5192.842997][   T27]  #1: 89ff80008c80b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x308/0x1234
[ 5192.844865][   T27] 2 locks held by syz-executor/3331:
[ 5192.845712][   T27] 2 locks held by kworker/u4:0/4003:
[ 5192.846054][   T27] 3 locks held by kworker/u4:5/4169:
[ 5192.846356][   T27] 3 locks held by kworker/u4:4/4339:
[ 5192.846681][   T27] 2 locks held by kworker/u4:9/4352:
[ 5192.846986][   T27]  #0: 38f000000cc26948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10
[ 5192.849015][   T27]  #1: ffff8000a9557c88 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10
[ 5193.052402][   T27] 3 locks held by kworker/u4:10/4487:
[ 5193.052820][   T27] 2 locks held by kworker/u4:3/4807:
[ 5193.053136][   T27] 3 locks held by kworker/u4:8/4867:
[ 5193.053433][   T27] 3 locks held by kworker/u4:13/4976:
[ 5193.053788][   T27] 2 locks held by kworker/u4:7/5268:
[ 5193.054090][   T27]  #0: 38f000000cc26948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a10
[ 5193.055981][   T27]  #1: ffff80008e377c88 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a10
[ 5193.057632][   T27] 3 locks held by kworker/u4:11/5273:
[ 5193.057977][   T27] 3 locks held by kworker/u4:15/5434:
[ 5193.058305][   T27] 2 locks held by syz.6.359/5577:
[ 5193.058638][   T27] 3 locks held by kworker/u4:2/5606:
[ 5193.058981][   T27] 2 locks held by dhcpcd-run-hook/5729:
[ 5193.059284][   T27] 1 lock held by modprobe/5730:
[ 5193.221883][   T27] 1 lock held by modprobe/5731:
[ 5193.233093][   T27] 
[ 5193.233472][   T27] =============================================
[ 5193.233472][   T27] 
[ 5193.234404][   T27] Kernel panic - not syncing: hung_task: blocked tasks
[ 5193.241391][   T27] CPU: 0 UID: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT 
[ 5193.242662][   T27] Hardware name: linux,dummy-virt (DT)
[ 5193.243459][   T27] Call trace:
[ 5193.244170][   T27]  show_stack+0x2c/0x3c (C)
[ 5193.245200][   T27]  __dump_stack+0x30/0x40
[ 5193.246078][   T27]  dump_stack_lvl+0x30/0x12c
[ 5193.247013][   T27]  dump_stack+0x1c/0x28
[ 5193.247916][   T27]  vpanic+0x1d4/0x4e4
[ 5193.248697][   T27]  vpanic+0x0/0x4e4
[ 5193.249444][   T27]  hung_task_panic+0x0/0x2c
[ 5193.250382][   T27]  kthread+0x794/0x99c
[ 5193.251260][   T27]  ret_from_fork+0x10/0x20
[ 5193.253081][   T27] Kernel Offset: disabled
[ 5193.253859][   T27] CPU features: 0x0000000,001a3005,fbe327a1,057ffe1f
[ 5193.254876][   T27] Memory Limit: none
[ 5193.257118][   T27] Rebooting in 86400 seconds..