Extracting prog: 42m16.137026011s
Minimizing prog: 1h23m5.365395419s
Simplifying prog options: 0s
Extracting C: 6m0.064591906s
Simplifying C: 39m0.592255149s


extracting reproducer from 2 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_SREGS
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0xeeee0000, 0xeaeba000, 0xb, 0x6, 0x40, 0x2, 0x0, 0x3, 0x9a, 0xdc, 0x88, 0x9}, {0xffff1000, 0x5000, 0x9, 0xf0, 0xfe, 0x8, 0x6, 0x6, 0x1, 0x7, 0x80}, {0x6000, 0x4000, 0xe, 0x4, 0x6, 0x9, 0x3, 0x7f, 0x1, 0x0, 0x5, 0xa0}, {0x5000, 0x10000, 0xe, 0x2, 0x3, 0x1, 0xa, 0x6, 0x4, 0x3, 0x2, 0x6}, {0xd5d72000, 0x10000, 0xd, 0x6, 0x6, 0x4, 0x0, 0x4, 0x2, 0x9, 0xff, 0x2}, {0x2000, 0xe6e60000, 0xd, 0x3, 0x8, 0xd, 0xea, 0x0, 0x10, 0x2, 0x4}, {0x2000, 0x3000, 0xd, 0xf, 0x6, 0x8, 0x84, 0x1, 0x7, 0x9, 0x3a, 0xd1}, {0x10000, 0xeeee0000, 0x0, 0x9, 0x9, 0x0, 0x10, 0x2, 0xfd, 0x7, 0x3, 0xc5}, {0x8080000, 0xff}, {0x80a0000, 0x2a}, 0x40000000, 0x0, 0xd5d5e000, 0x148235, 0xb, 0x400, 0xf000, [0x8, 0xf7d, 0x100000001, 0x8]})

program did not crash
single: failed to extract reproducer
bisect: bisecting 2 programs with base timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 14]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0xeeee0000, 0xeaeba000, 0xb, 0x6, 0x40, 0x2, 0x0, 0x3, 0x9a, 0xdc, 0x88, 0x9}, {0xffff1000, 0x5000, 0x9, 0xf0, 0xfe, 0x8, 0x6, 0x6, 0x1, 0x7, 0x80}, {0x6000, 0x4000, 0xe, 0x4, 0x6, 0x9, 0x3, 0x7f, 0x1, 0x0, 0x5, 0xa0}, {0x5000, 0x10000, 0xe, 0x2, 0x3, 0x1, 0xa, 0x6, 0x4, 0x3, 0x2, 0x6}, {0xd5d72000, 0x10000, 0xd, 0x6, 0x6, 0x4, 0x0, 0x4, 0x2, 0x9, 0xff, 0x2}, {0x2000, 0xe6e60000, 0xd, 0x3, 0x8, 0xd, 0xea, 0x0, 0x10, 0x2, 0x4}, {0x2000, 0x3000, 0xd, 0xf, 0x6, 0x8, 0x84, 0x1, 0x7, 0x9, 0x3a, 0xd1}, {0x10000, 0xeeee0000, 0x0, 0x9, 0x9, 0x0, 0x10, 0x2, 0xfd, 0x7, 0x3, 0xc5}, {0x8080000, 0xff}, {0x80a0000, 0x2a}, 0x40000000, 0x0, 0xd5d5e000, 0x148235, 0xb, 0x400, 0xf000, [0x8, 0xf7d, 0x100000001, 0x8]})
executing program 0:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
openat$kvm(0xffffffffffffff9c, 0x0, 0x2873f7aecfc88708, 0x0)
munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece)
ioctl$KVM_PRE_FAULT_MEMORY(r0, 0xc040aed5, &(0x7f00000000c0)={0x80a0000, 0x1000})
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94)
eventfd2(0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0x4020940d, 0x37)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20001, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xc0189436, 0x20004000)
ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_SREGS
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0xeeee0000, 0xeaeba000, 0xb, 0x6, 0x40, 0x2, 0x0, 0x3, 0x9a, 0xdc, 0x88, 0x9}, {0xffff1000, 0x5000, 0x9, 0xf0, 0xfe, 0x8, 0x6, 0x6, 0x1, 0x7, 0x80}, {0x6000, 0x4000, 0xe, 0x4, 0x6, 0x9, 0x3, 0x7f, 0x1, 0x0, 0x5, 0xa0}, {0x5000, 0x10000, 0xe, 0x2, 0x3, 0x1, 0xa, 0x6, 0x4, 0x3, 0x2, 0x6}, {0xd5d72000, 0x10000, 0xd, 0x6, 0x6, 0x4, 0x0, 0x4, 0x2, 0x9, 0xff, 0x2}, {0x2000, 0xe6e60000, 0xd, 0x3, 0x8, 0xd, 0xea, 0x0, 0x10, 0x2, 0x4}, {0x2000, 0x3000, 0xd, 0xf, 0x6, 0x8, 0x84, 0x1, 0x7, 0x9, 0x3a, 0xd1}, {0x10000, 0xeeee0000, 0x0, 0x9, 0x9, 0x0, 0x10, 0x2, 0xfd, 0x7, 0x3, 0xc5}, {0x8080000, 0xff}, {0x80a0000, 0x2a}, 0x40000000, 0x0, 0xd5d5e000, 0x148235, 0xb, 0x400, 0xf000, [0x8, 0xf7d, 0x100000001, 0x8]})

program did not crash
single: failed to extract reproducer
bisect: bisecting 2 programs with base timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 14]
detailed listing:
executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0xeeee0000, 0xeaeba000, 0xb, 0x6, 0x40, 0x2, 0x0, 0x3, 0x9a, 0xdc, 0x88, 0x9}, {0xffff1000, 0x5000, 0x9, 0xf0, 0xfe, 0x8, 0x6, 0x6, 0x1, 0x7, 0x80}, {0x6000, 0x4000, 0xe, 0x4, 0x6, 0x9, 0x3, 0x7f, 0x1, 0x0, 0x5, 0xa0}, {0x5000, 0x10000, 0xe, 0x2, 0x3, 0x1, 0xa, 0x6, 0x4, 0x3, 0x2, 0x6}, {0xd5d72000, 0x10000, 0xd, 0x6, 0x6, 0x4, 0x0, 0x4, 0x2, 0x9, 0xff, 0x2}, {0x2000, 0xe6e60000, 0xd, 0x3, 0x8, 0xd, 0xea, 0x0, 0x10, 0x2, 0x4}, {0x2000, 0x3000, 0xd, 0xf, 0x6, 0x8, 0x84, 0x1, 0x7, 0x9, 0x3a, 0xd1}, {0x10000, 0xeeee0000, 0x0, 0x9, 0x9, 0x0, 0x10, 0x2, 0xfd, 0x7, 0x3, 0xc5}, {0x8080000, 0xff}, {0x80a0000, 0x2a}, 0x40000000, 0x0, 0xd5d5e000, 0x148235, 0xb, 0x400, 0xf000, [0x8, 0xf7d, 0x100000001, 0x8]})
executing program 0:
munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000)
openat$kvm(0xffffffffffffff9c, 0x0, 0x2873f7aecfc88708, 0x0)
munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
r0 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece)
ioctl$KVM_PRE_FAULT_MEMORY(r0, 0xc040aed5, &(0x7f00000000c0)={0x80a0000, 0x1000})
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94)
eventfd2(0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r1, 0x4020940d, 0x37)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20001, 0x0)
ioctl$KVM_CREATE_VM(r2, 0xc0189436, 0x20004000)
ioctl$KVM_KVMCLOCK_CTRL(0xffffffffffffffff, 0xaead)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 16m0s
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_SREGS
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000200)={{0xeeee0000, 0xeaeba000, 0xb, 0x6, 0x40, 0x2, 0x0, 0x3, 0x9a, 0xdc, 0x88, 0x9}, {0xffff1000, 0x5000, 0x9, 0xf0, 0xfe, 0x8, 0x6, 0x6, 0x1, 0x7, 0x80}, {0x6000, 0x4000, 0xe, 0x4, 0x6, 0x9, 0x3, 0x7f, 0x1, 0x0, 0x5, 0xa0}, {0x5000, 0x10000, 0xe, 0x2, 0x3, 0x1, 0xa, 0x6, 0x4, 0x3, 0x2, 0x6}, {0xd5d72000, 0x10000, 0xd, 0x6, 0x6, 0x4, 0x0, 0x4, 0x2, 0x9, 0xff, 0x2}, {0x2000, 0xe6e60000, 0xd, 0x3, 0x8, 0xd, 0xea, 0x0, 0x10, 0x2, 0x4}, {0x2000, 0x3000, 0xd, 0xf, 0x6, 0x8, 0x84, 0x1, 0x7, 0x9, 0x3a, 0xd1}, {0x10000, 0xeeee0000, 0x0, 0x9, 0x9, 0x0, 0x10, 0x2, 0xfd, 0x7, 0x3, 0xc5}, {0x8080000, 0xff}, {0x80a0000, 0x2a}, 0x40000000, 0x0, 0xd5d5e000, 0x148235, 0xb, 0x400, 0xf000, [0x8, 0xf7d, 0x100000001, 0x8]})

program crashed: kernel panic: Unhandled exception
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)

program crashed: kernel panic: Unhandled exception
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: kernel panic: Unhandled exception
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm
detailed listing:
executing program 0:
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
simplifying C reproducer
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
program crashed: kernel panic: Unhandled exception
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: kernel panic: Unhandled exception
validation run: crashed=true
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: kernel panic: Unhandled exception
validation run: crashed=true
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

program crashed: kernel panic: Unhandled exception
validation run: crashed=true
reproducing took 3h27m23.152071948s
repro crashed as (corrupted=false):
x8 : 91f000001f3f1d80 x7 : ffff800080aba4c0 x6 : 0000000000000000
x5 : 0000000000000001 x4 : ffff80008e817ac0 x3 : 0000000000000004
x2 : 0000000000013c1c x1 : 0000000000000000 x0 : 00000000c600001b
Kernel panic - not syncing: Unhandled exception
CPU: 0 UID: 0 PID: 3641 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 vpanic+0x22c/0x59c kernel/panic.c:430
 vpanic+0x0/0x59c kernel/panic.c:566
 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336
 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P)
 kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187
 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline]
 kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline]
 kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Kernel Offset: disabled
CPU features: 0x00000,000068c0,17de33e1,057ffe1f
Memory Limit: none

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.2.17/3641 [HC1[1]:SC0[0]:HE0:SE1] takes:
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_to_subsys drivers/base/bus.c:68 [inline]
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359
{INITIAL USE} state was registered at:
  lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  kobj_kset_join lib/kobject.c:180 [inline]
  kobject_add_internal+0x46c/0xee4 lib/kobject.c:231
  kobject_add_varg lib/kobject.c:374 [inline]
  kobject_add+0x10c/0x1d0 lib/kobject.c:426
  device_add+0x494/0xd78 drivers/base/core.c:3627
  device_register+0x28/0x38 drivers/base/core.c:3771
  faux_bus_init+0x1c/0x88 drivers/base/faux.c:238
  driver_init+0x30/0x58 drivers/base/init.c:35
  do_basic_setup+0x1c/0xa8 init/main.c:1363
  kernel_init_freeable+0x244/0x330 init/main.c:1579
  kernel_init+0x24/0x1d0 init/main.c:1469
  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
irq event stamp: 1606
hardirqs last  enabled at (1605): [<ffff80008656ac54>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline]
hardirqs last  enabled at (1605): [<ffff80008656ac54>] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96
hardirqs last disabled at (1606): [<ffff800086567f28>] __panic_unhandled+0x24/0x68 arch/arm64/kernel/entry-common.c:327
softirqs last  enabled at (1600): [<ffff8000802cf2f0>] softirq_handle_end kernel/softirq.c:425 [inline]
softirqs last  enabled at (1600): [<ffff8000802cf2f0>] handle_softirqs+0xb8c/0xd08 kernel/softirq.c:607
softirqs last disabled at (1591): [<ffff800080010e20>] __do_softirq+0x14/0x20 kernel/softirq.c:613

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&k->list_lock);
  <Interrupt>
    lock(&k->list_lock);

 *** DEADLOCK ***

no locks held by syz.2.17/3641.

stack backtrace:
CPU: 0 UID: 0 PID: 3641 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_usage_bug+0x2f4/0x32c kernel/locking/lockdep.c:4042
 verify_lock_unused+0x78/0x88 kernel/locking/lockdep.c:5792
 lock_acquire+0x22c/0x2e0 kernel/locking/lockdep.c:5859
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 bus_to_subsys drivers/base/bus.c:68 [inline]
 bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359
 coresight_panic_cb+0x2c/0x3c drivers/hwtracing/coresight/coresight-core.c:1586
 notifier_call_chain+0x1e8/0x65c kernel/notifier.c:85
 atomic_notifier_call_chain+0xd0/0x180 kernel/notifier.c:223
 vpanic+0x2c4/0x59c kernel/panic.c:459
 vpanic+0x0/0x59c kernel/panic.c:566
 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336
 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P)
 kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187
 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline]
 kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline]
 kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Rebooting in 86400 seconds..

final repro crashed as (corrupted=false):
x8 : 91f000001f3f1d80 x7 : ffff800080aba4c0 x6 : 0000000000000000
x5 : 0000000000000001 x4 : ffff80008e817ac0 x3 : 0000000000000004
x2 : 0000000000013c1c x1 : 0000000000000000 x0 : 00000000c600001b
Kernel panic - not syncing: Unhandled exception
CPU: 0 UID: 0 PID: 3641 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 vpanic+0x22c/0x59c kernel/panic.c:430
 vpanic+0x0/0x59c kernel/panic.c:566
 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336
 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P)
 kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187
 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline]
 kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline]
 kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Kernel Offset: disabled
CPU features: 0x00000,000068c0,17de33e1,057ffe1f
Memory Limit: none

================================
WARNING: inconsistent lock state
syzkaller #0 Not tainted
--------------------------------
inconsistent {INITIAL USE} -> {IN-NMI} usage.
syz.2.17/3641 [HC1[1]:SC0[0]:HE0:SE1] takes:
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_to_subsys drivers/base/bus.c:68 [inline]
2ef000000d3ed6e8 (&k->list_lock){+.+.}-{3:3}, at: bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359
{INITIAL USE} state was registered at:
  lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5868
  __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
  _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
  spin_lock include/linux/spinlock.h:351 [inline]
  kobj_kset_join lib/kobject.c:180 [inline]
  kobject_add_internal+0x46c/0xee4 lib/kobject.c:231
  kobject_add_varg lib/kobject.c:374 [inline]
  kobject_add+0x10c/0x1d0 lib/kobject.c:426
  device_add+0x494/0xd78 drivers/base/core.c:3627
  device_register+0x28/0x38 drivers/base/core.c:3771
  faux_bus_init+0x1c/0x88 drivers/base/faux.c:238
  driver_init+0x30/0x58 drivers/base/init.c:35
  do_basic_setup+0x1c/0xa8 init/main.c:1363
  kernel_init_freeable+0x244/0x330 init/main.c:1579
  kernel_init+0x24/0x1d0 init/main.c:1469
  ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:844
irq event stamp: 1606
hardirqs last  enabled at (1605): [<ffff80008656ac54>] __exit_to_kernel_mode arch/arm64/kernel/entry-common.c:86 [inline]
hardirqs last  enabled at (1605): [<ffff80008656ac54>] exit_to_kernel_mode+0xc0/0xf0 arch/arm64/kernel/entry-common.c:96
hardirqs last disabled at (1606): [<ffff800086567f28>] __panic_unhandled+0x24/0x68 arch/arm64/kernel/entry-common.c:327
softirqs last  enabled at (1600): [<ffff8000802cf2f0>] softirq_handle_end kernel/softirq.c:425 [inline]
softirqs last  enabled at (1600): [<ffff8000802cf2f0>] handle_softirqs+0xb8c/0xd08 kernel/softirq.c:607
softirqs last disabled at (1591): [<ffff800080010e20>] __do_softirq+0x14/0x20 kernel/softirq.c:613

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(&k->list_lock);
  <Interrupt>
    lock(&k->list_lock);

 *** DEADLOCK ***

no locks held by syz.2.17/3641.

stack backtrace:
CPU: 0 UID: 0 PID: 3641 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0x30/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 print_usage_bug+0x2f4/0x32c kernel/locking/lockdep.c:4042
 verify_lock_unused+0x78/0x88 kernel/locking/lockdep.c:5792
 lock_acquire+0x22c/0x2e0 kernel/locking/lockdep.c:5859
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x48/0x60 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 bus_to_subsys drivers/base/bus.c:68 [inline]
 bus_for_each_dev+0x60/0x2a4 drivers/base/bus.c:359
 coresight_panic_cb+0x2c/0x3c drivers/hwtracing/coresight/coresight-core.c:1586
 notifier_call_chain+0x1e8/0x65c kernel/notifier.c:85
 atomic_notifier_call_chain+0xd0/0x180 kernel/notifier.c:223
 vpanic+0x2c4/0x59c kernel/panic.c:459
 vpanic+0x0/0x59c kernel/panic.c:566
 el1t_64_irq_handler+0x0/0x1c arch/arm64/kernel/entry-common.c:336
 el1_abort+0x0/0x5c arch/arm64/kernel/entry-common.c:635
 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:591
 pkvm_init_host_vm+0xb8/0x160 arch/arm64/kvm/pkvm.c:234 (P)
 kvm_arch_init_vm+0x150/0x288 arch/arm64/kvm/arm.c:187
 kvm_create_vm virt/kvm/kvm_main.c:1184 [inline]
 kvm_dev_ioctl_create_vm virt/kvm/kvm_main.c:5480 [inline]
 kvm_dev_ioctl+0x838/0x105c virt/kvm/kvm_main.c:5522
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl fs/ioctl.c:584 [inline]
 __arm64_sys_ioctl+0x18c/0x244 fs/ioctl.c:584
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x90/0x2b4 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x180/0x2f4 arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x58/0x74 arch/arm64/kernel/syscall.c:151
 el0_svc+0x58/0x164 arch/arm64/kernel/entry-common.c:879
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Rebooting in 86400 seconds..