last executing test programs: 1m13.301453043s ago: executing program 1 (id=791): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_HALT_POLL(r1, 0x4068aea3, &(0x7f0000000080)={0xb6, 0x0, 0xed6}) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000b80)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000001, [0x99a, 0xb, 0xaca, 0x101, 0x1]}}], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_REGS(r3, 0x4360ae82, 0x0) 59.537964965s ago: executing program 1 (id=794): munmap(&(0x7f0000d83000/0x4000)=nil, 0x4000) munmap(&(0x7f0000fde000/0x4000)=nil, 0x4000) r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r1 = ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000000)={0x10000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f0000000040)={0x10201, 0x4, 0x5000, 0x1000, &(0x7f0000ffe000/0x1000)=nil, 0x8000, r1}) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, r0, 0x2000000, 0x12eeff265b2ad0b8, 0xffffffffffffffff, 0x1000000) munmap(&(0x7f0000ffb000/0x2000)=nil, 0x2000) 45.208431807s ago: executing program 1 (id=796): munmap(&(0x7f0000c8f000/0x4000)=nil, 0x4000) munmap(&(0x7f0000d83000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x6832570e03c30b83, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000240)=@arm64_fp_extra={0x60200000001000d5, &(0x7f00000000c0)=0x80000000}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x400002, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x2710, 0x2, 0x2000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0x8a0, 0x5c7d165c771213e3}) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000080)={0x5, 0xe}) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013c028, &(0x7f0000000000)=0xffffffffffffffff}) r7 = openat$kvm(0x0, &(0x7f0000000200), 0x2c00, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x1, 0xffffffffffffffff, 0x1}) r9 = ioctl$KVM_CREATE_VM(r8, 0x894c, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xb701, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x0, 0x1000001, 0x11, r13, 0x0) ioctl$KVM_CREATE_VCPU(r10, 0xb704, 0x1fffffff) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f00000001c0)={0x10201, 0x1c0, 0x340, 0x0}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x100100, 0x0) ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) 35.333851695s ago: executing program 0 (id=798): r0 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f00000000c0)="b2034b40654cb3830b10cac4796cf99f34a324210a6477d8a24838522dc59b11b31e5f411f440db07cfb40d2b0a363496dedd74c56483a75778d8422d69ca659593560382851af80", 0x0, 0x48) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) (async) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x4) ioctl$KVM_CAP_PTP_KVM(r7, 0x4068aea3, &(0x7f00000002c0)) ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f0000000080)={0x5, 0xb}) ioctl$KVM_GET_ONE_REG(r7, 0x4010aeab, &(0x7f0000000600)=@arm64_bitmap={0x6030000000160000, &(0x7f0000000000)=0x3ee3}) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) (async) r10 = openat$kvm(0x0, &(0x7f0000000000), 0x121e82, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) (async) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r12, 0x4020aeae, &(0x7f0000000340)={0x5}) (async) ioctl$KVM_RUN(r12, 0xae80, 0x0) (async) syz_kvm_vgic_v3_setup(r11, 0x1, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) (async) r13 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r13, 0x4020aeae, &(0x7f0000000080)={0x5}) ioctl$KVM_SET_ONE_REG(r13, 0x4010aeac, &(0x7f0000000180)=@arm64_fw={0x6030000004140003, &(0x7f00000001c0)=0x4}) (async) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x400454dc, 0x0) 30.947232995s ago: executing program 1 (id=799): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r1 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r4 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x4) r8 = syz_kvm_vgic_v3_setup(r7, 0x1, 0x40) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x0, 0x3, &(0x7f00000000c0)=0xffffffffffffffbe}) r9 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r10 = mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x6, 0x8032, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000e10000/0x4000)=nil, r11, 0xc, 0x80010, 0xffffffffffffffff, 0x20000000) r12 = openat$kvm(0x0, &(0x7f0000000080), 0x101001, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000bfe000/0x400000)=nil) r14 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r15, 0x4020ae46, &(0x7f0000000180)=ANY=[@ANYBLOB="010000000100000000000001000000000010000002"]) ioctl$KVM_CLEAR_DIRTY_LOG(r15, 0xc018aec0, &(0x7f0000000100)={0x1, 0x1ffc01, 0x400, &(0x7f00000003c0)=[0x7fff, 0x6, 0xfffffffffffffff8, 0xffffffffffffffff, 0xffffffffffffffff, 0x80000000, 0x6f7, 0x81, 0x7, 0x6, 0x10000, 0x5, 0x9, 0x9, 0x8, 0x9, 0x0, 0xd07, 0x201000, 0x4, 0x0, 0x4, 0x2, 0x8001, 0xfffffffffffffff9, 0xffffffffffff0003, 0x9, 0x81, 0x6, 0x400, 0x0, 0x1, 0x5, 0x98, 0x3, 0xc, 0x3, 0x2f, 0x5, 0x7fffffff, 0x0, 0x9, 0x7, 0x0, 0x800, 0x6, 0x9, 0x3fe00, 0x1, 0xf4, 0xff, 0x9, 0x1, 0x8, 0x9, 0x7, 0x7fff, 0xfff, 0x95, 0x6, 0x7, 0x1, 0x2000000004, 0x1ff, 0xffffffffffffffff, 0x2, 0xf, 0x6, 0x6, 0x4, 0x400, 0x42, 0xa8a6, 0x0, 0x8, 0x1, 0x155, 0x2, 0x4, 0x1, 0x1, 0x100000001, 0x1, 0x10000, 0x1, 0x14001, 0x7, 0x6, 0xfffffffffffffffa, 0xffffffff, 0xffffffffffffff00, 0x0, 0x67, 0x2, 0x7, 0x7f0d, 0x4, 0x5, 0xff4, 0x2f4, 0x1f8, 0xb, 0x8001, 0x6, 0xe, 0x3, 0x5, 0x5, 0x0, 0x3c7, 0x5, 0x0, 0x7, 0x0, 0x8, 0x1, 0x800, 0x3, 0xc98e, 0x2, 0x3ff, 0x8, 0x401, 0xfffffffffffffffd, 0xe39, 0x9, 0x5, 0x7]}) r16 = syz_kvm_add_vcpu$arm64(r1, &(0x7f0000000140)={0x0, &(0x7f0000000000)=ANY=[@ANYRES64=r9], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) 28.267723438s ago: executing program 0 (id=800): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000080)={0xfdfd, 0x0, &(0x7f00007a4000/0x4000)=nil}) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x7, 0x4f832, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000340)={0x5, 0x3}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r9, 0x0) openat$kvm(0x6, &(0x7f0000000040), 0x525703, 0x0) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000000)={0x2, 0x9e}) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) ioctl$KVM_HAS_DEVICE_ATTR_vm(r1, 0x4018aee3, 0x0) 19.651449132s ago: executing program 0 (id=801): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x101001, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r2, 0x4018aee1, &(0x7f00000003c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000380)={0x9, 0xc5}}) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000bfe000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000140)={0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e00000000000000400000000000000001ff0086"], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000180)={0x5, 0x1c}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000000)={0x10200, 0x7, 0x11111000, 0x2000, &(0x7f0000c8e000/0x2000)=nil}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_sve={0x6080000000150011, 0x0}) syz_kvm_add_vcpu$arm64(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="220100000000000040000000000000000100000000000000fcffffffffffffff0100000000000000090000000000000000800000000000000a00000000000000aa0000000000000028000000000000000400010000000d000000030000007c0b000003000000000082000000000000002800000000000000020000000000000003000000000000009e020000000000006e000000000000003000000000000000003000000000000078010000000000000200000000000000485b6f1759b841964600000000000000180000000000000003000000ba000000be00000000000000180000000000000015da1300000030600a000000000000009c00000000000000002192d20040b0f2e10180d2a20080d2030080d2240180d2020000d4e003006b0000a09b007008d5007008d5e0d48dd20020b8f2a10080d2e20180d2a30080d2c40080d2020000d40000211ea04a91d200e0b0f2e10180d2620080d2a30080d204"], 0x534}, 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f0000000300)="fb4149dd033b8986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67525673312b01040000000000002627e7000000000000000200", 0x0, 0xfffffffffffffe73) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x12, r9, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x92040, 0x0) munmap(&(0x7f0000c90000/0x1000)=nil, 0x1000) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e76000/0x12000)=nil, 0x12000) munmap(&(0x7f0000ecd000/0x3000)=nil, 0x3000) munmap(&(0x7f0000f40000/0x5000)=nil, 0x5000) 17.253062213s ago: executing program 1 (id=802): r0 = openat$kvm(0x0, &(0x7f00000002c0), 0xc0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1fd, 0x0, 0x8000000, 0x2000, &(0x7f0000c93000/0x2000)=nil}) syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="140000000000200000000000000022c51300000030600700000000000000"], 0x20}, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_IOEVENTFD(r5, 0xc0189436, &(0x7f0000000040)={0xbffffffffffffffd}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x20000000000001) ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f0000000080)={0x5, 0x19}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013c03a, &(0x7f0000000140)=0x40000000026}) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x1) ioctl$KVM_ARM_VCPU_INIT(r11, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000140)=@arm64_ccsidr={0x6020000000110003, 0x0}) ioctl$KVM_GET_REG_LIST(r7, 0xc008aeb0, &(0x7f00000001c0)={0x8, [0x6, 0x2, 0x6, 0x82, 0x7, 0x8, 0x2, 0x5]}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, 0x0) r12 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x0, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r13 = mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f0000000240)="fb4149dd033be3ac2cc4a22332fdaa8de0418df24200000000a6ab8031d1dfd92f0000000001ffffffff9610fbff77521ce10d8f6b69d22627e700", 0x0, 0xffffffffffffffca) 11.964858286s ago: executing program 0 (id=803): ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x0) eventfd2(0x3, 0x800) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x202, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, &(0x7f0000000000)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x88, 0xd}}], 0x58}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r9, 0x4020aeae, &(0x7f0000000200)={0x5, 0x8}) r10 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x4) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r10, 0x4018aee1, &(0x7f0000000180)=@attr_set_pmu={0x0, 0x0, 0x3, 0x0}) r11 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_ARM_VCPU_INIT(r11, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r12, 0xae03, 0x24) ioctl$KVM_SET_ONE_REG(r11, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x60300000001000d7, 0x0}) 6.326224172s ago: executing program 0 (id=804): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x7ffc}}, @msr={0x14, 0x20, {0x603000000013dce5, 0x8000}}, @msr={0x14, 0x20, {0x603000000013dce8, 0x8000}}, @msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x80}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) (async, rerun: 32) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async, rerun: 32) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r5, 0x1, 0x100) (async) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000000)={0xa, 0xffffffffffffffff, 0x1}) 3.73357616s ago: executing program 1 (id=805): r0 = mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000000)="fb4149dd123b07000000a22332fdaa8de051adf242008031d1dfd92f0000000001fff9ffdc9610fbff770500e30d8f0000000000000000000000000e00", 0x0, 0x66) r1 = mmap$KVM_VCPU(&(0x7f0000004000/0x4000)=nil, 0x0, 0x0, 0x2010, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0x0, &(0x7f00000002c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x5000, 0x2000, &(0x7f0000002000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000040)={0x4, 0x3, 0xdddd1000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x0, 0x1, 0x10000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000027000/0x13000)=nil, 0x930, 0x2000009, 0x4102932, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f00000001c0)={0x1, 0x1, 0x4, 0x1000, &(0x7f000054a000/0x1000)=nil, 0x200}) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r7 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r6, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x12, r6, 0x0) ioctl$KVM_ARM_VCPU_INIT(r6, 0x4020aeae, &(0x7f0000000180)={0x2, 0x4}) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0x541b, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f00000000c0)="f4226b710681b48eca0dec9f51db7b017b58221e96fa1c35e1561606ca2e641c78d68687341991f7ebd1c09fdc655936e2bcb01e9a5919e406bb20eb8e570b9f2af4a66fce5d7662", 0x0, 0x48) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200400, 0x0) 0s ago: executing program 0 (id=806): openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f00000002c0)=ANY=[], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r2, 0x1, 0xd625e506a17c96da) ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) (async) r11 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, r11, 0x3, 0x11, r10, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000f4c000/0x3000)=nil, r11, 0x1000008, 0x20010, r4, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r14, 0x4020ae46, &(0x7f0000000000)={0x1fe, 0x0, 0x8080000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r14, 0x4020ae46, &(0x7f0000000000)={0x1fe, 0x0, 0x8080000, 0x1000, &(0x7f0000ffc000/0x1000)=nil}) r15 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000080)={0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="aa00000000000000280000000000000003"], 0x28}, 0x0, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) r16 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r16, 0x4040aea0, &(0x7f0000000200)=@arm64={0x4, 0x0, 0x0, '\x00', 0x101}) (async) ioctl$KVM_SET_VCPU_EVENTS(r16, 0x4040aea0, &(0x7f0000000200)=@arm64={0x4, 0x0, 0x0, '\x00', 0x101}) kernel console output (not intermixed with test programs): [ 398.098506][ T3131] 8021q: adding VLAN 0 to HW filter on device bond0 [ 444.248435][ T3131] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:22276' (ED25519) to the list of known hosts. [ 603.136014][ T25] audit: type=1400 audit(602.240:60): avc: denied { name_bind } for pid=3299 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 604.191087][ T25] audit: type=1400 audit(603.290:61): avc: denied { execute } for pid=3300 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 604.216969][ T25] audit: type=1400 audit(603.310:62): avc: denied { execute_no_trans } for pid=3300 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 622.027636][ T25] audit: type=1400 audit(621.130:63): avc: denied { mounton } for pid=3300 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 622.061767][ T25] audit: type=1400 audit(621.160:64): avc: denied { mount } for pid=3300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 622.143249][ T3300] cgroup: Unknown subsys name 'net' [ 622.195082][ T25] audit: type=1400 audit(621.300:65): avc: denied { unmount } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 622.581219][ T3300] cgroup: Unknown subsys name 'cpuset' [ 622.683064][ T3300] cgroup: Unknown subsys name 'rlimit' [ 623.597141][ T25] audit: type=1400 audit(622.700:66): avc: denied { setattr } for pid=3300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 623.617393][ T25] audit: type=1400 audit(622.720:67): avc: denied { mounton } for pid=3300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 623.648012][ T25] audit: type=1400 audit(622.750:68): avc: denied { mount } for pid=3300 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 624.874650][ T3303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 624.899152][ T25] audit: type=1400 audit(624.000:69): avc: denied { relabelto } for pid=3303 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 624.913254][ T25] audit: type=1400 audit(624.010:70): avc: denied { write } for pid=3303 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 625.107071][ T25] audit: type=1400 audit(624.210:71): avc: denied { read } for pid=3300 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 625.134262][ T25] audit: type=1400 audit(624.230:72): avc: denied { open } for pid=3300 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 625.173241][ T3300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 673.384247][ T25] audit: type=1400 audit(672.490:73): avc: denied { execmem } for pid=3304 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 676.888582][ T25] audit: type=1400 audit(675.990:74): avc: denied { read } for pid=3306 comm="syz-executor" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 676.917414][ T25] audit: type=1400 audit(676.020:75): avc: denied { open } for pid=3306 comm="syz-executor" path="net:[4026531840]" dev="nsfs" ino=4026531840 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 677.006080][ T25] audit: type=1400 audit(676.110:76): avc: denied { mounton } for pid=3306 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 677.265211][ T25] audit: type=1400 audit(676.360:77): avc: denied { module_request } for pid=3307 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 677.293602][ T25] audit: type=1400 audit(676.400:78): avc: denied { module_request } for pid=3306 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 678.449161][ T25] audit: type=1400 audit(677.550:79): avc: denied { sys_module } for pid=3306 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 706.106456][ T3307] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 706.731833][ T3307] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 707.918702][ T3306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 708.185154][ T3306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 720.326637][ T3307] hsr_slave_0: entered promiscuous mode [ 720.367583][ T3307] hsr_slave_1: entered promiscuous mode [ 721.417371][ T3306] hsr_slave_0: entered promiscuous mode [ 721.452852][ T3306] hsr_slave_1: entered promiscuous mode [ 721.482505][ T3306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 721.487207][ T3306] Cannot create hsr debugfs directory [ 726.841517][ T25] audit: type=1400 audit(725.940:80): avc: denied { create } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 726.899282][ T25] audit: type=1400 audit(726.000:81): avc: denied { write } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 726.912478][ T25] audit: type=1400 audit(726.010:82): avc: denied { read } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 727.064327][ T3307] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 727.339041][ T3307] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 727.793031][ T3307] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 728.088020][ T3307] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 729.516604][ T3306] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 729.707261][ T3306] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 729.873893][ T3306] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 730.007763][ T3306] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 742.748305][ T3307] 8021q: adding VLAN 0 to HW filter on device bond0 [ 744.705055][ T3306] 8021q: adding VLAN 0 to HW filter on device bond0 [ 801.086735][ T3307] veth0_vlan: entered promiscuous mode [ 801.602942][ T3307] veth1_vlan: entered promiscuous mode [ 803.598416][ T3307] veth0_macvtap: entered promiscuous mode [ 803.718122][ T3306] veth0_vlan: entered promiscuous mode [ 803.994432][ T3307] veth1_macvtap: entered promiscuous mode [ 804.535966][ T3306] veth1_vlan: entered promiscuous mode [ 806.059227][ T3307] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.076510][ T3307] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.101307][ T3307] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 806.107859][ T3307] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 807.058488][ T3306] veth0_macvtap: entered promiscuous mode [ 807.563519][ T3306] veth1_macvtap: entered promiscuous mode [ 809.025817][ T25] audit: type=1400 audit(808.070:83): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 809.421942][ T25] audit: type=1400 audit(808.470:84): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/syzkaller.ZuwBas/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 809.632319][ T25] audit: type=1400 audit(808.730:85): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 809.942822][ T3306] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.947087][ T3306] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 809.993234][ T3306] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.003968][ T3306] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.034301][ T25] audit: type=1400 audit(809.090:86): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/syzkaller.ZuwBas/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 810.154056][ T25] audit: type=1400 audit(809.230:87): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/syzkaller.ZuwBas/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3265 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 810.757494][ T25] audit: type=1400 audit(809.820:88): avc: denied { unmount } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 811.087840][ T25] audit: type=1400 audit(810.180:89): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1546 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 811.158371][ T25] audit: type=1400 audit(810.260:90): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="gadgetfs" ino=3276 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 811.471856][ T25] audit: type=1400 audit(810.560:91): avc: denied { mount } for pid=3307 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 811.653679][ T25] audit: type=1400 audit(810.750:92): avc: denied { mounton } for pid=3307 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 812.961815][ T3307] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 817.306868][ T25] kauditd_printk_skb: 4 callbacks suppressed [ 817.317182][ T25] audit: type=1400 audit(816.330:97): avc: denied { read } for pid=3461 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 817.440540][ T25] audit: type=1400 audit(816.410:98): avc: denied { open } for pid=3461 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 818.025678][ T25] audit: type=1400 audit(817.030:99): avc: denied { ioctl } for pid=3462 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 820.092785][ T25] audit: type=1400 audit(819.170:100): avc: denied { append } for pid=3461 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 832.173408][ T25] audit: type=1400 audit(831.230:101): avc: denied { write } for pid=3476 comm="syz.1.4" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 889.361010][ T25] audit: type=1400 audit(888.420:102): avc: denied { execute } for pid=3506 comm="syz.1.13" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4296 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1096.716440][ T3646] kvm [3646]: Failed to find VMA for hva 0x20ffc000 [ 1237.238130][ T3750] kvm [3750]: Failed to find VMA for hva 0x208a1000 [ 1286.248766][ T3780] kvm [3780]: Failed to find VMA for hva 0x21016000 [ 1286.506558][ T25] audit: type=1400 audit(1285.550:103): avc: denied { setattr } for pid=3779 comm="syz.0.97" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1337.732431][ T3813] kvm [3812]: Unsupported guest access at: eeef0000 [ 1337.732431][ T3813] { Op0( 2), Op1( 7), CRn(15), CRm(13), Op2( 1), func_write }, [ 1715.283292][ T4094] kvm [4094]: Failed to find VMA for hva 0x20c01000 [ 1763.416188][ T4129] kvm [4129]: Failed to find VMA for hva 0x20d8d000 [ 1773.306486][ T4139] kvm [4139]: Failed to find VMA for hva 0x20c01000 [ 1792.197876][ T25] audit: type=1400 audit(1791.270:104): avc: denied { map } for pid=4152 comm="syz.0.209" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1956.778251][ T25] audit: type=1400 audit(1955.880:105): avc: denied { ioctl } for pid=4282 comm="syz.0.246" path="net:[4026531840]" dev="nsfs" ino=4026531840 ioctlcmd=0x582b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2099.954500][ T4369] kvm [4369]: Failed to find VMA for hva 0x20c01000 [ 2368.561653][ T4545] debugfs: File 'vgic-its-state@0' in directory '4545-6' already present! [ 2378.893964][ T4556] kvm [4556]: Failed to find VMA for hva 0x20d8d000 [ 2414.425833][ T4579] kvm [4579]: Failed to find VMA for hva 0x20c01000 [ 2603.496242][ T4717] kvm [4717]: Failed to find VMA for hva 0x208a1000 [ 2607.957650][ T4720] kvm [4720]: Failed to find VMA for hva 0x20c01000 [ 2766.836624][ T4825] kvm [4825]: Failed to find VMA for hva 0x2101a000 [ 3191.827522][ T25] audit: type=1400 audit(3190.920:106): avc: denied { getattr } for pid=5118 comm="syz.0.491" path="net:[4026532631]" dev="nsfs" ino=4026532631 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 3304.782371][ T5195] kvm [5195]: Failed to find VMA for hva 0x20c01000 [ 4103.399186][ T5774] kvm [5774]: Failed to find VMA for hva 0x21016000 [ 4442.516381][ T6009] kvm [6009]: Failed to find VMA for hva 0x20d8d000 [ 4497.539304][ T6041] kvm [6041]: Failed to find VMA for hva 0x20c01000 [ 4571.355093][ T6093] kvm [6093]: Failed to find VMA for hva 0x20e8a000 [ 4650.417908][ T6124] kvm [6124]: Failed to find VMA for hva 0x20d8d000 [ 4726.406561][ T6167] ------------[ cut here ]------------ [ 4726.407444][ T6167] WARNING: CPU: 0 PID: 6167 at arch/arm64/kvm/inject_fault.c:71 pend_serror_exception+0x19c/0x5ac [ 4726.411444][ T6167] Modules linked in: [ 4726.414328][ T6167] CPU: 0 UID: 0 PID: 6167 Comm: syz.0.806 Not tainted 6.16.0-rc3-syzkaller-g15724a984643 #0 PREEMPT [ 4726.416081][ T6167] Hardware name: linux,dummy-virt (DT) [ 4726.417392][ T6167] pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 4726.418806][ T6167] pc : pend_serror_exception+0x19c/0x5ac [ 4726.419869][ T6167] lr : pend_serror_exception+0x19c/0x5ac [ 4726.420957][ T6167] sp : ffff80008ec07930 [ 4726.421885][ T6167] x29: ffff80008ec07930 x28: c1f000001d331da8 x27: 0000000000000001 [ 4726.423903][ T6167] x26: 0000000000000000 x25: 0000000000000001 x24: 00000000000000c1 [ 4726.425594][ T6167] x23: c1f000001d332028 x22: 00000000000000c1 x21: c1f000001d332c01 [ 4726.427302][ T6167] x20: 0000000000000007 x19: efff800000000000 x18: 0000000000000000 [ 4726.429051][ T6167] x17: 00000000000000bf x16: ffff800080011d9c x15: 0000000020000200 [ 4726.430850][ T6167] x14: ffffffffffffffff x13: 0000000000000028 x12: 00000000000000b7 [ 4726.432509][ T6167] x11: b7f000001d0fede4 x10: 0000000000ff0100 x9 : 0000000000000000 [ 4726.434287][ T6167] x8 : b7f000001d0fd880 x7 : ffff800080b08704 x6 : ffff80008ec07a88 [ 4726.435909][ T6167] x5 : ffff80008ec07a88 x4 : 0000000000000001 x3 : ffff8000801a2e80 [ 4726.437595][ T6167] x2 : 0000000000000000 x1 : 0000000000000002 x0 : 0000000000000000 [ 4726.439429][ T6167] Call trace: [ 4726.440558][ T6167] pend_serror_exception+0x19c/0x5ac (P) [ 4726.442004][ T6167] kvm_inject_serror_esr+0x274/0xe40 [ 4726.443166][ T6167] __kvm_arm_vcpu_set_events+0x1d4/0x238 [ 4726.444284][ T6167] kvm_arch_vcpu_ioctl+0xed8/0x16b0 [ 4726.445392][ T6167] kvm_vcpu_ioctl+0x5c4/0xc2c [ 4726.446511][ T6167] __arm64_sys_ioctl+0x18c/0x244 [ 4726.447543][ T6167] invoke_syscall+0x90/0x2b4 [ 4726.448635][ T6167] el0_svc_common+0x180/0x2f4 [ 4726.449766][ T6167] do_el0_svc+0x58/0x74 [ 4726.450827][ T6167] el0_svc+0x58/0x160 [ 4726.451805][ T6167] el0t_64_sync_handler+0x78/0x108 [ 4726.452895][ T6167] el0t_64_sync+0x198/0x19c [ 4726.454205][ T6167] irq event stamp: 2654 [ 4726.455064][ T6167] hardirqs last enabled at (2653): [] _raw_read_unlock_irqrestore+0x44/0xbc [ 4726.456569][ T6167] hardirqs last disabled at (2654): [] el1_dbg+0x24/0x80 [ 4726.457970][ T6167] softirqs last enabled at (2630): [] local_bh_enable+0x10/0x34 [ 4726.459308][ T6167] softirqs last disabled at (2628): [] local_bh_disable+0x10/0x34 [ 4726.460865][ T6167] ---[ end trace 0000000000000000 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 4744.923061][ T4778] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4745.706721][ T4778] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4746.343307][ T4778] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4746.872435][ T4778] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4755.524508][ T4778] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 4755.633384][ T4778] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 4755.695289][ T4778] bond0 (unregistering): Released all slaves VM DIAGNOSIS: 14:28:24 Registers: info registers vcpu 0 CPU#0 PC=ffff80008045386c X00=0000000000000001 X01=b7f000001d0fe310 X02=ffff8000804580e0 X03=0000000000000000 X04=ffff80008ec07070 X05=0000000000000020 X06=0000000000000000 X07=ffff80008652e834 X08=ffff800088141e58 X09=00000000000000b7 X10=0000000000000001 X11=0000000000000144 X12=0000000000000044 X13=0000000000000002 X14=00000000000000c8 X15=ffff800087f39a30 X16=ffff800080011d9c X17=00000000000000bf X18=0000000000000000 X19=0000000000000000 X20=0000000000000000 X21=ffff80008652e834 X22=ffff8000877e66a8 X23=0000000000000000 X24=0000000000000001 X25=0000000000000000 X26=ffff800087666580 X27=00000000000003c0 X28=0000000000000000 X29=ffff80008ec07230 X30=ffff800080451698 SP=ffff80008ec071e0 PSTATE=204023c9 --C- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=1200000000000000:1200000000000000 Z01=0000001200000000:0000000000000000 Z02=0000000000000012:0000000000000000 Z03=00d000a800000000:0000000000000000 Z04=0000000000000000:0000000000000002 Z05=0000000000000012:0000000000000002 Z06=6edc4d3a2914b135:d8e9c869e2695c88 Z07=b20fae707afde253:388e9c6c4fa85ca0 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffca8baf10:0000ffffca8baf10 Z17=ffffff80ffffffd0:0000ffffca8baee0 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000