last executing test programs: 1m2.636930132s ago: executing program 0 (id=182): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f00000000c0)=[@code={0xa, 0x20, {"002080d2a0bbbbf21f0042f9"}}], 0x20}], 0x1, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f00000000c0)=[@code={0xa, 0x20, {"002080d2a0bbbbf21f0042f9"}}], 0x20}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) (async) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) write$eventfd(r6, &(0x7f00000001c0), 0xfdef) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) (async) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@hvc={0x32, 0x40, {0x800, [0x9, 0x5, 0x800, 0x6, 0xfffffffffffffff8]}}], 0x40}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r11, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) r12 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000180)={0x0, &(0x7f0000000380)=[@memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x48, 0x7, 0x7}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x3, 0x5, 0x40, 0x7, 0x3}}, @eret={0xe6, 0x18, 0x10}, @eret={0xe6, 0x18, 0x8bd9}, @hvc={0x32, 0x40, {0x84000051, [0x1, 0x80000000, 0xff, 0xd17, 0x3]}}, @irq_setup={0x46, 0x18, {0x4, 0xe0}}, @msr={0x14, 0x20, {0x603000000013801d, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xf10, 0x5, 0x4}}, @msr={0x14, 0x20, {0x603000000013e6d6, 0x5}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x40, 0x671, 0x8}}, @smc={0x1e, 0x40, {0x200, [0xc513, 0x3, 0xffffc00000000000, 0x5, 0x1]}}, @its_setup={0x82, 0x28, {0x4, 0x0, 0x1e9}}, @uexit={0x0, 0x18, 0x7}, @svc={0x122, 0x40, {0xc5000021, [0x6, 0x5, 0x2514, 0xfd59, 0x3]}}, @msr={0x14, 0x20, {0x6030000000138074, 0xa}}, @eret={0xe6, 0x18, 0x8000000000000000}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x88, 0x7c6, 0x4}}, @uexit={0x0, 0x18, 0x1}, @irq_setup={0x46, 0x18, {0x4, 0x37c}}], 0x2d8}, &(0x7f00000000c0)=[@featur2={0x1, 0x19}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r15, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r15, 0xae80, 0x0) (async) ioctl$KVM_RUN(r15, 0xae80, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) (async) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(r15, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 58.265738402s ago: executing program 1 (id=183): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000280)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f0000000100)=@arm64_fp={0x60c00000001000ab, &(0x7f0000000000)=0x4d}) (async) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000100)={0x4, 0x1, 0x0, 0x1000, &(0x7f0000ee6000/0x1000)=nil}) (async) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@smc={0x1e, 0x40, {0x8000, [0x1, 0x4de8, 0xef23, 0x4, 0x6]}}, @memwrite={0x6e, 0x30, @generic={0x2000, 0xb38, 0x7fffffffffffffff}}, @eret={0xe6, 0x18, 0x8}, @svc={0x122, 0x40, {0xc5000021, [0x0, 0x7, 0x6, 0x5, 0xffff]}}], 0xc8}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) (async) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0x76) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) 48.78083611s ago: executing program 1 (id=184): ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r0 = eventfd2(0x8a, 0x80001) close(r0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, r1, 0x0, 0x110, r2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80200, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0xd1e3) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000080)=@arm64_core={0x603000000010004a, &(0x7f0000000040)=0x3}) ioctl$KVM_GET_MP_STATE(r2, 0x8004ae98, &(0x7f00000000c0)) r4 = ioctl$KVM_GET_STATS_FD_cpu(r2, 0xaece) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x2) r5 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000180)={0x0, &(0x7f0000000100)=[@uexit={0x0, 0x18}, @svc={0x122, 0x40, {0x6000000, [0xc, 0x9, 0x4, 0x7fffffff, 0x6]}}, @eret={0xe6, 0x18, 0x6}], 0x70}, &(0x7f00000001c0)=[@featur2={0x1, 0x40}], 0x1) ioctl$KVM_ARM_VCPU_FINALIZE(r5, 0x4004aec2, &(0x7f0000000200)=0x4) ioctl$KVM_SIGNAL_MSI(r4, 0x4020aea5, &(0x7f0000000240)={0xeeee0000, 0xf000, 0x398a, 0x0, 0x40}) mmap$KVM_VCPU(&(0x7f0000ffc000/0x1000)=nil, r1, 0x2, 0x20010, r4, 0x0) ioctl$KVM_S390_VCPU_FAULT(r4, 0x4008ae52, &(0x7f0000000280)=0x2) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f00000002c0)={0x0, 0xf000, 0x2, r0, 0xe}) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000300)={0xa}) ioctl$KVM_S390_VCPU_FAULT(0xffffffffffffffff, 0x4008ae52, &(0x7f0000000340)=0xc886) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, r1, 0x9, 0x810, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ff9000/0x4000)=nil, r1, 0x3000008, 0x10, r2, 0x0) ioctl$KVM_CLEAR_DIRTY_LOG(r4, 0xc018aec0, &(0x7f0000000780)={0x4, 0x0, 0x2c0, &(0x7f0000000380)=[0x5, 0xc9, 0x2b5f, 0xfffffffffffffffa, 0x73d0, 0x7fffffff, 0x1, 0xaa, 0xfffffffffffffffa, 0x786, 0x3, 0x80, 0x5a, 0x6, 0x800, 0x6, 0x4, 0x6, 0x1, 0x6, 0x6, 0x100, 0x2, 0x2, 0x7f, 0x8, 0x7fff, 0x10, 0x3, 0x8, 0x7, 0x7, 0x4422000000000000, 0x2, 0x8, 0x2, 0x80000000, 0x7db0, 0x5, 0x3, 0xe4, 0xfffffffffffffffe, 0xbf89, 0xffff, 0x1, 0x2, 0x9, 0x4, 0x8, 0x8000, 0x2, 0x0, 0xfff, 0x3, 0x31e, 0x7, 0x8000000000000000, 0x1, 0x2, 0x0, 0x9, 0x2e, 0x0, 0x2, 0xfffffffffffffffc, 0x400, 0x4000000000, 0x7ff, 0x5, 0xa, 0xfff, 0x6, 0x8, 0x800, 0x1000, 0x1, 0x8000000000000001, 0xfffffffffffffff7, 0x1727, 0x2, 0x6, 0x8, 0x2, 0x1, 0x9, 0x3, 0x8, 0x4, 0x80000000, 0x8000000000000001, 0x7, 0x2e3, 0x0, 0x2a, 0x4, 0xc4c3, 0x1, 0x8000000000000000, 0x6, 0x45085d67, 0x80, 0x9, 0x1, 0x1, 0x10001, 0xfb, 0x4, 0xf1, 0x7, 0x5, 0x100000001, 0xb, 0x9, 0xe8f, 0x9, 0x5, 0x0, 0x4000000000000, 0xf5b6, 0xffffffffffffff0e, 0x11e7, 0xb54c, 0x5, 0x9, 0x9, 0x3, 0x3ff, 0x6]}) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r6, 0x4018aee1, &(0x7f00000007c0)=@attr_pvtime_ipa) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x81) ioctl$KVM_SET_SIGNAL_MASK(r4, 0x4004ae8b, &(0x7f0000000800)={0x7f, "f8accf9bf45dad2e1069a863c119398b2daad66b7b09886292d88b2b1683258a05ac63f85a2db753fc0d79035626f79bc2a8ec3b4cf11b3a5d47ef47ff0591dd191cf780bd0e6cba5e1f770f9d98e4f2e0d4411bcb1d5ad6d7df5cdeb29f9c31435c134cf76a3391b40108358707f45bf6312b621474df099ba133dfd42531"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r5, 0x4010aeab, &(0x7f00000008c0)={0xfffffffffffffff5, 0x3000}) 47.358847636s ago: executing program 0 (id=185): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r2, 0x3, 0xa0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0xfffffffffffffffd, 0x5}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r5, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r9 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x28) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x1) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r10, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x408) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x100000c, 0x6832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000100), 0x80402, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x2c) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) r14 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) ioctl$KVM_CREATE_VM(r14, 0xae01, 0x17) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) 43.55168788s ago: executing program 1 (id=186): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000000)={0x0, &(0x7f0000000100)=[@its_send_cmd={0xaa, 0x28, {0x4, 0x2, 0x2, 0x4, 0x0, 0x80}}], 0x28}, 0x0, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x6030000000138002, 0x7ffc}}], 0x20}, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x1, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000080)={0x5, 0x1}) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)=@arm64_sys={0x603000000013d801, &(0x7f0000000000)=0x8005}) 34.760214347s ago: executing program 0 (id=187): syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (async) r1 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x23) ioctl$KVM_CAP_PTP_KVM(r3, 0x4068aea3, &(0x7f0000000280)) write$eventfd(0xffffffffffffffff, 0x0, 0x0) (async) write$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) (async) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_API_VERSION(r1, 0xae00, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r5}) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) (async) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_GUEST_DEBUG_arm64(r9, 0x4208ae9b, &(0x7f0000000340)={0x20001, 0x0, {[0x3800000000000000, 0x0, 0x5, 0x3, 0x5, 0xe88, 0x5, 0x800, 0x6, 0xfffffffffffffff9, 0x7f07, 0x3, 0x6, 0x2, 0x80, 0x1], [0x2a, 0x4, 0x9, 0x5, 0x3, 0x1, 0x5, 0xd, 0x8, 0xdc, 0x7fffffffffffffff, 0x1, 0x4, 0x8, 0x10000, 0x9], [0x81, 0xe, 0x1, 0x3, 0x7, 0x2e0882c1, 0x2, 0x40, 0x0, 0x8000000000000001, 0x3, 0xaf, 0xc7, 0x9, 0x7fff, 0x9], [0x7, 0x10001, 0x6, 0x7, 0x7ff, 0x849, 0x1, 0x9, 0x7fffffffffffffff, 0x9, 0x4, 0xe, 0xaf, 0xffff, 0x0, 0x3cbbf330]}}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r9, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000280)={0x14, 0xff, 0x1}}) r10 = syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r10, 0xae80, 0x0) ioctl$KVM_IRQ_LINE(r7, 0x4008ae61, &(0x7f0000000080)={0x1, 0x7}) 29.963279386s ago: executing program 1 (id=188): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x3) (async) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r4, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) ioctl$KVM_ARM_VCPU_FINALIZE(r4, 0x4004aec2, &(0x7f0000000180)=0x4) ioctl$KVM_GET_REG_LIST(r4, 0xc008aeb0, &(0x7f00000000c0)={0x15e}) r5 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) (async) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0xffff7ffffffffffb) (async) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0xffff7ffffffffffb) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) (async) r8 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x3, 0xa0) (async) syz_kvm_vgic_v3_setup(r1, 0x3, 0xa0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8}) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x40004000034) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x5, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}}], 0x75}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r10, 0x40000000000004, 0xc0) (async) syz_kvm_vgic_v3_setup(r10, 0x40000000000004, 0xc0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r13, 0xae04) 23.6696306s ago: executing program 0 (id=189): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0xdddd1000, 0x0, r6}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000000)={0xc, 0xeeef0000, 0x2, r6}) (async) close(r5) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f00004dc000/0x400000)=nil) 18.311120745s ago: executing program 1 (id=190): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x20) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async, rerun: 32) syz_kvm_assert_reg(0xffffffffffffffff, 0x603000000013dce8, 0x8000) (rerun: 32) r5 = openat$kvm(0x0, 0x0, 0x140, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x2e) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r4, r9, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r9, 0xae80, 0x0) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000040)={0x0, &(0x7f00000000c0)}, 0x0, 0x0) (async) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil) r13 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[@msr={0x14, 0x20, {0x603000000013df64, 0x8000}}, @msr={0x14, 0x20, {0x603000000013df7f, 0x8000}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r16, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) r17 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r17, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000240)={0x8, 0x9}}) ioctl$KVM_RUN(r16, 0xae80, 0x0) (async, rerun: 32) r18 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) (rerun: 32) ioctl$KVM_SET_ONE_REG(r18, 0x4010aeac, &(0x7f0000000100)=@arm64_fw={0x6030000000140003, &(0x7f0000000000)=0x100}) 14.400373081s ago: executing program 0 (id=191): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_SIGNAL_MASK(r6, 0x4004ae8b, 0x0) (async) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000300)=@attr_other={0x0, 0x8, 0x40, &(0x7f0000000140)=0x2}) 1.230515496s ago: executing program 0 (id=192): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) openat$kvm(0x0, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r5 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) close(r5) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f0000000100)={0x10001, 0x4, 0xeeef0000, 0x2000, &(0x7f0000e03000/0x2000)=nil, 0x2, r5}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x80, 0x0) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0xe4) r7 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@smc={0x1e, 0x40, {0x84000053, [0x80000000000, 0x6, 0xf1, 0x6f4, 0x1]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) 0s ago: executing program 1 (id=193): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=[@featur1={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2e) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000040)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000080)=[@featur1={0x1, 0x2}], 0x1) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) kernel console output (not intermixed with test programs): [ 398.850218][ T3145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 449.911810][ T3145] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:49035' (ED25519) to the list of known hosts. [ 616.991731][ T25] audit: type=1400 audit(616.170:61): avc: denied { name_bind } for pid=3302 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 618.006364][ T25] audit: type=1400 audit(617.180:62): avc: denied { execute } for pid=3303 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 618.031931][ T25] audit: type=1400 audit(617.210:63): avc: denied { execute_no_trans } for pid=3303 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 646.635316][ T25] audit: type=1400 audit(645.810:64): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 646.668378][ T25] audit: type=1400 audit(645.850:65): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 646.754865][ T3303] cgroup: Unknown subsys name 'net' [ 646.805810][ T25] audit: type=1400 audit(645.980:66): avc: denied { unmount } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 647.216147][ T3303] cgroup: Unknown subsys name 'cpuset' [ 647.325932][ T3303] cgroup: Unknown subsys name 'rlimit' [ 648.281708][ T25] audit: type=1400 audit(647.460:67): avc: denied { setattr } for pid=3303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 648.302969][ T25] audit: type=1400 audit(647.480:68): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 648.331995][ T25] audit: type=1400 audit(647.510:69): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 649.573168][ T3306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 649.594697][ T25] audit: type=1400 audit(648.770:70): avc: denied { relabelto } for pid=3306 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 649.620913][ T25] audit: type=1400 audit(648.800:71): avc: denied { write } for pid=3306 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 649.832538][ T25] audit: type=1400 audit(649.010:72): avc: denied { read } for pid=3303 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 649.850898][ T25] audit: type=1400 audit(649.030:73): avc: denied { open } for pid=3303 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 649.898600][ T3303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 699.915798][ T25] audit: type=1400 audit(699.090:74): avc: denied { execmem } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 706.429163][ T25] audit: type=1400 audit(705.610:75): avc: denied { read } for pid=3309 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 706.456944][ T25] audit: type=1400 audit(705.620:76): avc: denied { open } for pid=3309 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 706.524956][ T25] audit: type=1400 audit(705.700:77): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 706.762549][ T25] audit: type=1400 audit(705.940:78): avc: denied { module_request } for pid=3310 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 706.782411][ T25] audit: type=1400 audit(705.960:79): avc: denied { module_request } for pid=3309 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 707.926828][ T25] audit: type=1400 audit(707.100:80): avc: denied { sys_module } for pid=3309 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 733.087189][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 733.628005][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 733.815510][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 734.181696][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 746.862350][ T3309] hsr_slave_0: entered promiscuous mode [ 746.899032][ T3309] hsr_slave_1: entered promiscuous mode [ 747.652690][ T3310] hsr_slave_0: entered promiscuous mode [ 747.691572][ T3310] hsr_slave_1: entered promiscuous mode [ 747.727894][ T3310] debugfs: 'hsr0' already exists in 'hsr' [ 747.731902][ T3310] Cannot create hsr debugfs directory [ 753.406751][ T25] audit: type=1400 audit(752.580:81): avc: denied { create } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 753.447853][ T25] audit: type=1400 audit(752.620:82): avc: denied { write } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 753.517438][ T25] audit: type=1400 audit(752.690:83): avc: denied { read } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 753.649790][ T3309] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 754.116901][ T3309] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 754.438165][ T3309] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 754.738063][ T3309] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 756.240471][ T3310] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 756.429155][ T3310] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 756.672131][ T3310] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 756.917999][ T3310] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 777.106928][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 780.619918][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 842.051645][ T3309] veth0_vlan: entered promiscuous mode [ 842.638434][ T3309] veth1_vlan: entered promiscuous mode [ 844.601676][ T3310] veth0_vlan: entered promiscuous mode [ 844.914264][ T3309] veth0_macvtap: entered promiscuous mode [ 845.233054][ T3309] veth1_macvtap: entered promiscuous mode [ 845.329685][ T3310] veth1_vlan: entered promiscuous mode [ 847.927898][ T3380] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.031324][ T987] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.054609][ T987] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.060298][ T987] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 848.231411][ T3310] veth0_macvtap: entered promiscuous mode [ 848.689157][ T3310] veth1_macvtap: entered promiscuous mode [ 850.617767][ T25] audit: type=1400 audit(849.790:84): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 850.868232][ T25] audit: type=1400 audit(850.040:85): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.HY2qCI/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 851.206630][ T25] audit: type=1400 audit(850.380:86): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 851.419154][ T3381] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.420330][ T3381] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.441203][ T3381] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.468675][ T3381] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 851.687669][ T25] audit: type=1400 audit(850.850:87): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.HY2qCI/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 851.767569][ T25] audit: type=1400 audit(850.940:88): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.HY2qCI/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3769 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 852.337044][ T25] audit: type=1400 audit(851.500:89): avc: denied { unmount } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 852.687278][ T25] audit: type=1400 audit(851.850:90): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 852.835218][ T25] audit: type=1400 audit(852.010:91): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="gadgetfs" ino=3781 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 853.499997][ T25] audit: type=1400 audit(852.660:92): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 853.558762][ T25] audit: type=1400 audit(852.740:93): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 854.349648][ T3309] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 864.431069][ T25] kauditd_printk_skb: 4 callbacks suppressed [ 864.441027][ T25] audit: type=1400 audit(863.610:98): avc: denied { read append } for pid=3467 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 864.467100][ T25] audit: type=1400 audit(863.640:99): avc: denied { open } for pid=3467 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 864.836501][ T25] audit: type=1400 audit(864.010:100): avc: denied { ioctl } for pid=3467 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 866.849035][ T25] audit: type=1400 audit(866.020:101): avc: denied { write } for pid=3467 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 885.566214][ T25] audit: type=1400 audit(884.730:102): avc: denied { execute } for pid=3483 comm="syz.0.5" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4107 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1142.000162][ T3643] kvm [3643]: Failed to find VMA for hva 0x21016000 [ 1282.779303][ T3726] kvm [3726]: Failed to find VMA for hva 0x20d8d000 [ 1333.044360][ T25] audit: type=1400 audit(1332.210:103): avc: denied { setattr } for pid=3759 comm="syz.1.92" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1537.658957][ T3885] kvm [3885]: Failed to find VMA for hva 0x20c01000 [ 1649.509664][ T3954] kvm [3954]: Failed to find VMA for hva 0x20c01000 [ 1729.197747][ T4007] kvm [4007]: Failed to find VMA for hva 0x20c01000 [ 1817.767412][ T4056] kvm [4056]: Failed to find VMA for hva 0x21016000 [ 1817.929718][ T4060] kvm [4060]: Failed to find VMA for hva 0x21016000 [ 1832.500764][ T4066] kvm [4066]: Failed to find VMA for hva 0x20c01000 [ 1834.320600][ T4069] kvm [4067]: Unsupported guest access at: eeef0000 [ 1834.320600][ T4069] { Op0( 2), Op1( 0), CRn( 0), CRm( 0), Op2( 2), func_write }, [ 1835.118827][ T4071] kvm [4067]: Unsupported guest access at: eeef0000 [ 1835.118827][ T4071] { Op0( 2), Op1( 0), CRn( 0), CRm( 0), Op2( 2), func_write }, [ 1878.945141][ T4096] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5f51d [ 1878.955074][ T4096] flags: 0x1ffc94000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x25) [ 1878.975527][ T4096] raw: 01ffc94000000000 ffffc1ffc07d40c8 ffffc1ffc07d01c8 0000000000000000 [ 1878.988354][ T4096] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 1879.005814][ T4096] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 1879.036922][ T4096] ------------[ cut here ]------------ [ 1879.037180][ T4096] kernel BUG at ./include/linux/mm.h:1036! [ 1879.038999][ T4096] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 1879.043763][ T4096] Modules linked in: [ 1879.045851][ T4096] CPU: 0 UID: 0 PID: 4096 Comm: syz.1.193 Not tainted syzkaller #0 PREEMPT [ 1879.047388][ T4096] Hardware name: linux,dummy-virt (DT) [ 1879.048605][ T4096] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1879.049868][ T4096] pc : kvm_s2_put_page+0x374/0x3a0 [ 1879.052155][ T4096] lr : kvm_s2_put_page+0x374/0x3a0 [ 1879.053172][ T4096] sp : ffff8000a8a07450 [ 1879.053886][ T4096] x29: ffff8000a8a07450 x28: 2ff000001f407000 x27: 2ff000001f407000 [ 1879.055472][ T4096] x26: 00000000000000ff x25: ffff80008734e000 x24: ffffc1ffc0000000 [ 1879.056717][ T4096] x23: ffffc1ffc07d4748 x22: 0000000000000000 x21: ffffc1ffc07d4774 [ 1879.058076][ T4096] x20: 0000000000000000 x19: ffffc1ffc07d4740 x18: 00000000c05ec543 [ 1879.059407][ T4096] x17: 000000000490cbb2 x16: 00000000c05e9c53 x15: 000000003d911ad5 [ 1879.060702][ T4096] x14: ffffffffffffffff x13: fff000001d90bb08 x12: 0000000000000001 [ 1879.062033][ T4096] x11: 0000000000000000 x10: 0000000000ff0100 x9 : 14e76bf1e90d6c00 [ 1879.063488][ T4096] x8 : 14e76bf1e90d6c00 x7 : ffff8000803a03c8 x6 : 0000000000000000 [ 1879.064770][ T4096] x5 : 0000000000000001 x4 : 0000000000000001 x3 : ffff80008074b7f8 [ 1879.066059][ T4096] x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003e [ 1879.067614][ T4096] Call trace: [ 1879.068508][ T4096] kvm_s2_put_page+0x374/0x3a0 (P) [ 1879.069807][ T4096] stage2_free_walker+0x1b0/0x264 [ 1879.070825][ T4096] __kvm_pgtable_walk+0x7d8/0xa68 [ 1879.071811][ T4096] kvm_pgtable_walk+0x294/0x468 [ 1879.072737][ T4096] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 1879.073831][ T4096] kvm_free_stage2_pgd+0x198/0x28c [ 1879.074778][ T4096] kvm_uninit_stage2_mmu+0x20/0x38 [ 1879.075717][ T4096] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 1879.076651][ T4096] kvm_mmu_notifier_release+0x48/0xa8 [ 1879.077662][ T4096] __mmu_notifier_release+0x310/0x614 [ 1879.078619][ T4096] exit_mmap+0xb8/0xbb8 [ 1879.079463][ T4096] __mmput+0x10c/0x528 [ 1879.080311][ T4096] mmput+0x70/0xac [ 1879.081097][ T4096] exit_mm+0x158/0x258 [ 1879.081902][ T4096] do_exit+0x788/0x2378 [ 1879.082716][ T4096] do_group_exit+0x1d4/0x2ac [ 1879.083555][ T4096] get_signal+0x1440/0x1554 [ 1879.084461][ T4096] do_signal+0x23c/0x4dd0 [ 1879.085385][ T4096] do_notify_resume+0xb0/0x270 [ 1879.086223][ T4096] el0_svc+0xb8/0x164 [ 1879.087050][ T4096] el0t_64_sync_handler+0x84/0x12c [ 1879.087987][ T4096] el0t_64_sync+0x198/0x19c [ 1879.089500][ T4096] Code: d0037581 9126fc21 aa1303e0 97f9c9f2 (d4210000) [ 1879.091302][ T4096] ---[ end trace 0000000000000000 ]--- [ 1879.092782][ T4096] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 1879.094700][ T4096] Kernel Offset: disabled [ 1879.095401][ T4096] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 1879.096462][ T4096] Memory Limit: none [ 1879.098094][ T4096] Rebooting in 86400 seconds.. VM DIAGNOSIS: 04:38:29 Registers: info registers vcpu 0 CPU#0 PC=ffff800080020220 X00=0000000000000012 X01=0000000100000003 X02=0000000000000001 X03=ffff80008074b600 X04=0000000000000000 X05=0000000000000000 X06=ffff80008048b334 X07=ffff800080015834 X08=14e76bf1e90d6c00 X09=14e76bf1e90d6c00 X10=0000000000ff0100 X11=0000000000000003 X12=0000000000000004 X13=fff000001d90bb08 X14=0000000000000000 X15=ffff800087f83a20 X16=0000000000000000 X17=000000000490cbb2 X18=00000000c05ec543 X19=efff800000000000 X20=ffff8000801b05a0 X21=ffff8000a8a07300 X22=0000000000000000 X23=0000000000008001 X24=00000000000000ff X25=ffff80008734e000 X26=00000000000000ff X27=2ff000001f407000 X28=98f000001d90bb00 X29=ffff8000a8a07180 X30=ffff800080020220 SP=ffff8000a8a07150 PSTATE=604023c9 -ZC- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=1900000000000000:1900000000000000 Z01=0000001900000000:0000000000000000 Z02=0000000000000019:0000000000000000 Z03=00d000a800000000:0000000000000000 Z04=0000000000000000:0000000000000002 Z05=0000000000000019:0000000000000002 Z06=6edc4d3a2914b135:d8e9c869e2695c88 Z07=b20fae707afde253:388e9c6c4fa85ca0 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffeeb87ab0:0000ffffeeb87ab0 Z17=ffffff80ffffffd0:0000ffffeeb87a80 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000