./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor958865992
<...>
Warning: Permanently added '10.128.1.188' (ED25519) to the list of known hosts.
execve("./syz-executor958865992", ["./syz-executor958865992"], 0x7fffa097cca0 /* 10 vars */) = 0
brk(NULL) = 0x555588fb6000
brk(0x555588fb6d00) = 0x555588fb6d00
arch_prctl(ARCH_SET_FS, 0x555588fb6380) = 0
set_tid_address(0x555588fb6650) = 5850
set_robust_list(0x555588fb6660, 24) = 0
rseq(0x555588fb6ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor958865992", 4096) = 27
getrandom("\x39\x9c\xec\x6f\xa3\x1e\xc0\xed", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555588fb6d00
brk(0x555588fd7d00) = 0x555588fd7d00
brk(0x555588fd8000) = 0x555588fd8000
mprotect(0x7fd6e0175000, 16384, PROT_READ) = 0
mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000
mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000
mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000
executing program
write(1, "executing program\n", 18) = 18
openat(AT_FDCWD, "/dev/kvm", O_RDONLY) = 3
ioctl(3, KVM_CREATE_VM, 0) = 4
ioctl(4, KVM_CREATE_IRQCHIP, 0) = 0
ioctl(4, KVM_CREATE_VCPU, 0) = 5
ioctl(5, KVM_SET_MSRS, 0x200000000040) = 0
[ 80.108273][ T5850] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
ioctl(5, KVM_SET_LAPIC, 0x200000001240) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=0, flags=0, guest_phys_addr=0, memory_size=4096, userspace_addr=0x200000448000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=1, flags=0, guest_phys_addr=0x1000, memory_size=4096, userspace_addr=0x200000449000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=2, flags=0, guest_phys_addr=0x2000, memory_size=4096, userspace_addr=0x20000044a000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=3, flags=0, guest_phys_addr=0x3000, memory_size=4096, userspace_addr=0x20000044b000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=4, flags=0, guest_phys_addr=0x4000, memory_size=4096, userspace_addr=0x20000044c000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=5, flags=0, guest_phys_addr=0x5000, memory_size=4096, userspace_addr=0x20000044d000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=6, flags=0, guest_phys_addr=0x6000, memory_size=4096, userspace_addr=0x20000044e000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=7, flags=0, guest_phys_addr=0x7000, memory_size=4096, userspace_addr=0x20000044f000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=8, flags=0, guest_phys_addr=0x8000, memory_size=4096, userspace_addr=0x200000450000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=9, flags=0, guest_phys_addr=0x9000, memory_size=4096, userspace_addr=0x200000451000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=10, flags=0, guest_phys_addr=0xfec00000, memory_size=4096, userspace_addr=0x200000452000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=11, flags=0, guest_phys_addr=0xb000, memory_size=4096, userspace_addr=0x200000453000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=12, flags=0, guest_phys_addr=0xc000, memory_size=4096, userspace_addr=0x200000454000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=13, flags=0, guest_phys_addr=0xd000, memory_size=4096, userspace_addr=0x200000455000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=14, flags=0, guest_phys_addr=0xe000, memory_size=4096, userspace_addr=0x200000456000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=15, flags=0, guest_phys_addr=0xf000, memory_size=4096, userspace_addr=0x200000457000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=16, flags=0, guest_phys_addr=0x10000, memory_size=4096, userspace_addr=0x200000458000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=17, flags=0, guest_phys_addr=0x11000, memory_size=4096, userspace_addr=0x200000459000}) = 0
[ 80.159475][ T5850] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2249738109 (287966477952 ns) > initial count (248453880064 ns). Using initial count to start timer.
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=18, flags=0, guest_phys_addr=0x12000, memory_size=4096, userspace_addr=0x20000045a000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=19, flags=0, guest_phys_addr=0x13000, memory_size=4096, userspace_addr=0x20000045b000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=20, flags=0, guest_phys_addr=0x14000, memory_size=4096, userspace_addr=0x20000045c000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=21, flags=0, guest_phys_addr=0x15000, memory_size=4096, userspace_addr=0x20000045d000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=22, flags=0, guest_phys_addr=0x16000, memory_size=4096, userspace_addr=0x20000045e000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=23, flags=0, guest_phys_addr=0x17000, memory_size=4096, userspace_addr=0x20000045f000}) = 0
ioctl(4, KVM_SET_USER_MEMORY_REGION, {slot=65537, flags=0, guest_phys_addr=0x30000, memory_size=65536, userspace_addr=0x200000448000}) = -1 EINVAL (Invalid argument)
ioctl(5, KVM_GET_SREGS, {cs={base=0xffff0000, limit=65535, selector=61440, type=11, present=1, dpl=0, db=0, s=1, l=0, g=0, avl=0}, ...}) = 0
openat(AT_FDCWD, "/dev/kvm", O_RDWR) = 6
ioctl(6, KVM_GET_SUPPORTED_CPUID, {nent=31, entries=[...]}) = 0
ioctl(5, KVM_SET_CPUID2, {nent=31, entries=[...]}) = 0
close(6) = 0
ioctl(5, KVM_SET_SREGS, {cs={base=0, limit=65535, selector=0, type=11, present=1, dpl=0, db=0, s=1, l=0, g=0, avl=0}, ...}) = 0
ioctl(5, KVM_SET_REGS, {rax=0, ..., rsp=0xf80, rbp=0, ..., rip=0, rflags=0x245202}) = 0
madvise(0x200000000000, 6291459, 0x66 /* MADV_??? */) = 0
[ 80.336705][ T5850] ------------[ cut here ]------------
[ 80.342263][ T5850] WARNING: arch/x86/kvm/../../../virt/kvm/kvm_main.c:3461 at kvm_read_guest_offset_cached+0x3e0/0x460, CPU#0: syz-executor958/5850
[ 80.355878][ T5850] Modules linked in:
[ 80.359873][ T5850] CPU: 0 UID: 0 PID: 5850 Comm: syz-executor958 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
[ 80.371819][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 80.381978][ T5850] RIP: 0010:kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.388705][ T5850] Code: c6 05 af ac 8f 0e 01 48 c7 c7 8e 7c c5 8d be 25 04 00 00 48 c7 c2 80 ad a1 8b e8 7b b6 5f 00 e9 c8 fc ff ff e8 71 ed 81 00 90 <0f> 0b 90 b8 ea ff ff ff e9 6b ff ff ff 48 8b 5c 24 10 48 03 1c 24
[ 80.408433][ T5850] RSP: 0018:ffffc90003f17488 EFLAGS: 00010293
[ 80.414523][ T5850] RAX: ffffffff813e23ef RBX: 0000000000000008 RCX: ffff888076648000
[ 80.422616][ T5850] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
[ 80.430685][ T5850] RBP: 0000000000000000 R08: ffff88802aef97d3 R09: 1ffff110055df2fa
[ 80.439086][ T5850] R10: dffffc0000000000 R11: ffffed10055df2fb R12: ffff888031c11898
[ 80.447130][ T5850] R13: ffff88802aef85a0 R14: ffff88802aef8000 R15: 0000000000000004
[ 80.455110][ T5850] FS: 0000555588fb6380(0000) GS:ffff8881257a1000(0000) knlGS:0000000000000000
[ 80.464079][ T5850] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 80.470733][ T5850] CR2: 0000000000000000 CR3: 0000000071d26000 CR4: 00000000003526f0
[ 80.478747][ T5850] Call Trace:
[ 80.482039][ T5850]
[ 80.484977][ T5850] kvm_arch_can_dequeue_async_page_present+0x141/0x2f0
[ 80.491890][ T5850] ? __pfx_kvm_arch_can_dequeue_async_page_present+0x10/0x10
[ 80.499334][ T5850] kvm_check_async_pf_completion+0x102/0x3c0
[ 80.505328][ T5850] ? kvm_service_local_tlb_flush_requests+0xed/0x130
[ 80.512061][ T5850] vcpu_run+0x2663/0x6fa0
[ 80.516461][ T5850] ? vcpu_run+0x35f2/0x6fa0
[ 80.521031][ T5850] ? __pfx_vcpu_run+0x10/0x10
[ 80.525702][ T5850] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940
[ 80.531470][ T5850] ? rcu_is_watching+0x15/0xb0
[ 80.536310][ T5850] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940
[ 80.541868][ T5850] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940
[ 80.547634][ T5850] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[ 80.553659][ T5850] ? __lock_acquire+0xab9/0xd20
[ 80.558665][ T5850] kvm_vcpu_ioctl+0x95c/0xe90
[ 80.563390][ T5850] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 80.568726][ T5850] ? __pfx_ptrace_notify+0x10/0x10
[ 80.573887][ T5850] ? bpf_lsm_file_ioctl+0x9/0x20
[ 80.579010][ T5850] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 80.584239][ T5850] __se_sys_ioctl+0xf9/0x170
[ 80.588934][ T5850] do_syscall_64+0xfa/0x3b0
[ 80.593491][ T5850] ? lockdep_hardirqs_on+0x9c/0x150
[ 80.598737][ T5850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.604845][ T5850] ? clear_bhb_loop+0x60/0xb0
[ 80.609594][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 80.615501][ T5850] RIP: 0033:0x7fd6e01021f9
[ 80.620107][ T5850] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 80.639823][ T5850] RSP: 002b:00007ffe03e178e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 80.648294][ T5850] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fd6e01021f9
[ 80.656333][ T5850] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[ 80.664308][ T5850] RBP: 00007fd6e0175610 R08: 00007ffe03e17ab8 R09: 00007ffe03e17ab8
[ 80.672311][ T5850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 80.680353][ T5850] R13: 00007ffe03e17aa8 R14: 0000000000000001 R15: 0000000000000001
[ 80.688429][ T5850]
[ 80.691476][ T5850] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 80.698758][ T5850] CPU: 0 UID: 0 PID: 5850 Comm: syz-executor958 Not tainted 6.16.0-rc6-next-20250717-syzkaller #0 PREEMPT(full)
[ 80.710652][ T5850] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
[ 80.720715][ T5850] Call Trace:
[ 80.724003][ T5850]
[ 80.726946][ T5850] dump_stack_lvl+0x99/0x250
[ 80.731562][ T5850] ? __asan_memcpy+0x40/0x70
[ 80.736163][ T5850] ? __pfx_dump_stack_lvl+0x10/0x10
[ 80.741380][ T5850] ? __pfx__printk+0x10/0x10
[ 80.745995][ T5850] vpanic+0x281/0x750
[ 80.749994][ T5850] ? __pfx_vpanic+0x10/0x10
[ 80.754504][ T5850] ? is_bpf_text_address+0x292/0x2b0
[ 80.759802][ T5850] ? is_bpf_text_address+0x26/0x2b0
[ 80.765015][ T5850] panic+0xb9/0xc0
[ 80.768744][ T5850] ? __pfx_panic+0x10/0x10
[ 80.773187][ T5850] __warn+0x334/0x4c0
[ 80.777193][ T5850] ? kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.783269][ T5850] ? kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.789351][ T5850] report_bug+0x2be/0x4f0
[ 80.793690][ T5850] ? kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.799796][ T5850] ? kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.805886][ T5850] ? kvm_read_guest_offset_cached+0x3e2/0x460
[ 80.811974][ T5850] handle_bug+0x84/0x160
[ 80.816216][ T5850] exc_invalid_op+0x1a/0x50
[ 80.820724][ T5850] asm_exc_invalid_op+0x1a/0x20
[ 80.825573][ T5850] RIP: 0010:kvm_read_guest_offset_cached+0x3e0/0x460
[ 80.832268][ T5850] Code: c6 05 af ac 8f 0e 01 48 c7 c7 8e 7c c5 8d be 25 04 00 00 48 c7 c2 80 ad a1 8b e8 7b b6 5f 00 e9 c8 fc ff ff e8 71 ed 81 00 90 <0f> 0b 90 b8 ea ff ff ff e9 6b ff ff ff 48 8b 5c 24 10 48 03 1c 24
[ 80.851868][ T5850] RSP: 0018:ffffc90003f17488 EFLAGS: 00010293
[ 80.857936][ T5850] RAX: ffffffff813e23ef RBX: 0000000000000008 RCX: ffff888076648000
[ 80.865923][ T5850] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
[ 80.873923][ T5850] RBP: 0000000000000000 R08: ffff88802aef97d3 R09: 1ffff110055df2fa
[ 80.881908][ T5850] R10: dffffc0000000000 R11: ffffed10055df2fb R12: ffff888031c11898
[ 80.889896][ T5850] R13: ffff88802aef85a0 R14: ffff88802aef8000 R15: 0000000000000004
[ 80.897891][ T5850] ? kvm_read_guest_offset_cached+0x3df/0x460
[ 80.904002][ T5850] ? kvm_read_guest_offset_cached+0x3df/0x460
[ 80.910102][ T5850] kvm_arch_can_dequeue_async_page_present+0x141/0x2f0
[ 80.916977][ T5850] ? __pfx_kvm_arch_can_dequeue_async_page_present+0x10/0x10
[ 80.924357][ T5850] kvm_check_async_pf_completion+0x102/0x3c0
[ 80.930347][ T5850] ? kvm_service_local_tlb_flush_requests+0xed/0x130
[ 80.937033][ T5850] vcpu_run+0x2663/0x6fa0
[ 80.941385][ T5850] ? vcpu_run+0x35f2/0x6fa0
[ 80.945922][ T5850] ? __pfx_vcpu_run+0x10/0x10
[ 80.950613][ T5850] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940
[ 80.956343][ T5850] ? rcu_is_watching+0x15/0xb0
[ 80.961128][ T5850] kvm_arch_vcpu_ioctl_run+0xfc9/0x1940
[ 80.966676][ T5850] ? kvm_arch_vcpu_ioctl_run+0x1f3/0x1940
[ 80.972387][ T5850] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10
[ 80.978380][ T5850] ? __lock_acquire+0xab9/0xd20
[ 80.983246][ T5850] kvm_vcpu_ioctl+0x95c/0xe90
[ 80.987931][ T5850] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 80.993170][ T5850] ? __pfx_ptrace_notify+0x10/0x10
[ 80.998292][ T5850] ? bpf_lsm_file_ioctl+0x9/0x20
[ 81.003262][ T5850] ? __pfx_kvm_vcpu_ioctl+0x10/0x10
[ 81.008468][ T5850] __se_sys_ioctl+0xf9/0x170
[ 81.013065][ T5850] do_syscall_64+0xfa/0x3b0
[ 81.017575][ T5850] ? lockdep_hardirqs_on+0x9c/0x150
[ 81.022775][ T5850] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 81.028837][ T5850] ? clear_bhb_loop+0x60/0xb0
[ 81.033520][ T5850] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 81.039403][ T5850] RIP: 0033:0x7fd6e01021f9
[ 81.043814][ T5850] Code: 48 83 c4 28 c3 e8 37 17 00 00 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[ 81.063410][ T5850] RSP: 002b:00007ffe03e178e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 81.071821][ T5850] RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007fd6e01021f9
[ 81.079811][ T5850] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000005
[ 81.087789][ T5850] RBP: 00007fd6e0175610 R08: 00007ffe03e17ab8 R09: 00007ffe03e17ab8
[ 81.095772][ T5850] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 81.103738][ T5850] R13: 00007ffe03e17aa8 R14: 0000000000000001 R15: 0000000000000001
[ 81.111719][ T5850]
[ 81.115169][ T5850] Kernel Offset: disabled
[ 81.119575][ T5850] Rebooting in 86400 seconds..