last executing test programs: 6m14.330344841s ago: executing program 1 (id=129): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x5) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) mmap$KVM_VCPU(0x0, 0x50000, 0x3, 0x11, r3, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40001, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) write$eventfd(r6, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) ioctl$KVM_GET_ONE_REG(r7, 0x4010aeab, &(0x7f0000000180)=@arm64_sys={0x603000000013dce2, 0x0}) ioctl$KVM_CLEAR_DIRTY_LOG(r0, 0xc018aec0, &(0x7f0000000480)={0x0, 0x100, 0x3c0, &(0x7f0000000080)=[0x41, 0x7, 0x9, 0xd, 0x3, 0x2000, 0xa28, 0x7, 0x0, 0x3ff, 0x6, 0x3, 0x9, 0x1, 0xff, 0x5, 0x100, 0x8, 0x0, 0x8000, 0x100, 0x6, 0x62ac, 0x0, 0x8539, 0xc, 0x34, 0x1de2, 0x4, 0x74, 0x6, 0x0, 0x9, 0xc, 0x5, 0x400, 0x6, 0xffc7, 0xff, 0x4024, 0x7ff, 0x6, 0xfffffffffffffff9, 0x9, 0x4, 0x4, 0x11cb, 0x9, 0x5, 0x8, 0x7, 0x0, 0x1, 0x7, 0x13, 0x9, 0x0, 0xfffffffffffffffb, 0x8, 0x8000000000000000, 0x6, 0x3, 0x6, 0x6, 0x3, 0x398d, 0x200, 0x7cc2, 0x5f7d, 0x1d, 0x8, 0x7fff, 0x8, 0xb, 0x81, 0x6, 0x7fffffff, 0x800, 0x8, 0x0, 0x6, 0x7, 0x0, 0x80000001, 0x7ff, 0x6, 0x4, 0x2, 0xffffffff, 0x2, 0x3, 0x4, 0xd3b8, 0x2, 0x2, 0x3, 0x8d, 0x1, 0x0, 0x7, 0x47, 0xc08b, 0x1000, 0x100000001, 0x0, 0xb, 0x7a6c, 0x7, 0x100000000, 0x0, 0x3, 0x10000, 0x0, 0x0, 0x4, 0x200, 0x5, 0x7f, 0x5, 0xffffffffffffff1e, 0x8, 0xcf, 0xffffffffffffffff, 0xff, 0x8f2, 0x6, 0x1, 0x5]}) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0xd7) 6m7.962398278s ago: executing program 1 (id=131): r0 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r1 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616}) ioctl$KVM_REGISTER_COALESCED_MMIO(r3, 0x4010ae67, &(0x7f0000000180)={0xeeee0000}) r4 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000000)={0x48, 0xdddd1000, 0x0, r7}) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x1c9700, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x19) r11 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) r12 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r11, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f0000000240)="fb0149dd833be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8faa767969d22627e700", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r11, 0x0) r13 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0) mmap$KVM_VCPU(&(0x7f0000c0f000/0x4000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x6030000000100028, 0x0}) syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CREATE_VM(r13, 0x401c5820, 0x20000007) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x12) close(r7) close(r6) ioctl$KVM_RUN(r4, 0xae80, 0x0) 5m59.853817552s ago: executing program 0 (id=133): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2e) (async) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x400, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x3d) r2 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x8) syz_kvm_setup_cpu$arm64(r0, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000100)=[{0x0, 0x0}], 0x1, 0x0, &(0x7f00000003c0)=[@featur2={0x1, 0x17}], 0x1) (async) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000080)=@arm64_core={0x603000000010002c, &(0x7f0000000000)=0x801b}) 5m59.123282114s ago: executing program 1 (id=134): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x80000001d) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x18, {"7f2003d5"}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@mrs={0xbe, 0x18, {0x603000000013c017}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4040aea0, &(0x7f0000000000)=@arm64={0x7, 0x6, 0x4, '\x00', 0x2}) 5m54.851392756s ago: executing program 0 (id=135): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x36) ioctl$KVM_IRQ_LINE(r0, 0x4008ae61, &(0x7f0000000000)={0xf4b, 0x3b}) r1 = eventfd2(0x7f60, 0x1) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f0000000040)={0x249, 0xa000, 0x4, r1, 0xe}) r2 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece) r3 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000bff000/0x400000)=nil) ioctl$KVM_IOEVENTFD(r0, 0x4040ae79, &(0x7f0000000080)={0x8, 0x2000, 0x8, r2, 0x8}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f00000000c0)) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000100)={0x6, 0xffffffffffffffff, 0x1}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000140)={0x8, 0xeeee8000, 0x2, r2, 0x1}) ioctl$KVM_ASSIGN_SET_MSIX_NR(r0, 0x4008ae73, &(0x7f0000000180)={0xffffffff, 0x1}) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x6) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x300, 0x0) r5 = ioctl$KVM_GET_STATS_FD_vm(r2, 0xaece) r6 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, r6, 0x1, 0x10, r5, 0x0) ioctl$KVM_S390_VCPU_FAULT(r5, 0x4008ae52, &(0x7f0000000200)=0xfa) r7 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000480)={0x0, &(0x7f0000000240)=[@eret={0xe6, 0x18, 0xf3d7}, @uexit={0x0, 0x18, 0xe1a2}, @irq_setup={0x46, 0x18, {0x2, 0x3c3}}, @hvc={0x32, 0x40, {0x80000002, [0x8, 0x9c, 0x8, 0x80000000, 0x6]}}, @mrs={0xbe, 0x18, {0x774a1a4bb2a6e807}}, @uexit={0x0, 0x18, 0x7ff}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x223}}, @svc={0x122, 0x40, {0x84000013, [0x401, 0xf, 0x7, 0x4, 0x10000]}}, @code={0xa, 0x9c, {"60a29ad20060b8f2410180d2c20080d2430180d2a40080d2020000d420a184d20000b0f2610180d2220180d2630080d2640080d2020000d4407a9dd20080b8f2e10180d2220080d2a30080d2240180d2020000d4000028d5a0be9cd200a0b0f2210080d2820080d2430080d2040080d2020000d400004048000008d5007008d5007008d51f4000d5"}}, @smc={0x1e, 0x40, {0x40000000, [0x100000001, 0x33f, 0x8, 0x0, 0x4]}}, @mrs={0xbe, 0x18, {0x603000000013801f}}], 0x214}, &(0x7f00000004c0)=[@featur1={0x1, 0x3}], 0x1) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = eventfd2(0x6, 0x800) write$eventfd(r8, &(0x7f0000000500)=0x8, 0x8) mmap$KVM_VCPU(&(0x7f0000e5f000/0x2000)=nil, r6, 0x1000004, 0x110, r2, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_FINALIZE(r9, 0x4004aec2, &(0x7f0000000540)=0x1) ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) ioctl$KVM_ARM_PREFERRED_TARGET(0xffffffffffffffff, 0x8020aeaf, &(0x7f0000000580)) r10 = mmap$KVM_VCPU(&(0x7f0000df4000/0x4000)=nil, r6, 0x2, 0x1010, r7, 0x0) syz_memcpy_off$KVM_EXIT_MMIO(r10, 0x20, &(0x7f00000005c0)="928cb13dac083a89e20856d4e2112889203ffeb0f2515f55", 0x0, 0x18) ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) 5m50.912434041s ago: executing program 1 (id=136): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x1}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r1, 0xc008ae67, &(0x7f0000000080)={0x2, 0xc}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@msr={0x14, 0x20, {0x603000000013df7f, 0x8000}}], 0x20}, &(0x7f0000000280)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000000c0)={0x1, 0x298, 0x1}}) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x1, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) mmap$KVM_VCPU(0x0, 0x50000, 0x3, 0x11, r12, 0x0) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x3) syz_kvm_vgic_v3_setup(r14, 0x5, 0x1e0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r15, 0x4018aee1, &(0x7f0000000100)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0x31}) ioctl$KVM_GET_VCPU_EVENTS(r15, 0x4018aee2, &(0x7f0000000180)) syz_kvm_vgic_v3_setup(r7, 0x1, 0x180) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r9, 0x4018aee1, &(0x7f0000000040)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000000100)=0x80019}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x7}) 5m49.791811967s ago: executing program 0 (id=137): r0 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000080)="fb4149dd033b010000807bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67525673312b01b07800000000002627e700000000000000020000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x12, r2, 0x0) r4 = eventfd2(0x70, 0x0) close(r4) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0) write$eventfd(r4, &(0x7f0000000100)=0xfffffffffffffffe, 0x8) r5 = eventfd2(0x0, 0x0) close(r5) r6 = eventfd2(0x0, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) close(r6) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xc0c82, 0x0) mmap$KVM_VCPU(&(0x7f0000008000/0x3000)=nil, 0x930, 0x2000004, 0x2011, r6, 0x0) mmap$KVM_VCPU(&(0x7f0000008000/0x3000)=nil, 0x930, 0x2000004, 0x2011, r5, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_REGS(r2, 0x8360ae81, &(0x7f0000000140)) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x2000001, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x0) 5m39.564427962s ago: executing program 0 (id=138): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000240)={0x0, &(0x7f0000000400)=[@its_setup={0x82, 0x28, {0x2, 0x0, 0x19f}}, @msr={0x14, 0x20, {0x603000000013e005, 0x72}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffd0, 0xff, 0xe}}, @uexit={0x0, 0x18, 0x3}, @svc={0x122, 0x40, {0x84000050, [0x7, 0x3, 0x7, 0x0, 0x17a]}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x0, 0x4, 0xb, 0x0, 0x3, 0x4}}, @memwrite={0x6e, 0x30, @generic={0xffff1000, 0x87c, 0x7, 0x4}}, @mrs={0xbe, 0x18, {0x603000000013df5e}}, @mrs={0xbe, 0x18, {0x603000000013c005}}, @eret={0xe6, 0x18}], 0x170}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_vgic_v3_setup(r1, 0x4, 0x20) mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, 0x930, 0x1, 0x13, r2, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r2, 0x4018aee2, &(0x7f00000001c0)=@attr_pmu_filter={0x0, 0x0, 0x2, 0x0}) 5m36.126943951s ago: executing program 1 (id=139): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000040)={0x1fd, 0x2, 0xffffffff, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_GET_ONE_REG(r4, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013c807, &(0x7f0000000280)=0x1}) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000001c0)=@x86={0x67, 0x1, 0xb, 0x0, 0x0, 0x7, 0x1, 0xf, 0xa3, 0x0, 0x6, 0xaa, 0x0, 0x3, 0x6, 0x8, 0x9f, 0x4, 0x9, '\x00', 0x1, 0x1}) write$eventfd(r8, &(0x7f00000001c0)=0x9, 0x5d) 5m28.439503379s ago: executing program 0 (id=140): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x80000001d) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x18, {"7f2003d5"}}], 0x18}, 0x0, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r4, 0xc008ae67, &(0x7f0000000100)={0x0, 0x81}) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@mrs={0xbe, 0x18, {0x603000000013c017}}], 0x18}, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f0000000000)=@arm64={0x7, 0x6, 0x4, '\x00', 0x2}) 5m22.642084115s ago: executing program 0 (id=141): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x2401, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) ioctl$KVM_ARM_VCPU_FINALIZE(r3, 0x4004aec2, &(0x7f0000000180)=0x4) ioctl$KVM_ARM_VCPU_FINALIZE(r3, 0x4004aec2, &(0x7f0000000040)=0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x8900, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x24) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013c801, &(0x7f0000000080)=0xfffffffffffffff8}) 5m18.53627726s ago: executing program 1 (id=142): r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000640)={0x0, &(0x7f0000000000)=[@msr={0x14, 0x20, {0x603000000013c2a9, 0x8}}, @mrs={0xbe, 0x18, {0x603000000013de95}}, @msr={0x14, 0x20, {0x603000000013e720, 0xe}}, @code={0xa, 0x84, {"0000201e008008d5000008d50000003380368dd200c0b8f2810180d2020180d2a30180d2440080d2020000d4007008d50000006a007008d5807e88d20040b0f2010180d2020080d2630180d2040180d2020000d400f588d20060b0f2e10080d2c20080d2630080d2640180d2020000d4"}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x3, 0xd, 0x10, 0x100, 0x2}}, @hvc={0x32, 0x40, {0x80008000, [0x8, 0xdb1, 0xf97c, 0xc, 0x5]}}, @mrs={0xbe, 0x18, {0x603000000013df5a}}, @mrs={0xbe, 0x18, {0x603000000013e132}}, @msr={0x14, 0x20, {0x603000000013c082, 0x21}}, @mrs={0xbe, 0x18, {0x603000000013f081}}, @msr={0x14, 0x20, {0x603000000013f208}}, @hvc={0x32, 0x40, {0x6000000, [0x7, 0x8, 0x40, 0x1, 0x7fff]}}, @its_setup={0x82, 0x28, {0x7, 0x4, 0x2a}}, @eret={0xe6, 0x18, 0x1}, @msr={0x14, 0x20, {0x603000000013c65d, 0x5}}, @smc={0x1e, 0x40, {0xc4000010, [0x3, 0x2, 0x5, 0x9, 0x7]}}, @code={0xa, 0xcc, {"805089d20080b0f2410080d2a20080d2c30080d2e40080d2020000d4801890d20040b0f2a10080d2820080d2c30080d2240180d2020000d4605d9dd20020b8f2010180d2e20080d2030180d2640080d2020000d4a08194d200c0b0f2210080d2020180d2830080d2040080d2020000d420a584d20000b8f2810080d2620080d2630180d2240180d2020000d400f8a15e002e8ed200e0b0f2210180d2c20180d2830080d2240080d2020000d4007008d5007008d5008008d5"}}, @code={0xa, 0x84, {"0084200e007008d5007c209bc00f83d20000b0f2810080d2e20080d2630080d2240180d2020000d400118ed200e0b0f2a10180d2820180d2230080d2640180d2020000d4a0019fd20040b0f2c10180d2820180d2e30180d2c40080d2020000d4008008d5000000b10008607c007008d5"}}, @uexit={0x0, 0x18, 0x2}, @code={0xa, 0x9c, {"00a4c00d0060200d008008d5601d9fd200c0b0f2010180d2c20080d2a30080d2440080d2020000d4807995d20080b0f2e10180d2820180d2c30080d2a40080d2020000d4c0d497d20080b0f2c10080d2420080d2e30080d2040180d2020000d4005c202e000008d5007008d5e0dd9cd20080b0f2010180d2e20180d2e30080d2640180d2020000d4"}}, @smc={0x1e, 0x40, {0x32000000, [0x3, 0x5, 0x9, 0xffffffffffffffff, 0x100]}}, @svc={0x122, 0x40, {0x84000053, [0x9, 0x1, 0xd1c, 0xe5d, 0x56bb85b1]}}, @msr={0x14, 0x20, {0x603000000013801e, 0xffff}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x1, 0x1, 0x100, 0x5, 0x2}}, @code={0xa, 0x6c, {"005cc09a00609f0d007008d5009c004f00bc200e0004407c00a0000f400392d200e0b8f2810180d2820080d2030080d2c40180d2020000d4007008d5e0df90d20040b0f2a10180d2e20080d2630180d2440080d2020000d4"}}, @mrs={0xbe, 0x18, {0x603000000013c112}}, @irq_setup={0x46, 0x18, {0x4, 0x182}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x4, 0xd, 0x3, 0x6259, 0x1}}], 0x63c}, &(0x7f0000000680)=[@featur2={0x1, 0x64}], 0x1) mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, r0, 0x2000008, 0x10, r1, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x101002, 0x0) (async) r3 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000cc0)={0x0, &(0x7f0000000700)=[@its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x2, 0xa, 0x0, 0x6, 0x4}}, @uexit={0x0, 0x18, 0x5}, @eret={0xe6, 0x18, 0xb}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x2, 0xe, 0x1, 0x9, 0x1}}, @uexit={0x0, 0x18, 0x54f}, @mrs={0xbe, 0x18, {0x603000000013c208}}, @code={0xa, 0xe4, {"007008d520c994d200a0b8f2e10180d2820080d2430080d2a40180d2020000d4007008d5803a98d20000b8f2c10080d2a20180d2430180d2840180d2020000d4000008d5802f88d200c0b8f2a10180d2a20080d2230180d2640180d2020000d4c00097d20040b0f2e10180d2c20080d2a30080d2a40080d2020000d4602688d200c0b8f2a10080d2620180d2430080d2640180d2020000d4203c9dd20060b0f2210180d2420180d2830080d2a40080d2020000d460f59ed20020b8f2a10180d2220080d2430180d2c40180d2020000d4"}}, @svc={0x122, 0x40, {0xc4000012, [0x9, 0x10, 0x200, 0x2, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x1, 0x1, 0x4, 0xbd, 0x10, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c608}}, @its_setup={0x82, 0x28, {0x4, 0x2, 0x3d6}}, @memwrite={0x6e, 0x30, @generic={0xc000, 0xf42, 0x5d, 0x2}}, @eret={0xe6, 0x18}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0xffd0, 0x80000001, 0x4}}, @smc={0x1e, 0x40, {0x80008000, [0x4, 0x6, 0xe, 0x2, 0x101]}}, @mrs={0xbe, 0x18, {0x603000000013df62}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xfffc, 0x8, 0x2}}, @eret={0xe6, 0x18, 0x400}, @irq_setup={0x46, 0x18, {0x0, 0x294}}, @irq_setup={0x46, 0x18, {0x0, 0x32b}}, @smc={0x1e, 0x40, {0xc400000e, [0x9, 0x4, 0x6, 0x3, 0x1]}}, @msr={0x14, 0x20, {0x0, 0x575}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x2, 0xc, 0x4, 0xf474, 0x2}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x106}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x223}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x1, 0x4, 0x9, 0x58bc, 0x2a}}, @its_setup={0x82, 0x28, {0x4, 0x3, 0x49}}, @hvc={0x32, 0x40, {0x8400000f, [0x1, 0x8, 0x80000001, 0x2, 0x7]}}, @mrs={0xbe, 0x18, {0x603000000013c64b}}, @hvc={0x32, 0x40, {0xc400000c, [0x7, 0x40, 0x7, 0x8, 0x2]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x100, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x2, 0xc, 0x3, 0x1}}], 0x59c}, &(0x7f0000000d00)=[@featur2={0x1, 0x8}], 0x1) (async) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000d40)={0xd, 0xf8}) (async) r5 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000f40)={0x0, &(0x7f0000000d80)=[@smc={0x1e, 0x40, {0xc4000007, [0x2, 0x7, 0x0, 0x1, 0xffffffff80000001]}}, @smc={0x1e, 0x40, {0x84000008, [0x0, 0x8eb, 0x8, 0xffffffffffffffff, 0xa63f]}}, @uexit={0x0, 0x18, 0x8}, @code={0xa, 0x9c, {"000028d5007008d580bc89d20000b8f2e10180d2e20180d2a30080d2c40180d2020000d4e00898d20020b8f2a10080d2420180d2830180d2240080d2020000d40060a00d20799fd20040b8f2410180d2220080d2630180d2a40180d2020000d40000c0ac007008d5e00a98d20060b0f2a10080d2020180d2830180d2640180d2020000d400a0200e"}}, @svc={0x122, 0x40, {0x5000000, [0x6, 0x1, 0x4f4, 0x7, 0x5]}}, @smc={0x1e, 0x40, {0x80008000, [0x3, 0x2, 0xf, 0x62, 0x1c7f6f51]}}], 0x1b4}, &(0x7f0000000f80)=[@featur2={0x1, 0x5f}], 0x1) (async) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4000ae84, &(0x7f0000000fc0)={{0x6000, 0xf000, 0x8, 0x59, 0x3, 0x3, 0x6, 0x4, 0x9, 0x81, 0x0, 0x7}, {0x9000, 0x1, 0x0, 0xcd, 0xab, 0x5, 0xf0, 0x7, 0x2, 0x0, 0x1, 0x1}, {0xa000, 0x30000, 0xf, 0x6, 0x26, 0x6e, 0xc, 0x3, 0x9, 0x57, 0x3}, {0x1a000, 0x80a0000, 0x3, 0x4, 0x0, 0x1, 0x2, 0xda, 0x5, 0x1, 0xc}, {0x58000, 0x6000, 0x9, 0x0, 0x5, 0xf, 0x4f, 0x5, 0x5, 0xe, 0x0, 0x24}, {0x30000, 0x4, 0xa, 0xde, 0x92, 0x2, 0x6, 0xe, 0xc, 0x8, 0xcc, 0x2}, {0xeeee8000, 0xeeef0000, 0xd, 0x8, 0x7, 0xc8, 0x7, 0x5, 0x5, 0x7, 0x2, 0x3}, {0xfec00000, 0x3000, 0xb, 0x9a, 0x5, 0x9, 0xf4, 0x5, 0x3, 0x8a, 0x9, 0xc}, {0x80a0000, 0xff}, {0x8080000, 0x5}, 0x40000, 0x0, 0x5000, 0x400, 0x1, 0x4801, 0xffffd000, [0x7, 0x8556, 0x7, 0x6]}) (async) ioctl$KVM_ARM_PREFERRED_TARGET(r5, 0x8020aeaf, &(0x7f0000001100)) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f0000001180)=@riscv64_timer={0xd1c256085c338487, &(0x7f0000001140)=0x5}) r7 = ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece) (async) r8 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000001380)={0x0, &(0x7f00000011c0)=[@mrs={0xbe, 0x18, {0x603000000013806d}}, @smc={0x1e, 0x40, {0x80000001, [0x84e, 0xb02, 0x6, 0x1, 0x6]}}, @irq_setup={0x46, 0x18, {0x3, 0x340}}, @code={0xa, 0x84, {"000028d5808384d20000b0f2810080d2c20080d2430080d2e40080d2020000d4007008d50020bf0d205282d20080b8f2810180d2820180d2c30180d2840180d2020000d40040400c20e986d20020b0f2810180d2220180d2c30180d2240180d2020000d400e4000f008040c8000820f8"}}, @svc={0x122, 0x40, {0x32000000, [0xffffffffffff8001, 0x8, 0x8001, 0x100000000, 0x6]}}, @its_setup={0x82, 0x28, {0x0, 0x2, 0x16}}, @eret={0xe6, 0x18, 0x10}, @uexit={0x0, 0x18, 0x6}], 0x18c}, &(0x7f00000013c0)=[@featur2={0x1, 0x80}], 0x1) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000001880)=[{0x0, &(0x7f0000001400)=[@its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x0, 0xf, 0xb5, 0x1e}}, @irq_setup={0x46, 0x18, {0x4, 0x34a}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x0, 0x800000000000, 0xe}}, @irq_setup={0x46, 0x18, {0x4, 0x19f}}, @uexit={0x0, 0x18, 0x6}, @mrs={0xbe, 0x18, {0x603000000013c288}}, @mrs={0xbe, 0x18, {0x603000000013debb}}, @msr={0x14, 0x20, {0x603000000013e005, 0x3}}, @its_setup={0x82, 0x28, {0x2, 0x4, 0x8}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x2, 0x9, 0x62f, 0x3, 0x1}}, @irq_setup={0x46, 0x18, {0x0, 0x17}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x0, 0xe, 0x8, 0xff, 0x2}}, @memwrite={0x6e, 0x30, @generic={0xffff1000, 0x58a, 0xb1, 0x4}}, @hvc={0x32, 0x40, {0x8400000f, [0x206, 0x78cd, 0x3, 0x334, 0x7]}}, @eret={0xe6, 0x18, 0x100000000}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x10040, 0x8000}}, @hvc={0x32, 0x40, {0x30000000, [0xa09, 0x0, 0x0, 0x297b, 0x7]}}, @its_setup={0x82, 0x28, {0x3, 0x2, 0xc4}}, @msr={0x14, 0x20, {0x603000000013fa77, 0x5d7}}, @its_setup={0x82, 0x28, {0x1, 0x2, 0x3a8}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x3, 0xb, 0x18000, 0x8000, 0x1}}, @code={0xa, 0x54, {"008008d5603f9bd20080b0f2c10180d2420080d2e30080d2840080d2020000d4002cc09a00a0202e0080c0c8000028d5007008d50070004f008008d500a0600d"}}, @code={0xa, 0x84, {"00a4ff0d000080720004809a00b8202e0100a0d4e09390d200a0b0f2210180d2420180d2630180d2e40080d2020000d4c01198d20060b0f2810180d2220180d2030180d2840080d2020000d4c04496d20040b0f2010080d2a20180d2230180d2840180d2020000d4007008d50088205e"}}, @hvc={0x32, 0x40, {0x84000008, [0x9, 0x1, 0xe21f, 0x7, 0x1e8e08e3]}}, @memwrite={0x6e, 0x30, @generic={0xeeee0000, 0x399, 0x9, 0xe}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x3, 0xd, 0x9, 0x394bb8ad, 0x4}}], 0x480}], 0x1, 0x0, &(0x7f00000018c0)=[@featur2={0x1, 0x49}], 0x1) r9 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000001b40)={0x0, &(0x7f0000001900)=[@uexit={0x0, 0x18, 0x7}, @mrs={0xbe, 0x18, {0x60300000001383ce}}, @uexit={0x0, 0x18, 0x3ff}, @irq_setup={0x46, 0x18, {0x3, 0xbf}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x40, 0x4}}, @irq_setup={0x46, 0x18, {0x0, 0x25b}}, @msr={0x14, 0x20, {0x603000000013df01, 0x7fff}}, @eret={0xe6, 0x18, 0x2f}, @hvc={0x32, 0x40, {0x5000000, [0x56, 0xe, 0x8, 0x400, 0x6]}}, @eret={0xe6, 0x18, 0x7fffffff}, @eret={0xe6, 0x18, 0x9}, @uexit={0x0, 0x18, 0xe}, @mrs={0xbe, 0x18, {0x603000000013df61}}, @eret={0xe6, 0x18, 0x401}, @smc={0x1e, 0x40, {0x8, [0x1, 0x6, 0x3, 0x6, 0x8]}}, @msr={0x14, 0x20, {0x603000000013dee8, 0x2c}}, @smc={0x1e, 0x40, {0x86000001, [0x8, 0x6, 0x7, 0x4, 0x9]}}], 0x238}, &(0x7f0000001b80)=[@featur1={0x1, 0x40}], 0x1) ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f0000001c00)=@riscv64_smstateen_csr={0x0, &(0x7f0000001bc0)=0x9}) (async) ioctl$KVM_DIRTY_TLB(0xffffffffffffffff, 0x4010aeaa, &(0x7f0000001c40)={0x3, 0x5}) (async, rerun: 64) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x34) (rerun: 64) write$eventfd(r7, &(0x7f0000001c80)=0x2, 0x8) (async, rerun: 32) ioctl$KVM_ARM_PREFERRED_TARGET(r5, 0x8020aeaf, &(0x7f0000001cc0)) (async, rerun: 32) ioctl$KVM_SET_REGS(r8, 0x4360ae82, &(0x7f0000001d00)={[0x76, 0x3, 0x100, 0xb, 0x5, 0x100, 0x8, 0x0, 0x51332355, 0x101, 0x401, 0x2, 0x3, 0x0, 0x4000000000000000, 0x6], 0xffffffff, 0x20000}) (async, rerun: 32) write$eventfd(r7, &(0x7f0000001dc0)=0x401, 0x8) (rerun: 32) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000001e40)=@arm64_ccsidr={0x602000000011000d, &(0x7f0000001e00)=0x8}) (async) ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f0000001e80)) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000001ec0)=@attr_pvtime_ipa={0x0, 0x2, 0x0, 0x5}) (async) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000001f00)={0x5, 0xffffffffffffffff, 0x1}) (async, rerun: 32) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000001f80)=@riscv64_smstateen_csr={0x0, &(0x7f0000001f40)=0x8}) (rerun: 32) ioctl$KVM_S390_VCPU_FAULT(r7, 0x4008ae52, &(0x7f0000001fc0)=0x5) (async) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r6, 0x4018aee2, &(0x7f0000002040)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000002000)=0x11}) 4m36.395615716s ago: executing program 32 (id=141): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x2401, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r3, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) ioctl$KVM_ARM_VCPU_FINALIZE(r3, 0x4004aec2, &(0x7f0000000180)=0x4) ioctl$KVM_ARM_VCPU_FINALIZE(r3, 0x4004aec2, &(0x7f0000000040)=0x4) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x8900, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x24) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013c801, &(0x7f0000000080)=0xfffffffffffffff8}) 4m32.545314673s ago: executing program 33 (id=142): r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000640)={0x0, &(0x7f0000000000)=[@msr={0x14, 0x20, {0x603000000013c2a9, 0x8}}, @mrs={0xbe, 0x18, {0x603000000013de95}}, @msr={0x14, 0x20, {0x603000000013e720, 0xe}}, @code={0xa, 0x84, {"0000201e008008d5000008d50000003380368dd200c0b8f2810180d2020180d2a30180d2440080d2020000d4007008d50000006a007008d5807e88d20040b0f2010180d2020080d2630180d2040180d2020000d400f588d20060b0f2e10080d2c20080d2630080d2640180d2020000d4"}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x3, 0xd, 0x10, 0x100, 0x2}}, @hvc={0x32, 0x40, {0x80008000, [0x8, 0xdb1, 0xf97c, 0xc, 0x5]}}, @mrs={0xbe, 0x18, {0x603000000013df5a}}, @mrs={0xbe, 0x18, {0x603000000013e132}}, @msr={0x14, 0x20, {0x603000000013c082, 0x21}}, @mrs={0xbe, 0x18, {0x603000000013f081}}, @msr={0x14, 0x20, {0x603000000013f208}}, @hvc={0x32, 0x40, {0x6000000, [0x7, 0x8, 0x40, 0x1, 0x7fff]}}, @its_setup={0x82, 0x28, {0x7, 0x4, 0x2a}}, @eret={0xe6, 0x18, 0x1}, @msr={0x14, 0x20, {0x603000000013c65d, 0x5}}, @smc={0x1e, 0x40, {0xc4000010, [0x3, 0x2, 0x5, 0x9, 0x7]}}, @code={0xa, 0xcc, {"805089d20080b0f2410080d2a20080d2c30080d2e40080d2020000d4801890d20040b0f2a10080d2820080d2c30080d2240180d2020000d4605d9dd20020b8f2010180d2e20080d2030180d2640080d2020000d4a08194d200c0b0f2210080d2020180d2830080d2040080d2020000d420a584d20000b8f2810080d2620080d2630180d2240180d2020000d400f8a15e002e8ed200e0b0f2210180d2c20180d2830080d2240080d2020000d4007008d5007008d5008008d5"}}, @code={0xa, 0x84, {"0084200e007008d5007c209bc00f83d20000b0f2810080d2e20080d2630080d2240180d2020000d400118ed200e0b0f2a10180d2820180d2230080d2640180d2020000d4a0019fd20040b0f2c10180d2820180d2e30180d2c40080d2020000d4008008d5000000b10008607c007008d5"}}, @uexit={0x0, 0x18, 0x2}, @code={0xa, 0x9c, {"00a4c00d0060200d008008d5601d9fd200c0b0f2010180d2c20080d2a30080d2440080d2020000d4807995d20080b0f2e10180d2820180d2c30080d2a40080d2020000d4c0d497d20080b0f2c10080d2420080d2e30080d2040180d2020000d4005c202e000008d5007008d5e0dd9cd20080b0f2010180d2e20180d2e30080d2640180d2020000d4"}}, @smc={0x1e, 0x40, {0x32000000, [0x3, 0x5, 0x9, 0xffffffffffffffff, 0x100]}}, @svc={0x122, 0x40, {0x84000053, [0x9, 0x1, 0xd1c, 0xe5d, 0x56bb85b1]}}, @msr={0x14, 0x20, {0x603000000013801e, 0xffff}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x1, 0x1, 0x100, 0x5, 0x2}}, @code={0xa, 0x6c, {"005cc09a00609f0d007008d5009c004f00bc200e0004407c00a0000f400392d200e0b8f2810180d2820080d2030080d2c40180d2020000d4007008d5e0df90d20040b0f2a10180d2e20080d2630180d2440080d2020000d4"}}, @mrs={0xbe, 0x18, {0x603000000013c112}}, @irq_setup={0x46, 0x18, {0x4, 0x182}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x4, 0xd, 0x3, 0x6259, 0x1}}], 0x63c}, &(0x7f0000000680)=[@featur2={0x1, 0x64}], 0x1) mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, r0, 0x2000008, 0x10, r1, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0), 0x101002, 0x0) (async) r3 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000cc0)={0x0, &(0x7f0000000700)=[@its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x2, 0xa, 0x0, 0x6, 0x4}}, @uexit={0x0, 0x18, 0x5}, @eret={0xe6, 0x18, 0xb}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x2, 0xe, 0x1, 0x9, 0x1}}, @uexit={0x0, 0x18, 0x54f}, @mrs={0xbe, 0x18, {0x603000000013c208}}, @code={0xa, 0xe4, {"007008d520c994d200a0b8f2e10180d2820080d2430080d2a40180d2020000d4007008d5803a98d20000b8f2c10080d2a20180d2430180d2840180d2020000d4000008d5802f88d200c0b8f2a10180d2a20080d2230180d2640180d2020000d4c00097d20040b0f2e10180d2c20080d2a30080d2a40080d2020000d4602688d200c0b8f2a10080d2620180d2430080d2640180d2020000d4203c9dd20060b0f2210180d2420180d2830080d2a40080d2020000d460f59ed20020b8f2a10180d2220080d2430180d2c40180d2020000d4"}}, @svc={0x122, 0x40, {0xc4000012, [0x9, 0x10, 0x200, 0x2, 0x5]}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x1, 0x1, 0x4, 0xbd, 0x10, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013c608}}, @its_setup={0x82, 0x28, {0x4, 0x2, 0x3d6}}, @memwrite={0x6e, 0x30, @generic={0xc000, 0xf42, 0x5d, 0x2}}, @eret={0xe6, 0x18}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0xffd0, 0x80000001, 0x4}}, @smc={0x1e, 0x40, {0x80008000, [0x4, 0x6, 0xe, 0x2, 0x101]}}, @mrs={0xbe, 0x18, {0x603000000013df62}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xfffc, 0x8, 0x2}}, @eret={0xe6, 0x18, 0x400}, @irq_setup={0x46, 0x18, {0x0, 0x294}}, @irq_setup={0x46, 0x18, {0x0, 0x32b}}, @smc={0x1e, 0x40, {0xc400000e, [0x9, 0x4, 0x6, 0x3, 0x1]}}, @msr={0x14, 0x20, {0x0, 0x575}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x2, 0xc, 0x4, 0xf474, 0x2}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x106}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x223}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x1, 0x4, 0x9, 0x58bc, 0x2a}}, @its_setup={0x82, 0x28, {0x4, 0x3, 0x49}}, @hvc={0x32, 0x40, {0x8400000f, [0x1, 0x8, 0x80000001, 0x2, 0x7]}}, @mrs={0xbe, 0x18, {0x603000000013c64b}}, @hvc={0x32, 0x40, {0xc400000c, [0x7, 0x40, 0x7, 0x8, 0x2]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x100, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x2, 0xc, 0x3, 0x1}}], 0x59c}, &(0x7f0000000d00)=[@featur2={0x1, 0x8}], 0x1) (async) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000d40)={0xd, 0xf8}) (async) r5 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000f40)={0x0, &(0x7f0000000d80)=[@smc={0x1e, 0x40, {0xc4000007, [0x2, 0x7, 0x0, 0x1, 0xffffffff80000001]}}, @smc={0x1e, 0x40, {0x84000008, [0x0, 0x8eb, 0x8, 0xffffffffffffffff, 0xa63f]}}, @uexit={0x0, 0x18, 0x8}, @code={0xa, 0x9c, {"000028d5007008d580bc89d20000b8f2e10180d2e20180d2a30080d2c40180d2020000d4e00898d20020b8f2a10080d2420180d2830180d2240080d2020000d40060a00d20799fd20040b8f2410180d2220080d2630180d2a40180d2020000d40000c0ac007008d5e00a98d20060b0f2a10080d2020180d2830180d2640180d2020000d400a0200e"}}, @svc={0x122, 0x40, {0x5000000, [0x6, 0x1, 0x4f4, 0x7, 0x5]}}, @smc={0x1e, 0x40, {0x80008000, [0x3, 0x2, 0xf, 0x62, 0x1c7f6f51]}}], 0x1b4}, &(0x7f0000000f80)=[@featur2={0x1, 0x5f}], 0x1) (async) r6 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4000ae84, &(0x7f0000000fc0)={{0x6000, 0xf000, 0x8, 0x59, 0x3, 0x3, 0x6, 0x4, 0x9, 0x81, 0x0, 0x7}, {0x9000, 0x1, 0x0, 0xcd, 0xab, 0x5, 0xf0, 0x7, 0x2, 0x0, 0x1, 0x1}, {0xa000, 0x30000, 0xf, 0x6, 0x26, 0x6e, 0xc, 0x3, 0x9, 0x57, 0x3}, {0x1a000, 0x80a0000, 0x3, 0x4, 0x0, 0x1, 0x2, 0xda, 0x5, 0x1, 0xc}, {0x58000, 0x6000, 0x9, 0x0, 0x5, 0xf, 0x4f, 0x5, 0x5, 0xe, 0x0, 0x24}, {0x30000, 0x4, 0xa, 0xde, 0x92, 0x2, 0x6, 0xe, 0xc, 0x8, 0xcc, 0x2}, {0xeeee8000, 0xeeef0000, 0xd, 0x8, 0x7, 0xc8, 0x7, 0x5, 0x5, 0x7, 0x2, 0x3}, {0xfec00000, 0x3000, 0xb, 0x9a, 0x5, 0x9, 0xf4, 0x5, 0x3, 0x8a, 0x9, 0xc}, {0x80a0000, 0xff}, {0x8080000, 0x5}, 0x40000, 0x0, 0x5000, 0x400, 0x1, 0x4801, 0xffffd000, [0x7, 0x8556, 0x7, 0x6]}) (async) ioctl$KVM_ARM_PREFERRED_TARGET(r5, 0x8020aeaf, &(0x7f0000001100)) ioctl$KVM_GET_ONE_REG(r1, 0x4010aeab, &(0x7f0000001180)=@riscv64_timer={0xd1c256085c338487, &(0x7f0000001140)=0x5}) r7 = ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece) (async) r8 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000001380)={0x0, &(0x7f00000011c0)=[@mrs={0xbe, 0x18, {0x603000000013806d}}, @smc={0x1e, 0x40, {0x80000001, [0x84e, 0xb02, 0x6, 0x1, 0x6]}}, @irq_setup={0x46, 0x18, {0x3, 0x340}}, @code={0xa, 0x84, {"000028d5808384d20000b0f2810080d2c20080d2430080d2e40080d2020000d4007008d50020bf0d205282d20080b8f2810180d2820180d2c30180d2840180d2020000d40040400c20e986d20020b0f2810180d2220180d2c30180d2240180d2020000d400e4000f008040c8000820f8"}}, @svc={0x122, 0x40, {0x32000000, [0xffffffffffff8001, 0x8, 0x8001, 0x100000000, 0x6]}}, @its_setup={0x82, 0x28, {0x0, 0x2, 0x16}}, @eret={0xe6, 0x18, 0x10}, @uexit={0x0, 0x18, 0x6}], 0x18c}, &(0x7f00000013c0)=[@featur2={0x1, 0x80}], 0x1) syz_kvm_setup_cpu$arm64(r7, r8, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000001880)=[{0x0, &(0x7f0000001400)=[@its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x0, 0xf, 0xb5, 0x1e}}, @irq_setup={0x46, 0x18, {0x4, 0x34a}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x0, 0x800000000000, 0xe}}, @irq_setup={0x46, 0x18, {0x4, 0x19f}}, @uexit={0x0, 0x18, 0x6}, @mrs={0xbe, 0x18, {0x603000000013c288}}, @mrs={0xbe, 0x18, {0x603000000013debb}}, @msr={0x14, 0x20, {0x603000000013e005, 0x3}}, @its_setup={0x82, 0x28, {0x2, 0x4, 0x8}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x2, 0x9, 0x62f, 0x3, 0x1}}, @irq_setup={0x46, 0x18, {0x0, 0x17}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x0, 0xe, 0x8, 0xff, 0x2}}, @memwrite={0x6e, 0x30, @generic={0xffff1000, 0x58a, 0xb1, 0x4}}, @hvc={0x32, 0x40, {0x8400000f, [0x206, 0x78cd, 0x3, 0x334, 0x7]}}, @eret={0xe6, 0x18, 0x100000000}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x10040, 0x8000}}, @hvc={0x32, 0x40, {0x30000000, [0xa09, 0x0, 0x0, 0x297b, 0x7]}}, @its_setup={0x82, 0x28, {0x3, 0x2, 0xc4}}, @msr={0x14, 0x20, {0x603000000013fa77, 0x5d7}}, @its_setup={0x82, 0x28, {0x1, 0x2, 0x3a8}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x3, 0xb, 0x18000, 0x8000, 0x1}}, @code={0xa, 0x54, {"008008d5603f9bd20080b0f2c10180d2420080d2e30080d2840080d2020000d4002cc09a00a0202e0080c0c8000028d5007008d50070004f008008d500a0600d"}}, @code={0xa, 0x84, {"00a4ff0d000080720004809a00b8202e0100a0d4e09390d200a0b0f2210180d2420180d2630180d2e40080d2020000d4c01198d20060b0f2810180d2220180d2030180d2840080d2020000d4c04496d20040b0f2010080d2a20180d2230180d2840180d2020000d4007008d50088205e"}}, @hvc={0x32, 0x40, {0x84000008, [0x9, 0x1, 0xe21f, 0x7, 0x1e8e08e3]}}, @memwrite={0x6e, 0x30, @generic={0xeeee0000, 0x399, 0x9, 0xe}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x3, 0xd, 0x9, 0x394bb8ad, 0x4}}], 0x480}], 0x1, 0x0, &(0x7f00000018c0)=[@featur2={0x1, 0x49}], 0x1) r9 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000001b40)={0x0, &(0x7f0000001900)=[@uexit={0x0, 0x18, 0x7}, @mrs={0xbe, 0x18, {0x60300000001383ce}}, @uexit={0x0, 0x18, 0x3ff}, @irq_setup={0x46, 0x18, {0x3, 0xbf}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x40, 0x4}}, @irq_setup={0x46, 0x18, {0x0, 0x25b}}, @msr={0x14, 0x20, {0x603000000013df01, 0x7fff}}, @eret={0xe6, 0x18, 0x2f}, @hvc={0x32, 0x40, {0x5000000, [0x56, 0xe, 0x8, 0x400, 0x6]}}, @eret={0xe6, 0x18, 0x7fffffff}, @eret={0xe6, 0x18, 0x9}, @uexit={0x0, 0x18, 0xe}, @mrs={0xbe, 0x18, {0x603000000013df61}}, @eret={0xe6, 0x18, 0x401}, @smc={0x1e, 0x40, {0x8, [0x1, 0x6, 0x3, 0x6, 0x8]}}, @msr={0x14, 0x20, {0x603000000013dee8, 0x2c}}, @smc={0x1e, 0x40, {0x86000001, [0x8, 0x6, 0x7, 0x4, 0x9]}}], 0x238}, &(0x7f0000001b80)=[@featur1={0x1, 0x40}], 0x1) ioctl$KVM_GET_ONE_REG(r9, 0x4010aeab, &(0x7f0000001c00)=@riscv64_smstateen_csr={0x0, &(0x7f0000001bc0)=0x9}) (async) ioctl$KVM_DIRTY_TLB(0xffffffffffffffff, 0x4010aeaa, &(0x7f0000001c40)={0x3, 0x5}) (async, rerun: 64) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x34) (rerun: 64) write$eventfd(r7, &(0x7f0000001c80)=0x2, 0x8) (async, rerun: 32) ioctl$KVM_ARM_PREFERRED_TARGET(r5, 0x8020aeaf, &(0x7f0000001cc0)) (async, rerun: 32) ioctl$KVM_SET_REGS(r8, 0x4360ae82, &(0x7f0000001d00)={[0x76, 0x3, 0x100, 0xb, 0x5, 0x100, 0x8, 0x0, 0x51332355, 0x101, 0x401, 0x2, 0x3, 0x0, 0x4000000000000000, 0x6], 0xffffffff, 0x20000}) (async, rerun: 32) write$eventfd(r7, &(0x7f0000001dc0)=0x401, 0x8) (rerun: 32) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000001e40)=@arm64_ccsidr={0x602000000011000d, &(0x7f0000001e00)=0x8}) (async) ioctl$KVM_GET_MP_STATE(r1, 0x8004ae98, &(0x7f0000001e80)) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000001ec0)=@attr_pvtime_ipa={0x0, 0x2, 0x0, 0x5}) (async) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000001f00)={0x5, 0xffffffffffffffff, 0x1}) (async, rerun: 32) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000001f80)=@riscv64_smstateen_csr={0x0, &(0x7f0000001f40)=0x8}) (rerun: 32) ioctl$KVM_S390_VCPU_FAULT(r7, 0x4008ae52, &(0x7f0000001fc0)=0x5) (async) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r6, 0x4018aee2, &(0x7f0000002040)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000002000)=0x11}) 53.58486851s ago: executing program 2 (id=143): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x28a002, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) syz_kvm_vgic_v3_setup(r1, 0x5, 0x1e0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r5, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f0000000100)=@attr_pmu_irq={0x0, 0x0, 0x0, 0x0}) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000eef000/0x4000)=nil, 0x0, 0x100000f, 0x10, r2, 0x9000000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000e76000/0x12000)=nil, 0x12000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x7a) openat$kvm(0x0, &(0x7f0000000040), 0x2401, 0x0) 47.683660388s ago: executing program 3 (id=144): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x40) (async) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000000c0)=0xa) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.732964784s ago: executing program 34 (id=143): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x28a002, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) syz_kvm_vgic_v3_setup(r1, 0x5, 0x1e0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r5, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f0000000100)=@attr_pmu_irq={0x0, 0x0, 0x0, 0x0}) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000eef000/0x4000)=nil, 0x0, 0x100000f, 0x10, r2, 0x9000000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) munmap(&(0x7f0000e76000/0x12000)=nil, 0x12000) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x7a) openat$kvm(0x0, &(0x7f0000000040), 0x2401, 0x0) 0s ago: executing program 35 (id=144): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x40) (async) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f00000000c0)=0xa) ioctl$KVM_RUN(r3, 0xae80, 0x0) kernel console output (not intermixed with test programs): [ 362.289506][ T24] audit: type=1400 audit(361.530:78): avc: denied { write } for pid=3275 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 364.676080][ T3211] 8021q: adding VLAN 0 to HW filter on device bond0 [ 371.103938][ T24] audit: type=1400 audit(370.340:79): avc: denied { write } for pid=3283 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 375.565132][ T24] audit: type=1400 audit(374.810:80): avc: denied { write } for pid=3286 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 387.983506][ T24] audit: type=1400 audit(387.190:81): avc: denied { write } for pid=3291 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 392.894828][ T24] audit: type=1400 audit(392.100:82): avc: denied { write } for pid=3294 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 395.998522][ T3211] eql: remember to turn off Van-Jacobson compression on your slave devices [ 404.684066][ T24] audit: type=1400 audit(403.910:83): avc: denied { write } for pid=3300 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 408.071976][ T24] audit: type=1400 audit(407.260:84): avc: denied { write } for pid=3303 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 417.352027][ T24] audit: type=1400 audit(416.590:85): avc: denied { write } for pid=3308 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 420.796423][ T24] audit: type=1400 audit(420.030:86): avc: denied { write } for pid=3311 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 431.023376][ T24] audit: type=1400 audit(430.260:87): avc: denied { write } for pid=3316 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 434.713209][ T24] audit: type=1400 audit(433.950:88): avc: denied { write } for pid=3319 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 439.928321][ T24] audit: type=1400 audit(439.170:89): avc: denied { write } for pid=3322 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 443.352542][ T24] audit: type=1400 audit(442.590:90): avc: denied { write } for pid=3325 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 454.582687][ T24] audit: type=1400 audit(453.820:91): avc: denied { write } for pid=3329 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 458.625988][ T24] audit: type=1400 audit(457.870:92): avc: denied { write } for pid=3332 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 467.303856][ T24] audit: type=1400 audit(466.520:93): avc: denied { write } for pid=3336 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 470.781999][ T24] audit: type=1400 audit(470.010:94): avc: denied { write } for pid=3339 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 481.389414][ T24] audit: type=1400 audit(480.620:95): avc: denied { write } for pid=3344 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 484.956326][ T24] audit: type=1400 audit(484.200:96): avc: denied { write } for pid=3347 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 507.886995][ T24] audit: type=1400 audit(507.100:97): avc: denied { write } for pid=3358 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 512.676057][ T24] audit: type=1400 audit(511.920:98): avc: denied { write } for pid=3361 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 522.767827][ T24] audit: type=1400 audit(522.010:99): avc: denied { write } for pid=3364 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 526.309218][ T24] audit: type=1400 audit(525.550:100): avc: denied { write } for pid=3367 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:52966' (ED25519) to the list of known hosts. [ 559.585542][ T24] audit: type=1400 audit(558.830:101): avc: denied { name_bind } for pid=3372 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 560.452215][ T24] audit: type=1400 audit(559.690:102): avc: denied { execute } for pid=3373 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 560.483180][ T24] audit: type=1400 audit(559.720:103): avc: denied { execute_no_trans } for pid=3373 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 578.447455][ T24] audit: type=1400 audit(577.690:104): avc: denied { write } for pid=3374 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 580.563093][ T24] audit: type=1400 audit(579.780:105): avc: denied { write } for pid=3377 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 589.175363][ T24] audit: type=1400 audit(588.410:106): avc: denied { mounton } for pid=3373 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 589.208686][ T24] audit: type=1400 audit(588.450:107): avc: denied { mount } for pid=3373 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 589.285995][ T3373] cgroup: Unknown subsys name 'net' [ 589.337106][ T24] audit: type=1400 audit(588.580:108): avc: denied { unmount } for pid=3373 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 589.719083][ T3373] cgroup: Unknown subsys name 'cpuset' [ 589.826111][ T3373] cgroup: Unknown subsys name 'rlimit' [ 590.589212][ T24] audit: type=1400 audit(589.830:109): avc: denied { setattr } for pid=3373 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 590.607196][ T24] audit: type=1400 audit(589.850:110): avc: denied { mounton } for pid=3373 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 590.629532][ T24] audit: type=1400 audit(589.870:111): avc: denied { mount } for pid=3373 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 591.546766][ T3381] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 591.567180][ T24] audit: type=1400 audit(590.810:112): avc: denied { relabelto } for pid=3381 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 591.587125][ T24] audit: type=1400 audit(590.830:113): avc: denied { write } for pid=3381 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 591.758627][ T24] audit: type=1400 audit(591.000:114): avc: denied { read } for pid=3373 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 591.777829][ T24] audit: type=1400 audit(591.010:115): avc: denied { open } for pid=3373 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 591.819698][ T3373] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 644.534830][ T24] audit: type=1400 audit(643.780:116): avc: denied { execmem } for pid=3382 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 647.953047][ T24] audit: type=1400 audit(647.190:118): avc: denied { open } for pid=3385 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 647.969711][ T24] audit: type=1400 audit(647.180:117): avc: denied { read } for pid=3384 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 648.045705][ T24] audit: type=1400 audit(647.260:119): avc: denied { mounton } for pid=3385 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 648.234692][ T24] audit: type=1400 audit(647.480:120): avc: denied { module_request } for pid=3384 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 649.129743][ T24] audit: type=1400 audit(648.370:121): avc: denied { sys_module } for pid=3384 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 669.278621][ T3384] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.556417][ T3384] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 669.614000][ T3385] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.866491][ T3385] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 680.505473][ T3384] hsr_slave_0: entered promiscuous mode [ 680.532455][ T3384] hsr_slave_1: entered promiscuous mode [ 681.436486][ T3385] hsr_slave_0: entered promiscuous mode [ 681.467998][ T3385] hsr_slave_1: entered promiscuous mode [ 681.513867][ T3385] debugfs: 'hsr0' already exists in 'hsr' [ 681.522482][ T3385] Cannot create hsr debugfs directory [ 686.609724][ T24] audit: type=1400 audit(685.850:122): avc: denied { create } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 686.660387][ T24] audit: type=1400 audit(685.900:123): avc: denied { write } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 686.722474][ T24] audit: type=1400 audit(685.960:124): avc: denied { read } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 686.868431][ T3384] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 687.133235][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 687.243556][ T3384] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 687.435620][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 687.533876][ T3384] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 687.668584][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 687.832272][ T3384] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 687.899059][ T3384] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 689.225822][ T3385] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 689.352934][ T3385] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 689.399675][ T3385] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 689.526436][ T3385] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 689.605944][ T3385] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 689.738296][ T3385] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 689.828293][ T3385] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 690.053117][ T3385] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 704.627733][ T3384] 8021q: adding VLAN 0 to HW filter on device bond0 [ 706.695456][ T3385] 8021q: adding VLAN 0 to HW filter on device bond0 [ 748.033019][ T3384] veth0_vlan: entered promiscuous mode [ 748.493870][ T3384] veth1_vlan: entered promiscuous mode [ 750.104253][ T3384] veth0_macvtap: entered promiscuous mode [ 750.637520][ T3384] veth1_macvtap: entered promiscuous mode [ 751.264371][ T3385] veth0_vlan: entered promiscuous mode [ 752.313562][ T3385] veth1_vlan: entered promiscuous mode [ 753.556914][ T3461] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.626941][ T3461] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.632702][ T3461] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 753.776974][ T47] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 756.475338][ T3385] veth0_macvtap: entered promiscuous mode [ 756.634544][ T24] audit: type=1400 audit(755.870:125): avc: denied { mount } for pid=3384 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 756.827439][ T3385] veth1_macvtap: entered promiscuous mode [ 756.973818][ T24] audit: type=1400 audit(756.120:126): avc: denied { mounton } for pid=3384 comm="syz-executor" path="/syzkaller.zjv5km/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 757.280027][ T24] audit: type=1400 audit(756.520:127): avc: denied { mount } for pid=3384 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 757.748470][ T24] audit: type=1400 audit(756.990:128): avc: denied { mounton } for pid=3384 comm="syz-executor" path="/syzkaller.zjv5km/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 757.932982][ T24] audit: type=1400 audit(757.170:129): avc: denied { mounton } for pid=3384 comm="syz-executor" path="/syzkaller.zjv5km/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3740 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 758.855464][ T24] audit: type=1400 audit(758.020:130): avc: denied { unmount } for pid=3384 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 759.119426][ T24] audit: type=1400 audit(758.360:131): avc: denied { mounton } for pid=3384 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 759.293066][ T24] audit: type=1400 audit(758.520:132): avc: denied { mount } for pid=3384 comm="syz-executor" name="/" dev="gadgetfs" ino=3748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 759.734433][ T24] audit: type=1400 audit(758.970:133): avc: denied { mount } for pid=3384 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 759.808482][ T3466] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.842708][ T3466] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.845744][ T3466] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.846611][ T3466] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 759.909409][ T24] audit: type=1400 audit(759.150:134): avc: denied { mounton } for pid=3384 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 761.888252][ T3384] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 763.368225][ T24] kauditd_printk_skb: 1 callbacks suppressed [ 763.387368][ T24] audit: type=1400 audit(762.550:136): avc: denied { read write } for pid=3384 comm="syz-executor" name="loop0" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 763.412579][ T24] audit: type=1400 audit(762.640:137): avc: denied { open } for pid=3384 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=636 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 763.449249][ T24] audit: type=1400 audit(762.690:138): avc: denied { ioctl } for pid=3384 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=636 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 772.465285][ T24] audit: type=1400 audit(771.710:139): avc: denied { read } for pid=3535 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 772.513458][ T24] audit: type=1400 audit(771.750:140): avc: denied { open } for pid=3535 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 773.114802][ T24] audit: type=1400 audit(772.290:141): avc: denied { ioctl } for pid=3535 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 774.619778][ T24] audit: type=1400 audit(773.860:142): avc: denied { append } for pid=3537 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 792.394529][ T24] audit: type=1400 audit(791.600:143): avc: denied { execute } for pid=3549 comm="syz.0.5" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4099 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 793.885766][ T24] audit: type=1400 audit(793.090:144): avc: denied { write } for pid=3551 comm="syz.1.6" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 857.987583][ T3585] kvm [3585]: Failed to find VMA for hva 0x21016000 [ 859.033055][ T24] audit: type=1400 audit(858.250:145): avc: denied { create } for pid=3584 comm="syz.1.19" anonclass=[kvm-gmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 859.818961][ T24] audit: type=1400 audit(859.050:146): avc: denied { ioctl } for pid=3584 comm="syz.1.19" path="net:[4026532627]" dev="nsfs" ino=4026532627 ioctlcmd=0xb705 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 941.583634][ T24] audit: type=1400 audit(940.820:147): avc: denied { map } for pid=3630 comm="syz.1.35" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=5997 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 941.639723][ T24] audit: type=1400 audit(940.880:148): avc: denied { read } for pid=3630 comm="syz.1.35" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=5997 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 985.166490][ T24] audit: type=1400 audit(984.410:149): avc: denied { mmap_zero } for pid=3648 comm="syz.1.42" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 1031.944127][ T24] audit: type=1400 audit(1031.180:150): avc: denied { map } for pid=3681 comm="syz.0.55" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1050.773231][ T24] audit: type=1400 audit(1050.000:151): avc: denied { execute } for pid=3692 comm="syz.0.59" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1118.202722][ T24] audit: type=1400 audit(1117.420:152): avc: denied { write } for pid=3752 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1127.298513][ T24] audit: type=1400 audit(1126.540:153): avc: denied { write } for pid=3760 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1154.288387][ T3778] kvm [3777]: Unsupported guest access at: eeef0000 [ 1154.288387][ T3778] { Op0( 2), Op1( 0), CRn( 0), CRm( 6), Op2( 2), func_read }, [ 1201.615024][ T24] audit: type=1400 audit(1200.780:154): avc: denied { setattr } for pid=3795 comm="syz.0.89" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1204.086131][ T3800] kvm [3797]: Unsupported guest access at: eeef0000 [ 1204.086131][ T3800] { Op0( 2), Op1( 0), CRn( 0), CRm( 6), Op2( 2), func_read }, [ 1216.551930][ T24] audit: type=1400 audit(1215.790:155): avc: denied { execute } for pid=3807 comm="syz.1.92" path=2F34342F10FBFF67525673312B0104 dev="tmpfs" ino=239 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1387.848055][ T24] audit: type=1400 audit(1387.080:156): avc: denied { write } for pid=3903 comm="syz.0.126" path=2F5B6B766D2D676D656D5D202864656C6574656429 dev="guest_memfd" ino=10906 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 1494.599324][ T24] audit: type=1400 audit(1493.830:157): avc: denied { execute } for pid=3950 comm="syz-executor" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 1494.643252][ T24] audit: type=1400 audit(1493.880:158): avc: denied { execute_no_trans } for pid=3950 comm="syz-executor" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 1533.073396][ T24] audit: type=1400 audit(1532.310:159): avc: denied { write } for pid=3979 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1538.923806][ T24] audit: type=1400 audit(1538.150:160): avc: denied { write } for pid=3988 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1550.536854][ T3952] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1550.912884][ T3952] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1556.522250][ T3956] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1556.852738][ T3956] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1573.585470][ T3952] hsr_slave_0: entered promiscuous mode [ 1573.647809][ T3952] hsr_slave_1: entered promiscuous mode [ 1573.659715][ T3952] debugfs: 'hsr0' already exists in 'hsr' [ 1573.714107][ T3952] Cannot create hsr debugfs directory [ 1578.967400][ T3956] hsr_slave_0: entered promiscuous mode [ 1579.004353][ T3956] hsr_slave_1: entered promiscuous mode [ 1579.052752][ T3956] debugfs: 'hsr0' already exists in 'hsr' [ 1579.055680][ T3956] Cannot create hsr debugfs directory [ 1588.923458][ T3952] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1589.165803][ T3952] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1589.632469][ T3952] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1589.859975][ T3952] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1590.062695][ T3952] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1590.275263][ T3952] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1590.405107][ T3952] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1590.710193][ T3952] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1594.256651][ T3956] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1594.507146][ T3956] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1594.589688][ T3956] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1594.986088][ T3956] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1595.104695][ T3956] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1595.357219][ T3956] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1595.453846][ T3956] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1595.769637][ T3956] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1615.234487][ T3952] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1620.357022][ T3956] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1700.421466][ T3952] veth0_vlan: entered promiscuous mode [ 1701.124760][ T3952] veth1_vlan: entered promiscuous mode [ 1703.645940][ T3952] veth0_macvtap: entered promiscuous mode [ 1704.426494][ T3952] veth1_macvtap: entered promiscuous mode [ 1705.933545][ T3956] veth0_vlan: entered promiscuous mode [ 1707.613639][ T3956] veth1_vlan: entered promiscuous mode [ 1708.502455][ T3461] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.507397][ T3461] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.530035][ T3461] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1708.556335][ T3461] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1712.363289][ T3956] veth0_macvtap: entered promiscuous mode [ 1712.859878][ T3956] veth1_macvtap: entered promiscuous mode [ 1715.948497][ T3461] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1715.956314][ T3461] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1715.973406][ T3461] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1716.005009][ T3461] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1746.291999][ T24] audit: type=1400 audit(1745.470:161): avc: denied { write } for pid=4115 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1750.061764][ T24] audit: type=1400 audit(1749.300:162): avc: denied { write } for pid=4119 comm="rm" name="hook-state" dev="tmpfs" ino=90 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1833.388289][ T4122] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1833.744110][ T4122] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1842.422508][ T4128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1842.809465][ T4128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1861.919986][ T4122] hsr_slave_0: entered promiscuous mode [ 1862.015575][ T4122] hsr_slave_1: entered promiscuous mode [ 1862.115988][ T4122] debugfs: 'hsr0' already exists in 'hsr' [ 1862.132870][ T4122] Cannot create hsr debugfs directory [ 1874.108568][ T4128] hsr_slave_0: entered promiscuous mode [ 1874.157096][ T4128] hsr_slave_1: entered promiscuous mode [ 1874.222802][ T4128] debugfs: 'hsr0' already exists in 'hsr' [ 1874.231685][ T4128] Cannot create hsr debugfs directory [ 1883.014653][ T4122] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1883.374968][ T4122] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1883.909835][ T4122] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1884.126788][ T4122] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1885.129893][ T4122] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1885.375299][ T4122] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1885.922401][ T4122] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1886.166207][ T4122] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1893.955773][ T4128] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1894.297287][ T4128] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1894.429533][ T4128] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1894.935448][ T4128] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1895.107478][ T4128] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1895.545150][ T4128] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1895.794844][ T4128] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1896.185260][ T4128] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1899.489622][ T26] INFO: task syz.0.141:3943 blocked for more than 430 seconds. [ 1899.553508][ T26] Not tainted syzkaller #0 [ 1899.563509][ T26] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1899.564142][ T26] task:syz.0.141 state:D stack:0 pid:3943 tgid:3943 ppid:3384 task_flags:0x400040 flags:0x00000011 [ 1899.567244][ T26] Call trace: [ 1899.567804][ T26] __switch_to+0x5e0/0xb70 (T) [ 1899.569966][ T26] __schedule+0x1e0c/0x38cc [ 1899.570526][ T26] schedule+0x1b4/0x274 [ 1899.702929][ T26] schedule_timeout+0x68/0x1e4 [ 1899.722141][ T26] wait_for_completion+0x1b8/0x414 [ 1899.722868][ T26] __synchronize_srcu+0x1c8/0x208 [ 1899.723387][ T26] synchronize_srcu+0x668/0x8dc [ 1899.723911][ T26] mmu_notifier_unregister+0x33c/0x444 [ 1899.724457][ T26] kvm_put_kvm+0x69c/0xbbc [ 1899.724984][ T26] kvm_vm_release+0x58/0x78 [ 1899.725456][ T26] __fput+0x4ac/0x978 [ 1899.725907][ T26] ____fput+0x20/0x30 [ 1899.726360][ T26] task_work_run+0x1b8/0x250 [ 1899.726884][ T26] exit_to_user_mode_loop+0x110/0x188 [ 1899.727410][ T26] el0_svc+0x18c/0x240 [ 1899.727923][ T26] el0t_64_sync_handler+0x84/0x12c [ 1899.728426][ T26] el0t_64_sync+0x198/0x19c [ 1899.730137][ T26] [ 1899.730137][ T26] Showing all locks held in the system: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1899.898223][ T26] 1 lock held by khungtaskd/26: [ 1899.933617][ T26] #0: ffff800087e73598 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 [ 1899.936343][ T26] 2 locks held by kworker/u4:4/47: [ 1899.936751][ T26] #0: 4af000000d034140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x958/0x154c [ 1899.938485][ T26] #1: ffff80008dfd7ce8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x978/0x154c [ 1899.940235][ T26] 3 locks held by kworker/u4:5/49: [ 1900.052591][ T26] 2 locks held by getty/3239: [ 1900.053320][ T26] #0: 02f000001236a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 1900.055235][ T26] #1: 46ff80008cbbb2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x314/0x11f8 [ 1900.057091][ T26] 2 locks held by syz-executor/3373: [ 1900.057468][ T26] 3 locks held by kworker/u4:3/3456: [ 1900.057796][ T26] 3 locks held by kworker/u4:6/3461: [ 1900.058106][ T26] 2 locks held by kworker/u4:0/3936: [ 1900.058444][ T26] 2 locks held by syz.1.142/3946: [ 1900.058797][ T26] 2 locks held by kworker/u4:8/4039: [ 1900.059109][ T26] #0: 4af000000d034140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x958/0x154c [ 1900.183462][ T26] #1: ffff80008ea47ce8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x978/0x154c [ 1900.185473][ T26] 3 locks held by kworker/u4:10/4089: [ 1900.185853][ T26] 2 locks held by udevd/4196: [ 1900.186188][ T26] 1 lock held by modprobe/4203: [ 1900.186502][ T26] 1 lock held by modprobe/4204: [ 1900.187018][ T26] [ 1900.187306][ T26] ============================================= [ 1900.187306][ T26] [ 1900.188303][ T26] Kernel panic - not syncing: hung_task: blocked tasks [ 1900.196912][ T26] CPU: 0 UID: 0 PID: 26 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 1900.198306][ T26] Hardware name: linux,dummy-virt (DT) [ 1900.199214][ T26] Call trace: [ 1900.200008][ T26] show_stack+0x2c/0x3c (C) [ 1900.201025][ T26] __dump_stack+0x30/0x40 [ 1900.201994][ T26] dump_stack_lvl+0x30/0x12c [ 1900.202986][ T26] dump_stack+0x1c/0x28 [ 1900.203936][ T26] vpanic+0x4cc/0x844 [ 1900.204786][ T26] vpanic+0x0/0x844 [ 1900.205589][ T26] hung_task_panic+0x0/0x2c [ 1900.206377][ T26] kthread+0x4cc/0x514 [ 1900.207277][ T26] ret_from_fork+0x10/0x20 [ 1900.209112][ T26] Kernel Offset: disabled [ 1900.209871][ T26] CPU features: 0x00000000,00d1802f,df1847a1,057ffe1f [ 1900.210985][ T26] Memory Limit: none [ 1900.213260][ T26] Rebooting in 86400 seconds..