Extracting prog: 43m17.397809409s Minimizing prog: 1h47m42.660477304s Simplifying prog options: 0s Extracting C: 6m7.71744613s Simplifying C: 38m53.263726661s extracting reproducer from 12 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-mmap$KVM_VCPU-ioctl$KVM_CREATE_VM-ioctl$KVM_CAP_ARM_MTE detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) ioctl$KVM_CAP_ARM_MTE(r1, 0x4068aea3, &(0x7f0000000040)) program did not crash single: failed to extract reproducer bisect: bisecting 12 programs with base timeout 45s testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 4, 3, 5, 26, 4, 21, 5, 4, 16, 5, 6] detailed listing: executing program 1: r0 = openat$kvm(0x0, &(0x7f0000000040), 0x101181, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x80040, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xae) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r3, 0x2, 0x1000000000000) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, 0x0, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0x401c5820, 0xffff98600fff) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000380)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) (fail_nth: 4) executing program 0: openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) (fail_nth: 1) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e5b000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3) r4 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r5 = eventfd2(0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x1000004, 0x11, r5, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000580)={r4, 0x7, 0x1, r5}) mmap$KVM_VCPU(&(0x7f0000c17000/0x3000)=nil, 0x930, 0x0, 0x10, 0xffffffffffffffff, 0x20) ioctl$KVM_CREATE_VM(r2, 0x5452, 0x2000fdfd) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0x80111500, 0x20000000) close(r7) ioctl$KVM_GET_DIRTY_LOG(r7, 0x4010ae42, &(0x7f00000005c0)={0x1ff, 0x0, &(0x7f0000cd6000/0x4000)=nil}) r8 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000500)={0x0, &(0x7f0000000080)=[@its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x3, 0x4, 0xf13, 0xc210, 0x1}}, @mrs={0xbe, 0x18, {0x603000000013e108}}, @hvc={0x32, 0x40, {0xc4000014, [0x8, 0x34, 0x1, 0x5, 0x7ff]}}, @irq_setup={0x46, 0x18, {0x3, 0x1d}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x3, 0x1ff, 0x6, 0x2}}, @irq_setup={0x46, 0x18, {0x0, 0x3a2}}, @eret={0xe6, 0x18, 0x4}, @mrs={0xbe, 0x18, {0xc06000000027cc9a}}, @irq_setup={0x46, 0x18, {0x3, 0x145}}, @its_send_cmd={0xaa, 0x28, {0x34b0e1404fd4bbff, 0x1, 0x2, 0x6, 0x8, 0x8, 0x2}}, @code={0xa, 0xb4, {"000008d5000028d5007008d500008039e01e8cd20060b0f2a10180d2e20080d2830080d2c40180d2020000d400a08ad20020b0f2010080d2820080d2230180d2c40080d2020000d4007008d580ed84d20000b8f2210080d2420080d2830180d2240180d2020000d4604090d20040b0f2c10080d2420080d2e30080d2440080d2020000d400e68dd20040b8f2a10180d2c20180d2a30080d2040180d2020000d4"}}, @svc={0x122, 0x40, {0xc4000005, [0x8, 0x2, 0xd4, 0x7, 0x1]}}, @hvc={0x32, 0x40, {0x84000050, [0xa, 0x7fff, 0x5, 0x5, 0x19ea]}}, @mrs={0xbe, 0x18, {0x603000000013df78}}, @uexit={0x0, 0x18, 0x3}, @mrs={0xbe, 0x18, {0x6030000000138066}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x38d}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x1, 0xd, 0x6, 0x10, 0x3}}, @mrs={0xbe, 0x18, {0x603000000013de93}}, @svc={0x122, 0x40, {0x8041, [0x1, 0x5, 0x101, 0x400, 0x5]}}, @svc={0x122, 0x40, {0x84000050, [0x8000000000000000, 0x10, 0x5, 0x1000, 0x1]}}, @smc={0x1e, 0x40, {0x84000011, [0x0, 0x6, 0x9, 0x2]}}, @mrs={0xbe, 0x18, {0x603000000013e609}}, @svc={0x122, 0x40, {0x80000001, [0x8000000000000001, 0x9, 0x8, 0x99, 0x100000000]}}], 0x444}, &(0x7f0000000540)=[@featur2={0x1, 0x50}], 0x1) mmap$KVM_VCPU(&(0x7f000064b000/0x4000)=nil, r1, 0x0, 0x10010, r8, 0x0) openat$kvm(0x0, &(0x7f0000000000), 0x72483, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r9, 0x2, 0x1000000000000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0x80111500, 0x20000000) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r1, 0x5760, 0x2000001c) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1237c0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x12, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r2, 0xf, 0x2010, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0x80111500, 0x20000000) ioctl$KVM_CREATE_VM(r5, 0x541b, 0x2000001c) r6 = ioctl$KVM_CREATE_VM(r3, 0xae03, 0xbb) ioctl$KVM_IOEVENTFD(r6, 0xc0189436, &(0x7f0000000080)={0x0, 0x0, 0x5dabdef0cbf6a717, 0xffffffffffffffff, 0x5}) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x0, 0x8032, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xcb) mmap$KVM_VCPU(&(0x7f0000f2a000/0x4000)=nil, 0x930, 0xf, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) executing program 0: openat$kvm(0x0, 0x0, 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) executing program 1: syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x300000c, 0x4f832, 0xffffffffffffffff, 0x1000000) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x300000c, 0x4f832, 0xffffffffffffffff, 0x1000000) executing program 0: r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000840)=[@featur1={0x1, 0xc7}], 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x0) mmap$KVM_VCPU(&(0x7f0000581000/0x1000)=nil, 0x930, 0x0, 0x4020131, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, r3, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, r2, 0x4000011, 0x13, r3, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000080)=@attr_other={0x0, 0x6, 0x8, &(0x7f0000000000)=0x401}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0x401c5820, 0xffff98600fff) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) executing program 1: munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000140)=[@featur1={0x1, 0x1}], 0x1) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (fail_nth: 1) executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) ioctl$KVM_CAP_ARM_MTE(r1, 0x4068aea3, &(0x7f0000000040)) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-mmap$KVM_VCPU-ioctl$KVM_CREATE_VM-ioctl$KVM_CAP_ARM_MTE detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) ioctl$KVM_CAP_ARM_MTE(r1, 0x4068aea3, &(0x7f0000000040)) program did not crash single: failed to extract reproducer bisect: bisecting 12 programs with base timeout 5m0s testing program (duration=5m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 4, 3, 5, 26, 4, 21, 5, 4, 16, 5, 6] detailed listing: executing program 1: r0 = openat$kvm(0x0, &(0x7f0000000040), 0x101181, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x8200, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x80040, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xae) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r3, 0x2, 0x1000000000000) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, 0x0, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0x401c5820, 0xffff98600fff) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000380)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) (fail_nth: 4) executing program 0: openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) (fail_nth: 1) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000e5b000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80002, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3) r4 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r5 = eventfd2(0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, 0x0, 0x1000004, 0x11, r5, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000580)={r4, 0x7, 0x1, r5}) mmap$KVM_VCPU(&(0x7f0000c17000/0x3000)=nil, 0x930, 0x0, 0x10, 0xffffffffffffffff, 0x20) ioctl$KVM_CREATE_VM(r2, 0x5452, 0x2000fdfd) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0x80111500, 0x20000000) close(r7) ioctl$KVM_GET_DIRTY_LOG(r7, 0x4010ae42, &(0x7f00000005c0)={0x1ff, 0x0, &(0x7f0000cd6000/0x4000)=nil}) r8 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000500)={0x0, &(0x7f0000000080)=[@its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x3, 0x4, 0xf13, 0xc210, 0x1}}, @mrs={0xbe, 0x18, {0x603000000013e108}}, @hvc={0x32, 0x40, {0xc4000014, [0x8, 0x34, 0x1, 0x5, 0x7ff]}}, @irq_setup={0x46, 0x18, {0x3, 0x1d}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x0, 0x0, 0x3, 0x1ff, 0x6, 0x2}}, @irq_setup={0x46, 0x18, {0x0, 0x3a2}}, @eret={0xe6, 0x18, 0x4}, @mrs={0xbe, 0x18, {0xc06000000027cc9a}}, @irq_setup={0x46, 0x18, {0x3, 0x145}}, @its_send_cmd={0xaa, 0x28, {0x34b0e1404fd4bbff, 0x1, 0x2, 0x6, 0x8, 0x8, 0x2}}, @code={0xa, 0xb4, {"000008d5000028d5007008d500008039e01e8cd20060b0f2a10180d2e20080d2830080d2c40180d2020000d400a08ad20020b0f2010080d2820080d2230180d2c40080d2020000d4007008d580ed84d20000b8f2210080d2420080d2830180d2240180d2020000d4604090d20040b0f2c10080d2420080d2e30080d2440080d2020000d400e68dd20040b8f2a10180d2c20180d2a30080d2040180d2020000d4"}}, @svc={0x122, 0x40, {0xc4000005, [0x8, 0x2, 0xd4, 0x7, 0x1]}}, @hvc={0x32, 0x40, {0x84000050, [0xa, 0x7fff, 0x5, 0x5, 0x19ea]}}, @mrs={0xbe, 0x18, {0x603000000013df78}}, @uexit={0x0, 0x18, 0x3}, @mrs={0xbe, 0x18, {0x6030000000138066}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x38d}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x1, 0xd, 0x6, 0x10, 0x3}}, @mrs={0xbe, 0x18, {0x603000000013de93}}, @svc={0x122, 0x40, {0x8041, [0x1, 0x5, 0x101, 0x400, 0x5]}}, @svc={0x122, 0x40, {0x84000050, [0x8000000000000000, 0x10, 0x5, 0x1000, 0x1]}}, @smc={0x1e, 0x40, {0x84000011, [0x0, 0x6, 0x9, 0x2]}}, @mrs={0xbe, 0x18, {0x603000000013e609}}, @svc={0x122, 0x40, {0x80000001, [0x8000000000000001, 0x9, 0x8, 0x99, 0x100000000]}}], 0x444}, &(0x7f0000000540)=[@featur2={0x1, 0x50}], 0x1) mmap$KVM_VCPU(&(0x7f000064b000/0x4000)=nil, r1, 0x0, 0x10010, r8, 0x0) openat$kvm(0x0, &(0x7f0000000000), 0x72483, 0x0) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r9, 0x2, 0x1000000000000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0x80111500, 0x20000000) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r1, 0x5760, 0x2000001c) executing program 1: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1237c0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x12, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r2, 0xf, 0x2010, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0x80111500, 0x20000000) ioctl$KVM_CREATE_VM(r5, 0x541b, 0x2000001c) r6 = ioctl$KVM_CREATE_VM(r3, 0xae03, 0xbb) ioctl$KVM_IOEVENTFD(r6, 0xc0189436, &(0x7f0000000080)={0x0, 0x0, 0x5dabdef0cbf6a717, 0xffffffffffffffff, 0x5}) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x0, 0x8032, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r7, 0xae03, 0xcb) mmap$KVM_VCPU(&(0x7f0000f2a000/0x4000)=nil, 0x930, 0xf, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) executing program 0: openat$kvm(0x0, 0x0, 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) executing program 1: syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x300000c, 0x4f832, 0xffffffffffffffff, 0x1000000) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x300000c, 0x4f832, 0xffffffffffffffff, 0x1000000) executing program 0: r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x8) ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000840)=[@featur1={0x1, 0xc7}], 0x1) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0xae03, 0x0) mmap$KVM_VCPU(&(0x7f0000581000/0x1000)=nil, 0x930, 0x0, 0x4020131, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, r3, 0x0) mmap$KVM_VCPU(&(0x7f0000ffc000/0x4000)=nil, r2, 0x4000011, 0x13, r3, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000080)=@attr_other={0x0, 0x6, 0x8, &(0x7f0000000000)=0x401}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0x401c5820, 0xffff98600fff) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) executing program 1: munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) syz_kvm_add_vcpu$arm64(0x0, 0x0, &(0x7f0000000140)=[@featur1={0x1, 0x1}], 0x1) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (fail_nth: 1) executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) ioctl$KVM_CAP_ARM_MTE(r1, 0x4068aea3, &(0x7f0000000040)) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 16m0s testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-mmap$KVM_VCPU-ioctl$KVM_CREATE_VM-ioctl$KVM_CAP_ARM_MTE detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) ioctl$KVM_CAP_ARM_MTE(r1, 0x4068aea3, &(0x7f0000000040)) program crashed: kernel panic: Unhandled exception single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-mmap$KVM_VCPU-ioctl$KVM_CREATE_VM detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-mmap$KVM_VCPU detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CHECK_EXTENSION-ioctl$KVM_CREATE_VM detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0xe1) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap$KVM_VCPU-ioctl$KVM_CREATE_VM detailed listing: executing program 0: mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2d) program did not crash testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program did not crash extracting C reproducer testing compiled C program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception simplifying C reproducer testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM program crashed: kernel panic: Unhandled exception testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception validation run: crashed=true testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception validation run: crashed=true testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2d) program crashed: kernel panic: Unhandled exception validation run: crashed=true reproducing took 3h52m23.828678913s repro crashed as (corrupted=false): x8 : 29f0000020150000 x7 : ffff800080aba4c0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : ffff80008e657ac0 x3 : 0000000000000004 x2 : 00000000000144f4 x1 : 0000000000000000 x0 : 00000000c600001b Kernel panic - not syncing: Unhandled exception CPU: 0 UID: 0 PID: 3624 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 vpanic+0x22c/0x59c kernel/panic.c:430 vpanic+0x0/0x59c kernel/panic.c:566 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P) kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline] kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Kernel Offset: disabled CPU features: 0x00000,000068c0,17de33e1,057ffe1f Memory Limit: none ================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. syz.2.17/3624 [HC1[1]:SC0[0]:HE0:SE1] takes: a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_to_subsys drivers/base/bus.c:68 [inline] a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359 {INITIAL USE} state was registered at: lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] kobj_kset_join lib/kobject.c:180 [inline] kobject_add_internal+0x46c/0xee4 lib/kobject.c:231 kobject_add_varg lib/kobject.c:374 [inline] kobject_add+0x10c/0x1d0 lib/kobject.c:426 device_add+0x494/0xd78 drivers/base/core.c:3627 device_register+0x28/0x38 drivers/base/core.c:3771 faux_bus_init+0x1c/0x88 drivers/base/faux.c:238 driver_init+0x30/0x58 drivers/base/init.c:35 do_basic_setup+0x1c/0xa8 init/main.c:1363 kernel_init_freeable+0x244/0x330 init/main.c:1579 kernel_init+0x24/0x1d0 init/main.c:1469 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 irq event stamp: 1908 hardirqs last enabled at (1907): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (1907): [] _raw_spin_unlock_irqrestore+0x44/0xbc kernel/locking/spinlock.c:194 hardirqs last disabled at (1908): [] __panic_unhandled+0x24/0x68 arch/arm64/kernel/entry-common.c:327 softirqs last enabled at (1864): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (1864): [] handle_softirqs+0xb8c/0xd08 kernel/softirq.c:607 softirqs last disabled at (1855): [] __do_softirq+0x14/0x20 kernel/softirq.c:613 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&k->list_lock); lock(&k->list_lock); *** DEADLOCK *** no locks held by syz.2.17/3624. stack backtrace: CPU: 0 UID: 0 PID: 3624 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_usage_bug+0x2f4/0x32c kernel/locking/lockdep.c:4042 verify_lock_unused+0x78/0x88 kernel/locking/lockdep.c:5792 lock_acquire+0x22c/0x2e0 kernel/locking/lockdep.c:5859 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] bus_to_subsys drivers/base/bus.c:68 [inline] bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359 coresight_panic_cb+0x2c/0x3c drivers/hwtracing/coresight/coresight-core.c:1586 notifier_call_chain+0x1e8/0x65c kernel/notifier.c:85 atomic_notifier_call_chain+0xd0/0x180 kernel/notifier.c:223 vpanic+0x2c4/0x59c kernel/panic.c:459 vpanic+0x0/0x59c kernel/panic.c:566 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P) kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline] kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Rebooting in 86400 seconds.. final repro crashed as (corrupted=false): x8 : 29f0000020150000 x7 : ffff800080aba4c0 x6 : 0000000000000000 x5 : 0000000000000001 x4 : ffff80008e657ac0 x3 : 0000000000000004 x2 : 00000000000144f4 x1 : 0000000000000000 x0 : 00000000c600001b Kernel panic - not syncing: Unhandled exception CPU: 0 UID: 0 PID: 3624 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 vpanic+0x22c/0x59c kernel/panic.c:430 vpanic+0x0/0x59c kernel/panic.c:566 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P) kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline] kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Kernel Offset: disabled CPU features: 0x00000,000068c0,17de33e1,057ffe1f Memory Limit: none ================================ WARNING: inconsistent lock state syzkaller #0 Not tainted -------------------------------- inconsistent {INITIAL USE} -> {IN-NMI} usage. syz.2.17/3624 [HC1[1]:SC0[0]:HE0:SE1] takes: a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_to_subsys drivers/base/bus.c:68 [inline] a6f000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359 {INITIAL USE} state was registered at: lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] kobj_kset_join lib/kobject.c:180 [inline] kobject_add_internal+0x46c/0xee4 lib/kobject.c:231 kobject_add_varg lib/kobject.c:374 [inline] kobject_add+0x10c/0x1d0 lib/kobject.c:426 device_add+0x494/0xd78 drivers/base/core.c:3627 device_register+0x28/0x38 drivers/base/core.c:3771 faux_bus_init+0x1c/0x88 drivers/base/faux.c:238 driver_init+0x30/0x58 drivers/base/init.c:35 do_basic_setup+0x1c/0xa8 init/main.c:1363 kernel_init_freeable+0x244/0x330 init/main.c:1579 kernel_init+0x24/0x1d0 init/main.c:1469 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844 irq event stamp: 1908 hardirqs last enabled at (1907): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] hardirqs last enabled at (1907): [] _raw_spin_unlock_irqrestore+0x44/0xbc kernel/locking/spinlock.c:194 hardirqs last disabled at (1908): [] __panic_unhandled+0x24/0x68 arch/arm64/kernel/entry-common.c:327 softirqs last enabled at (1864): [] softirq_handle_end kernel/softirq.c:425 [inline] softirqs last enabled at (1864): [] handle_softirqs+0xb8c/0xd08 kernel/softirq.c:607 softirqs last disabled at (1855): [] __do_softirq+0x14/0x20 kernel/softirq.c:613 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&k->list_lock); lock(&k->list_lock); *** DEADLOCK *** no locks held by syz.2.17/3624. stack backtrace: CPU: 0 UID: 0 PID: 3624 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_usage_bug+0x2f4/0x32c kernel/locking/lockdep.c:4042 verify_lock_unused+0x78/0x88 kernel/locking/lockdep.c:5792 lock_acquire+0x22c/0x2e0 kernel/locking/lockdep.c:5859 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154 spin_lock include/linux/spinlock.h:351 [inline] bus_to_subsys drivers/base/bus.c:68 [inline] bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359 coresight_panic_cb+0x2c/0x3c drivers/hwtracing/coresight/coresight-core.c:1586 notifier_call_chain+0x1e8/0x65c kernel/notifier.c:85 atomic_notifier_call_chain+0xd0/0x180 kernel/notifier.c:223 vpanic+0x2c4/0x59c kernel/panic.c:459 vpanic+0x0/0x59c kernel/panic.c:566 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P) kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline] kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline] kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596 Rebooting in 86400 seconds..