last executing test programs: 31m24.075726094s ago: executing program 0 (id=134): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r1, 0xae03, 0x5d) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000280)={0xdf, 0x0, 0x2000}) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r3, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r4, 0x40086602, 0x110e22ffff) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x3202, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, r3, 0x6, 0x8032, 0xffffffffffffffff, 0x0) r6 = eventfd2(0xfffffffa, 0x80001) write$eventfd(r6, &(0x7f0000000200)=0x8, 0x8) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="37d3116035d7513e9a000200018000", 0x0, 0x43) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x20000000) ioctl$KVM_CHECK_EXTENSION(r5, 0x40086602, 0x110e227ffe) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x28) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r10, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_cpu$arm64(r8, r10, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="aa00000000000000280000000000000003010400000000000000090000000e0000000000000000003200000000000000400000000000000100000006000000000000000000000000f7780000000013000800000000000000030000000000000009000000000000001e0000000000000040000000000000000900008400000000050000000000000010000000000000007f0d0000000000000010000000000000050000000000006b03000000000000001800000000000000000000005a000000be00000000000000180000000000000028981300000030601400000000000000200000000000000085c01300000030600100000001000000320000000000000040000000000000000d0000c400000000ffffffff000000000001000000000000060000000000000007000000000000000000000000000080320000000000000040000000000000000b000084000000000400000000000000080000000000000006000000000000000600000000000000dd00000000000000be000000000000001800000000000000fe77000000000000"], 0x190}], 0x1, 0x0, 0x0, 0x0) 31m19.371182794s ago: executing program 1 (id=135): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) (async) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x603000000010000a, &(0x7f0000000000)=0x10000}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (async) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0x52) (async) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0x52) r7 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) (async) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2000000000) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000bfd000/0x400000)=nil) openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (async) r11 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) (async) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = eventfd2(0x6, 0x800) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000280)={r14, 0x9}) (async) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000280)={r14, 0x9}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r14, 0x74, 0x2, r14}) r15 = eventfd2(0xfffff801, 0x80000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f00000001c0)={r14, 0x0, 0x2, r15}) syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@msr={0x14, 0x20, {0x603000000013c081, 0x2}}], 0x20}, 0x0, 0x0) (async) r16 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@msr={0x14, 0x20, {0x603000000013c081, 0x2}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r16, 0x4018aee1, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) r17 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000b80)={0x0, &(0x7f00000009c0)=[@hvc={0x32, 0x40, {0xc4000004, [0x400000000000007, 0xfffffffffffffffa, 0x8000000000000000, 0x427f, 0x400003]}}], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r17, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x10003, 0x5, 0x1, 0x1000, &(0x7f0000eab000/0x1000)=nil}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x8}) 31m11.837655094s ago: executing program 1 (id=136): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = eventfd2(0x101, 0x800) write$eventfd(r1, &(0x7f0000000080)=0xfffffffffffffff7, 0x8) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) r5 = syz_kvm_vgic_v3_setup(r2, 0x4, 0x220) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r5, 0x4018aee3, &(0x7f0000000240)=@attr_other={0x0, 0x6, 0x0, 0x0}) (async) ioctl$KVM_HAS_DEVICE_ATTR(r5, 0x4018aee3, &(0x7f0000000240)=@attr_other={0x0, 0x6, 0x0, 0x0}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xdddd1000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee1, &(0x7f00000000c0)=@attr_irq_timer={0x0, 0x1, 0x1, 0x0}) ioctl$KVM_CREATE_DEVICE(r7, 0xc018aec0, &(0x7f00000000c0)={0x1}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x25) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) (async) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x0, 0x6, 0x2, 0x4}}], 0x50}, 0x0, 0x0) (async) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x0, 0x6, 0x2, 0x4}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r9, 0x1, 0x100) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r13, 0x40a0ae49, &(0x7f00000000c0)={0x5, 0x5, 0x2000, 0x1000, &(0x7f0000ffd000/0x1000)=nil, 0x3}) (async) ioctl$KVM_SET_USER_MEMORY_REGION2(r13, 0x40a0ae49, &(0x7f00000000c0)={0x5, 0x5, 0x2000, 0x1000, &(0x7f0000ffd000/0x1000)=nil, 0x3}) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r13, 0x4068aea3, &(0x7f0000000280)={0xe4, 0x0, 0x1000}) (async) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r13, 0x4068aea3, &(0x7f0000000280)={0xe4, 0x0, 0x1000}) ioctl$KVM_INTERRUPT(r11, 0x4004ae86, &(0x7f0000000000)=0x8) 31m8.057573605s ago: executing program 0 (id=137): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000140)=@arm64_bitmap={0x6070000000160002, 0x0}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x4602, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x28) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(r4, r7, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000001140)=[{0x0, 0x0}], 0x1, 0x0, &(0x7f0000001180)=[@featur2={0x1, 0xac}], 0x1) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) (async) r10 = syz_kvm_vgic_v3_setup(r9, 0x1, 0x100) ioctl$KVM_HAS_DEVICE_ATTR(r10, 0x4018aee3, &(0x7f0000000380)=@attr_other={0x0, 0x5, 0x0, 0x0}) (async) ioctl$KVM_HAS_DEVICE_ATTR(r10, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0x9, 0xb6df, &(0x7f0000000000)=0x3}) 31m1.890322285s ago: executing program 0 (id=138): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r1, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x400c80, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, r3, 0x0, 0x40032, 0xffffffffffffffff, 0x0) 30m59.182398705s ago: executing program 1 (id=139): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x40) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r0, 0x4010ae74, &(0x7f0000000000)={0x0, 0x8001, 0x80}) (async) r1 = syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000bfe000/0x400000)=nil) r2 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x38) ioctl$KVM_CAP_HALT_POLL(r2, 0x4068aea3, &(0x7f0000000040)={0xb6, 0x0, 0x2bb}) (async, rerun: 32) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async, rerun: 32) ioctl$KVM_SET_DEVICE_ATTR_vm(r0, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0xcbc0}}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) (async) r5 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000001c0)={0x0, &(0x7f0000000180)=[@mrs={0xbe, 0x18, {0x1867}}], 0x18}, &(0x7f0000000200)=[@featur2={0x1, 0xc0}], 0x1) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r5, 0x4018aee3, &(0x7f0000000280)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000240)=0x6}) (async) syz_kvm_setup_cpu$arm64(r3, r2, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000000900)=[{0x0, &(0x7f00000002c0)=[@msr={0x14, 0x20, {0x603000000013f300, 0x6}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x1, 0x3, 0xd, 0x3f1e, 0xe9, 0x4}}, @msr={0x14, 0x20, {0x603000000013dce5, 0x42619318}}, @code={0xa, 0xb4, {"0060000e1f00003100d299d20040b8f2e10080d2020080d2430080d2440080d2020000d420c395d200a0b8f2a10180d2420080d2830180d2640180d2020000d4602592d20060b8f2010080d2620080d2430180d2040080d2020000d420ec98d200c0b8f2010080d2c20080d2c30080d2a40180d2020000d400a8205e60bf82d200e0b8f2a10180d2020080d2c30180d2240180d2020000d4000028d500008052"}}, @its_setup={0x82, 0x28, {0x1, 0x2, 0x9f}}, @uexit={0x0, 0x18, 0x7}, @memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x80, 0x5, 0xb}}, @irq_setup={0x46, 0x18, {0x2, 0x12d}}, @irq_setup={0x46, 0x18, {0x4, 0x36e}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x242}}, @irq_setup={0x46, 0x18, {0x2, 0x1d3}}, @smc={0x1e, 0x40, {0x84000000, [0x5, 0x100000000, 0x53d, 0x3, 0xf9b]}}, @msr={0x14, 0x20, {0x603000000013df4d, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x2, 0x2, 0x10001, 0x9, 0x3}}, @smc={0x1e, 0x40, {0x4008051, [0x6, 0x100, 0x93c8, 0x5, 0x40]}}, @code={0xa, 0x84, {"007008d5000028d5000990d200e0b0f2c10180d2220080d2630180d2c40180d2020000d4007008d5007008d5007008d5007008d540979cd20020b8f2010080d2220180d2430180d2640080d2020000d4608e91d200c0b8f2a10080d2620080d2030080d2840180d2020000d4007008d5"}}, @mrs={0xbe, 0x18, {0x603000000013e180}}, @code={0xa, 0xcc, {"206791d200a0b8f2010080d2020080d2230080d2a40180d2020000d4a0209ed20060b8f2010180d2620180d2c30080d2e40180d2020000d40000c0dac05994d20060b0f2c10080d2620180d2230080d2040180d2020000d4e00d82d20000b0f2c10180d2020180d2630180d2a40180d2020000d40050204e60eb95d200c0b8f2810180d2c20080d2430180d2840080d2020000d40068603c0080a09be05284d20060b0f2810080d2820180d2e30180d2240080d2020000d4"}}, @mrs={0xbe, 0x18, {0x603000000013f288}}, @mrs={0xbe, 0x18, {0x603000000013dea7}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x40, 0x8, 0x1}}, @svc={0x122, 0x40, {0x8000, [0x6, 0x80, 0x6, 0xfffffffffffffff7, 0x7]}}, @hvc={0x32, 0x40, {0x5000000, [0x6, 0x100000000, 0x2, 0x6, 0x80000000]}}, @its_setup={0x82, 0x28, {0x1, 0x4, 0x19f}}, @svc={0x122, 0x40, {0x3000000, [0x100000000, 0x1, 0xffffffff, 0x3, 0x1]}}, @msr={0x14, 0x20, {0x603000000013ff12, 0xbb44}}, @msr={0x14, 0x20, {0x603000000013c10b, 0x2}}, @svc={0x122, 0x40, {0x1000, [0xb, 0xa, 0x0, 0x149, 0x1]}}, @irq_setup={0x46, 0x18, {0x0, 0x2ea}}], 0x60c}], 0x1, 0x0, &(0x7f0000000940)=[@featur1={0x1, 0x10}], 0x1) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000980), 0x402c00, 0x0) (async) r6 = syz_kvm_add_vcpu$arm64(r1, &(0x7f0000000f00)={0x0, &(0x7f00000009c0)=[@its_setup={0x82, 0x28, {0x4, 0x0, 0x31b}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x2, 0x2, 0x6, 0x1, 0x2}}, @uexit={0x0, 0x18, 0x81}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x100, 0xc, 0x8}}, @smc={0x1e, 0x40, {0x80000001, [0x2, 0x6, 0x2, 0x5, 0x46]}}, @svc={0x122, 0x40, {0xc4000005, [0x5, 0x3ff, 0xfffffffffffffff2, 0x73f, 0x82]}}, @its_setup={0x82, 0x28, {0x3, 0x2, 0x226}}, @smc={0x1e, 0x40, {0x100, [0x1, 0xffffffffffffff00, 0x1ff, 0x100, 0x8]}}, @code={0xa, 0x6c, {"e08998d20040b8f2210080d2820080d2030080d2240080d2020000d4000028d5e0049ed20040b0f2810080d2420080d2430080d2440080d2020000d40000249e0000009c007008d5000008d5000028d5000008d5008008d5"}}, @mrs={0xbe, 0x18, {0x603000000013e08b}}, @svc={0x122, 0x40, {0x4, [0xc, 0x100000001, 0x3, 0xffffffff, 0x80000000]}}, @mrs={0xbe, 0x18, {0x603000000013806c}}, @mrs={0xbe, 0x18, {0x603000000013c01d}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x1, 0xc, 0x80, 0x0, 0x2}}, @svc={0x122, 0x40, {0x84000006, [0x3000000000000000, 0x6, 0x5, 0x98, 0x3ff]}}, @hvc={0x32, 0x40, {0x86000001, [0xdce3, 0x8, 0x9, 0x2, 0xb]}}, @code={0xa, 0xb4, {"c08a90d20080b8f2a10180d2a20180d2030180d2c40080d2020000d40004000f000028d5007008d5000008d5800d9dd20060b0f2010080d2a20080d2230180d2e40180d2020000d4205390d20000b0f2210180d2020180d2a30080d2c40180d2020000d400878fd20020b0f2e10080d2620080d2830080d2640180d2020000d4a08a91d20020b8f2e10180d2e20080d2230180d2a40180d2020000d4000028d5"}}, @irq_setup={0x46, 0x18, {0x2, 0x3d2}}, @svc={0x122, 0x40, {0x84000013, [0x100000000, 0x10001, 0x5, 0xe, 0x8]}}, @svc={0x122, 0x40, {0x84000002, [0x80000001, 0xd, 0x7f, 0x3, 0x5]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x8, 0x7f, 0xd}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x0, 0xe, 0x1, 0x24000, 0x2}}, @smc={0x1e, 0x40, {0x10, [0x5, 0x9, 0x10d, 0x1, 0xffffffff]}}, @smc={0x1e, 0x40, {0x0, [0x2, 0x4, 0x16fb, 0xfffffffffffffffa]}}], 0x540}, &(0x7f0000000f40)=[@featur2={0x1, 0x1}], 0x1) ioctl$KVM_SIGNAL_MSI(r0, 0x4020aea5, &(0x7f0000000f80)={0xffff1000, 0x0, 0x458, 0x0, 0xb5b}) (async) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r2, 0x4068aea3, &(0x7f0000000fc0)={0xa8, 0x0, 0x1}) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000001040)="a1be6b6666866231b337cfc187ee5bc502d9554c6901be2207a0e7b87a6aca26b65b71b29d384a219f81dab7b5e8d870a4032676364cb944e362052955e695d1dd18235392820efd", 0x0, 0x48) (async) r7 = mmap$KVM_VCPU(&(0x7f0000cbf000/0x3000)=nil, 0x0, 0x5, 0x40010, r6, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r7, 0x20, &(0x7f00000010c0)="d4a37f0943f8f17ea7755dc9f0be675b798868a2c7e9009f27b8021ff6f88533c663c3be2bab3fd3f3489187fc3495d345b4e8d26ed85db31c48a5be52f397371dd3e3fc7ce2cada", 0x0, 0x48) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000c27000/0x4000)=nil, r8, 0x1000002, 0x8010, r6, 0x0) (async) r9 = syz_kvm_add_vcpu$arm64(r1, &(0x7f0000001240)={0x0, &(0x7f0000001140)=[@its_setup={0x82, 0x28, {0x0, 0x1, 0x132}}, @smc={0x1e, 0x40, {0x0, [0x3b5f744b, 0x7, 0x10001, 0x6, 0x8000000000000000]}}, @irq_setup={0x46, 0x18, {0x3, 0x68}}, @hvc={0x32, 0x40, {0x10, [0x3, 0x8, 0x9073, 0x200, 0xd2ec]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xc45c7d04a7da7f56, 0x3}}], 0xf0}, &(0x7f0000001280)=[@featur2={0x1, 0xe3ad097071c3ab69}], 0x1) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f00000012c0)=@x86={0x2, 0xff, 0x90, 0x0, 0x5, 0x5, 0x3, 0xc, 0x9d, 0x6, 0x3, 0xfa, 0x0, 0x7c098f9, 0xc4b0, 0x32, 0x6, 0x2, 0x8, '\x00', 0x1, 0x81}) (async) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000001340)=@arm64_fp_extra={0x60200000001000d5, &(0x7f0000001300)=0xf}) (async) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, r8, 0x1, 0x12, r4, 0x0) (async) ioctl$KVM_CAP_DIRTY_LOG_RING(r3, 0x4068aea3, &(0x7f0000001380)={0xc0, 0x0, 0x2000}) (async) ioctl$KVM_SET_REGS(r2, 0x4360ae82, &(0x7f0000001400)={[0x8000000000000001, 0xffffffffffffffe6, 0x3ffc000000000000, 0x0, 0x8, 0x7, 0xe, 0xe39c, 0x100000000, 0x800, 0x4, 0x6, 0x4, 0x9, 0x3, 0xff], 0x1, 0x30000}) (async) ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000014c0)={0x6, 0xfffffffffffffff8}) ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f0000001540)=@attr_other={0x0, 0xfffffffd, 0x8, &(0x7f0000001500)=0x8}) 30m55.180356486s ago: executing program 0 (id=140): syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f0000000140)="38ce8347fc1e86008cfc72bb312c8659dcc9225b48cb5cb00c73b0b30800000073f7f1f493e89c859e17625ad1b19c73a7fd4ce992bfc316bd22ccc646cd69c72800", 0x0, 0x1f) (async) r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async, rerun: 64) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) (async, rerun: 64) r3 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r3}) (async) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r5 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x2, 0x1}}, @its_setup={0x82, 0x28, {0x4, 0x4, 0x62}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async, rerun: 32) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="7cfaa2bfd6dd76375aa1bde04fceeb33743b07d73b3e9aac", 0x0, 0xffffffffffffff94) (rerun: 32) 30m52.839195328s ago: executing program 1 (id=141): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x29) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x13) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0xd8) r5 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000300)={0x0, &(0x7f0000000480)=[@smc={0x1e, 0x40, {0xc4000012, [0x7, 0x939, 0xe, 0x7f]}}], 0x40}, &(0x7f00000001c0)=[@featur1={0x1, 0x18}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) (async, rerun: 32) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async, rerun: 32) r8 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) (async, rerun: 32) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (rerun: 32) r10 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r9, 0x2, 0x11, r8, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) (async, rerun: 64) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f0000000200)="af229d3c1d719c67f1a4a3231722e7facde719284c94d613364da4f8e13081325ea9eb36c05b83a7de45a57f215b88cc23a1286fb1ea26ad010b073b2d1732e8fdd6f5eb801ec058", 0x0, 0x48) (async, rerun: 64) r11 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) openat$kvm(0x0, 0x0, 0x8100, 0x0) (async) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000340)=[@featur2={0x1, 0x80}], 0x1) syz_kvm_vgic_v3_setup(r12, 0x1, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async, rerun: 32) r15 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x9) (rerun: 32) ioctl$KVM_SET_USER_MEMORY_REGION(r15, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 32) syz_kvm_setup_cpu$arm64(r15, 0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil, &(0x7f0000000280)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (rerun: 32) ioctl$KVM_SET_USER_MEMORY_REGION(r15, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async, rerun: 64) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r14, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) (rerun: 64) 30m47.96695984s ago: executing program 0 (id=142): munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x80111500, 0x20000000) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x0, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r0, 0x4010ae67, &(0x7f0000000000)={0xdddd0000, 0x12000}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r2 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r2, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r8}) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = eventfd2(0x5, 0x800) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r10, 0x8}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f00000000c0)={0x8000000008000800, 0x0, 0x0, r10, 0x2}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r10, 0x6}) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000800000/0x800000)=nil, 0x800000) 30m43.382621986s ago: executing program 1 (id=143): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x25000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000240)={0xffff1000, 0xa000}) 30m34.827213698s ago: executing program 1 (id=144): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013d000}}], 0x18}], 0x1, 0x0, 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x2, 0x6}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 30m33.691026472s ago: executing program 0 (id=145): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610f3ff67521cd66f8f1f447d35b20700000000000000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xb00f2, 0x0) 29m48.442263504s ago: executing program 32 (id=144): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013d000}}], 0x18}], 0x1, 0x0, 0x0, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x2, 0x6}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r4, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 29m45.377878441s ago: executing program 33 (id=145): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610f3ff67521cd66f8f1f447d35b20700000000000000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xb00f2, 0x0) 24m26.399382754s ago: executing program 2 (id=146): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x3000)=nil, r1, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0xdc032, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x30) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async, rerun: 32) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) (rerun: 32) mmap$KVM_VCPU(&(0x7f0000003000/0x3000)=nil, 0x0, 0x3000000, 0x4010, r4, 0x0) (async) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vm(r5, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000140)=[{0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="1e000000000000004000000000000000000000ef00000000fcffffffffffff1bf3a3b292e50d9600020000000100000003000000000000000400000000000000320000000000000040000000000000005200008400"], 0x80}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async, rerun: 64) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) ioctl$KVM_SIGNAL_MSI(r5, 0x4020aea5, &(0x7f0000000000)={0xeeef0000, 0xeeee8000, 0x9, 0x0, 0x5}) 23m58.747752297s ago: executing program 2 (id=148): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x25000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000240)={0xffff1000, 0xa000}) 23m46.656050134s ago: executing program 2 (id=150): r0 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r2, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000140)={0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013c640}}], 0x18}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000080)=@arm64_sve={0x6080000000150289, &(0x7f0000000000)=0x400}) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x180000b, 0x11, r2, 0x0) 23m32.839550466s ago: executing program 2 (id=152): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000200)={0x1fd, 0x2, 0x8000000, 0x2000, &(0x7f0000ecf000/0x2000)=nil}) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xcd) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x603000000010002a, &(0x7f00000000c0)=0xc}) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x140, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x1b) 22m45.087250335s ago: executing program 34 (id=152): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000200)={0x1fd, 0x2, 0x8000000, 0x2000, &(0x7f0000ecf000/0x2000)=nil}) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xcd) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000100)=@arm64_core={0x603000000010002a, &(0x7f00000000c0)=0xc}) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x140, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x1b) 20m0.987787708s ago: executing program 3 (id=170): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a82616}) r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x5, 0x2, 0x4}}], 0x28}, 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4360ae82, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 19m51.591632527s ago: executing program 3 (id=171): munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0x5421, 0xfffffffefffffffe) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0x40086602, 0x110e22ffff) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x6, 0x8032, 0xffffffffffffffff, 0x0) eventfd2(0xfffffffa, 0x80001) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x20000000) ioctl$KVM_CHECK_EXTENSION(r2, 0x40086602, 0x110e227ffe) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x28) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r6, 0xae03, 0xa5) r7 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_cpu$arm64(r4, r8, &(0x7f0000c00000/0x400000)=nil, 0x0, 0x0, 0x0, &(0x7f0000000080)=[@featur1={0x1, 0xc0}], 0x1) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) 19m36.707114567s ago: executing program 3 (id=172): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x28) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000280)={0xdf, 0x0, 0x2000}) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r4, 0x4068aea3, &(0x7f0000000080)={0xa8, 0x0, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$arm64(r4, 0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000500)={0x5, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000980)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000b80)={0x0, 0x0}, 0x0, 0x0) 19m21.212052716s ago: executing program 3 (id=173): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x2f) r0 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r1, 0xae04) r3 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r2, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000ff9000/0x4000)=nil, r2, 0x1000008, 0x10, 0xffffffffffffffff, 0x0) openat$kvm(0x0, 0x0, 0x80, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4040aea0, &(0x7f00000003c0)=@arm64={0xd2, 0x3, 0x1}) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000240)="dba5e5863ef6cf85d0d00b991eb456a060e2769491722148447bf7fd94d2183cc3e27f4cc5e5d81219034c8234c6944b2da8de3f724dfaac394dd293915283215d95dd05b71e8aea", 0x0, 0x48) r7 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce5, 0x7fff}}, @msr={0x14, 0x20, {0x603000000013dce8, 0x8000}}, @msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x60}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r10, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000000)={0xa, 0x4}}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r10, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r10, 0xae80, 0x0) r11 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r11, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) 18m59.421081694s ago: executing program 3 (id=174): ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x7, 0x1, &(0x7f0000000000)=0x2}) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x6) ioctl$KVM_CREATE_DEVICE(r0, 0xc00caee0, &(0x7f0000000080)={0xa, 0xffffffffffffffff}) r2 = syz_kvm_vgic_v3_setup(r0, 0x4, 0x0) ioctl$KVM_CAP_ARM_INJECT_SERROR_ESR(r0, 0x4068aea3, &(0x7f00000000c0)) ioctl$KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, &(0x7f0000000180)=@attr_arm64={0x0, 0x4, 0x1, &(0x7f0000000140)=0x81}) r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r0, 0xc040aed4, &(0x7f00000001c0)={0xfffffffffffffffe, 0xfffffffffffffffd}) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000200)={0x1, 0x0, 0x4000, 0x2000, &(0x7f0000ffc000/0x2000)=nil, 0x5, r3}) ioctl$KVM_CAP_PTP_KVM(r0, 0x4068aea3, &(0x7f00000002c0)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x400, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f00000003c0)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000380)=0x12}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x200, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vm(r0, 0x4018aee2, &(0x7f0000000480)=@attr_other={0x0, 0x10000, 0xad0b, &(0x7f0000000440)=0x5}) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f00000004c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_GET_DEVICE_ATTR(r6, 0x4018aee2, &(0x7f0000000540)=@attr_arm64={0x0, 0x5, 0x0, &(0x7f0000000500)=0x3}) syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_GET_DEVICE_ATTR(r1, 0x4018aee2, &(0x7f00000005c0)=@attr_other={0x0, 0x2, 0xa, &(0x7f0000000580)=0xff}) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xb) ioctl$KVM_CAP_PTP_KVM(r2, 0x4068aea3, &(0x7f0000000600)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, &(0x7f0000000700)=@attr_other={0x0, 0x9e, 0x2, &(0x7f00000006c0)=0x5}) syz_kvm_vgic_v3_setup(r0, 0x4, 0x140) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x1f) ioctl$KVM_CAP_ARM_USER_IRQ(r7, 0x4068aea3, &(0x7f0000000740)) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r0, 0x4068aea3, &(0x7f00000007c0)={0xdf, 0x0, 0x1000}) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_HAS_DEVICE_ATTR_vm(r0, 0x4018aee3, &(0x7f0000000880)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000840)={0xf, 0x2, 0x1}}) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r7, 0x4010ae74, &(0x7f00000008c0)={0x9, 0x5, 0x5}) ioctl$KVM_CAP_ARM_USER_IRQ(r7, 0x4068aea3, &(0x7f0000000900)) 18m52.35744206s ago: executing program 3 (id=175): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000160006, &(0x7f0000000000)=0x8}) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x21) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x10000002) r8 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r7, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x60871, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000500)=[@uexit={0x0, 0x18, 0xb}, @code={0xa, 0x9c, {"205f93d20020b8f2e10180d2e20080d2e30080d2a40180d2020000d4007008d5007008d5007008d560b584d200a0b0f2410180d2a20180d2e30080d2640180d2020000d40050200e0004601e007008d580d58bd200a0b0f2a10180d2c20180d2230080d2a40180d2020000d4402689d200e0b8f2c10080d2a20080d2030180d2a40180d2020000d4"}}, @msr={0x14, 0x20, {0x603000000013c647, 0x10000}}, @eret={0xe6, 0x18, 0x81}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x10040, 0x7fff, 0x7}}, @smc={0x1e, 0x40, {0x0, [0x2, 0x8, 0x8000000000000000, 0x5, 0x80000001]}}, @hvc={0x32, 0x40, {0x3, [0x0, 0xc, 0x9, 0x1be4, 0x1]}}], 0x19c}, 0x0, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000000000000000000001"]) r12 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x31) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000ab9000/0x400000)=nil) r15 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r16 = ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_GSI_ROUTING(r16, 0x4008ae6a, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x40) ioctl$KVM_IRQ_LINE(r12, 0x4008ae61, &(0x7f0000000100)={0x1001ffd, 0x1}) r17 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r17, 0xae41, 0x1) 18m4.54847296s ago: executing program 35 (id=175): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000160006, &(0x7f0000000000)=0x8}) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x21) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x10000002) r8 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r7, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x60871, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000500)=[@uexit={0x0, 0x18, 0xb}, @code={0xa, 0x9c, {"205f93d20020b8f2e10180d2e20080d2e30080d2a40180d2020000d4007008d5007008d5007008d560b584d200a0b0f2410180d2a20180d2e30080d2640180d2020000d40050200e0004601e007008d580d58bd200a0b0f2a10180d2c20180d2230080d2a40180d2020000d4402689d200e0b8f2c10080d2a20080d2030180d2a40180d2020000d4"}}, @msr={0x14, 0x20, {0x603000000013c647, 0x10000}}, @eret={0xe6, 0x18, 0x81}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x10040, 0x7fff, 0x7}}, @smc={0x1e, 0x40, {0x0, [0x2, 0x8, 0x8000000000000000, 0x5, 0x80000001]}}, @hvc={0x32, 0x40, {0x3, [0x0, 0xc, 0x9, 0x1be4, 0x1]}}], 0x19c}, 0x0, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000000000000000000001"]) r12 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x31) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000ab9000/0x400000)=nil) r15 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r16 = ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_GSI_ROUTING(r16, 0x4008ae6a, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x40) ioctl$KVM_IRQ_LINE(r12, 0x4008ae61, &(0x7f0000000100)={0x1001ffd, 0x1}) r17 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r17, 0xae41, 0x1) 12m21.977392759s ago: executing program 4 (id=188): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff}) ioctl$KVM_GET_DEVICE_ATTR(r2, 0x4018aee2, &(0x7f0000000100)=@attr_arm64={0x0, 0x7, 0x5, 0x0}) ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f0000000180)={0x81, 0x4}) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_DEVICE_ATTR_vm(r4, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000140)={0x0, &(0x7f0000000200)=[@smc={0x1e, 0x40, {0xef000000, [0x0, 0x1, 0x2, 0x3, 0x4]}}, @hvc={0x32, 0x40, {0xc4000053, [0x0, 0x1, 0x2, 0x3, 0x6]}}], 0x80}, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) 12m7.635555549s ago: executing program 4 (id=189): ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8, 0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) r3 = ioctl$KVM_CREATE_VM(r2, 0x894c, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0x40305839, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r5, 0x4010aeab, &(0x7f0000000000)={0x7fffffff, 0x8000001}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_vgic_v3_setup(r7, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r8, 0x4018aee2, &(0x7f0000000080)=@attr_arm64={0x0, 0x5, 0x5, &(0x7f00000000c0)}) 11m53.568763105s ago: executing program 4 (id=190): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x18}], 0x1, 0x0, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000180)=@attr_other={0x0, 0x1, 0x8, &(0x7f00000000c0)=0x45d4970}) ioctl$KVM_RUN(r2, 0xae80, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x200, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x2e) syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000200)={0x0, &(0x7f00000002c0)=[@msr={0x14, 0x20, {0x603000000013f081, 0x1}}, @svc={0x122, 0x40, {0x84000052, [0x5, 0x2, 0xfff, 0x7, 0x14460bd6]}}, @svc={0x122, 0x40, {0xc400000c, [0x6, 0x72, 0x7, 0x3, 0x8]}}, @uexit={0x0, 0x18, 0x1}, @irq_setup={0x46, 0x18, {0x4, 0x1f}}, @hvc={0x32, 0x40, {0x84000003, [0x400, 0x9, 0x7, 0xf, 0x9]}}, @svc={0x122, 0x40, {0x10e004012, [0x2, 0x48, 0x6, 0x1, 0xf10]}}, @smc={0x1e, 0x40, {0xc4000005, [0x8000000000000000, 0x1, 0x80000001, 0x6, 0x3]}}, @its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x0, 0xe, 0x2fd, 0x0, 0x2}}, @svc={0x122, 0x40, {0x10, [0x1, 0x1, 0x8, 0xfffffffffffffffa, 0x3]}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x2, 0x8, 0x3000000, 0x4691, 0x3}}, @mrs={0xbe, 0x18, {0x603000000013dee3}}, @uexit={0x0, 0x18, 0x3}, @its_setup={0x82, 0x28, {0x3, 0x2}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x180, 0x3, 0x1}}], 0x2a8}, &(0x7f0000000240)=[@featur2={0x1, 0xe8}], 0x1) ioctl$KVM_ARM_SET_COUNTER_OFFSET(r8, 0x4010aeb5, &(0x7f0000000180)={0x7ff8000000, 0xfffffffffffffffe}) r9 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r11, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil) write$eventfd(r12, &(0x7f00000001c0), 0xfdef) r13 = syz_kvm_add_vcpu$arm64(r9, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3}}], 0x68}, 0x0, 0x0) r14 = syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) ioctl$KVM_SET_ONE_REG(r13, 0x4010aeac, &(0x7f0000000040)=@arm64_fw={0x6030000000140003, &(0x7f0000000000)=0x40}) ioctl$KVM_RUN(r13, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x6, 0x4, 0x0}) 11m19.669397705s ago: executing program 4 (id=191): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x2) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r0, 0xc040aed4, &(0x7f0000000000)={0x4, 0x10001}) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000040)={0x10004, 0x4, 0x6000, 0x1000, &(0x7f0000ffc000/0x1000)=nil, 0x7, r2}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x4) ioctl$KVM_SET_GSI_ROUTING(r3, 0x4008ae6a, &(0x7f0000000100)={0x5, 0x0, [{0x1, 0x4, 0x0, 0x0, @irqchip={0x7, 0xffffffff}}, {0x1, 0x1, 0x1, 0x0, @adapter={0x7, 0x8, 0x401, 0x6, 0x401}}, {0xfffffffc, 0x3, 0x0, 0x0, @irqchip={0x800, 0x6}}, {0xff, 0x3, 0x0, 0x0, @adapter={0x2, 0x2, 0x80, 0xfffffffb, 0xffffffff}}, {0x1, 0x1, 0x0, 0x0, @irqchip={0x2, 0xc2}}]}) ioctl$KVM_ARM_VCPU_INIT(r1, 0x4020aeae, &(0x7f0000000200)={0x3, 0x39}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) ioctl$KVM_RUN(r1, 0xae80, 0x0) r5 = ioctl$KVM_GET_STATS_FD_cpu(r4, 0xaece) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x38) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r5, 0x4068aea3, &(0x7f0000000240)={0xa8, 0x0, 0x1}) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r3, 0x4068aea3, &(0x7f00000002c0)) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r3, 0x4010ae68, &(0x7f0000000340)={0x3000, 0x4000, 0x1}) ioctl$KVM_SET_USER_MEMORY_REGION2(r0, 0x40a0ae49, &(0x7f0000000380)={0x1, 0x7, 0x3000, 0x1000, &(0x7f0000ffc000/0x1000)=nil, 0xfffffffffffffff8, r5}) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x37) ioctl$KVM_CLEAR_DIRTY_LOG(r6, 0xc018aec0, &(0x7f0000000840)={0x101ff, 0x100, 0x200, &(0x7f0000000440)=[0x0, 0x800, 0x5, 0x18, 0x9, 0x4, 0xe, 0x7, 0xff, 0x5, 0xcce, 0x5, 0x4, 0xffffffff, 0xfffffffffffffff9, 0x3, 0x100000000, 0xffffffffffffffff, 0x81, 0x8, 0xc, 0x4, 0x100, 0x3cc9, 0xfffffffffffffffb, 0xffffffffffffffe9, 0xd266, 0x1, 0x13, 0x2, 0x2, 0x8001, 0xfffffffffffffffa, 0x3, 0x5, 0x6, 0x6892, 0xc099, 0x401, 0x8, 0x10000, 0xd19, 0xe435, 0x91, 0x5, 0xef, 0x3, 0x0, 0x4, 0xfa35, 0x4, 0x1e, 0xd, 0xfffffffffffffffe, 0xf3, 0x5, 0xaf, 0xfffffffffffffff9, 0x4, 0xd67, 0x5, 0x10, 0x8, 0x8, 0x9, 0x5, 0x1a, 0x2, 0x6, 0x5, 0x7, 0xb, 0x9, 0x4, 0x187, 0x8, 0xffffffff7fffffff, 0x9, 0x5, 0x5, 0xa, 0x0, 0x2, 0x7fffffff, 0xab5, 0x7, 0x5, 0x17536be7, 0x10, 0x4, 0x6, 0x7fffffff, 0x101, 0xe83, 0x141, 0x0, 0x9d4, 0xfffffffffffffff8, 0x7fffffff, 0x7fffffff, 0x1ff, 0x81, 0x9, 0x80000000, 0x940, 0x1, 0x400, 0xe5, 0x81, 0x4, 0x5, 0x4, 0x8, 0x8, 0x10, 0x8001, 0x8, 0x0, 0x2, 0xb, 0x0, 0x4, 0x2, 0xc, 0x4, 0x81, 0x8, 0xd]}) ioctl$KVM_S390_VCPU_FAULT(r4, 0x4008ae52, &(0x7f0000000880)=0x8) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000cc0)={0x0, &(0x7f00000008c0)=[@uexit={0x0, 0x18, 0xffffffffffffff00}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x0, 0x6, 0x8}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x1, 0x1, 0x7, 0x2, 0x1, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x4, 0x6, 0x9}}, @hvc={0x32, 0x40, {0xc4000053, [0x6, 0x4, 0x0, 0x3, 0x4]}}, @mrs={0xbe, 0x18, {0x30f3cf7afa0cc201}}, @its_send_cmd={0xaa, 0x28, {0x2, 0x0, 0x0, 0x3, 0x9, 0x58, 0x2}}, @mrs={0xbe, 0x18, {0x603000000013df6f}}, @hvc={0x32, 0x40, {0x84000011, [0x7be9, 0x40, 0x2, 0xffffffffffffffff, 0x8ee7]}}, @hvc={0x32, 0x40, {0x80000000, [0xa325, 0x0, 0xb, 0x6, 0x40ed6f42]}}, @svc={0x122, 0x40, {0x2ab89ed66a49d642, [0x4, 0x9, 0x2, 0x3, 0x4]}}, @uexit={0x0, 0x18, 0x2}, @uexit={0x0, 0x18, 0x3}, @mrs={0xbe, 0x18, {0x603000000013801f}}, @code={0xa, 0x9c, {"1020601ea0d989d200c0b0f2410080d2420180d2c30180d2e40080d2020000d40054000f007008d5e0a09ad200c0b0f2210180d2e20080d2030180d2c40180d2020000d480568cd20020b0f2810080d2620180d2030080d2040080d2020000d4000028d580ae9bd20020b0f2c10180d2820180d2430180d2240180d2020000d40034002f0038201e"}}, @eret={0xe6, 0x18, 0x6}, @code={0xa, 0x6c, {"007008d500a8a17e00b0005f806483d200c0b0f2e10180d2020080d2030080d2240080d2020000d4000000f9007008d5403289d200a0b0f2610180d2020180d2a30180d2240180d2020000d40034007f007008d5000840ba"}}, @smc={0x1e, 0x40, {0xc400000d, [0x4, 0x2800000000000, 0x6, 0x0, 0xffffffff80000000]}}, @svc={0x122, 0x40, {0x84000011, [0x3e234319, 0x2, 0x8000000000000001, 0x5000000000000000, 0x7]}}], 0x3e0}, &(0x7f0000000d00)=[@featur2={0x1, 0xb}], 0x1) r8 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_INTERRUPT(r8, 0x4004ae86, &(0x7f0000000d40)=0x4) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f0000000dc0)=@other={0x7, &(0x7f0000000d80)=0xfffffffffffffffb}) mmap$KVM_VCPU(&(0x7f0000ffa000/0x3000)=nil, 0x0, 0xec3cf6686f5045b9, 0x4000010, r2, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r5, 0x4068aea3, &(0x7f0000000e00)={0xc0, 0x0, 0x18000}) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r8, 0x4018aee2, &(0x7f0000000ec0)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000e80)=0x16}) ioctl$KVM_IRQ_LINE_STATUS(r3, 0xc008ae67, &(0x7f0000000f00)={0x9, 0x7d0ff2e8}) r9 = syz_kvm_add_vcpu$arm64(r7, &(0x7f00000010c0)={0x0, &(0x7f0000000f40)=[@irq_setup={0x46, 0x18, {0x4, 0x2b0}}, @its_setup={0x82, 0x28, {0x0, 0x0, 0x14d}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1f1}}, @smc={0x1e, 0x40, {0x84000008, [0x0, 0x6, 0x6, 0x3, 0x7]}}, @code={0xa, 0xb4, {"0038202e20af95d200e0b8f2410080d2620080d2c30080d2c40080d2020000d4e04098d200a0b8f2810180d2220080d2e30080d2e40180d2020000d4000028d5a0688dd20040b0f2a10080d2a20080d2230080d2840080d2020000d4007008d580ce91d200c0b0f2610180d2a20180d2830080d2040180d2020000d4007008d5007008d5e0da99d200a0b8f2210080d2e20180d2030180d2240080d2020000d4"}}], 0x15c}, &(0x7f0000001100)=[@featur2={0x1, 0x2}], 0x1) ioctl$KVM_ARM_VCPU_INIT(r9, 0x4020aeae, &(0x7f0000001140)={0x0, 0x84}) 11m10.399943993s ago: executing program 4 (id=192): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0x40049409, 0x13) openat$kvm(0x0, 0x0, 0x72483, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x400800, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x400800, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r8, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) (async) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r8, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, 0x0) (async) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, 0x0) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xdddd1000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0xdddd1000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_GET_DIRTY_LOG(r9, 0x4010ae42, &(0x7f0000000000)={0x1, 0x0, &(0x7f0000ffb000/0x3000)=nil}) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f00000001c0)=@arm64_core={0x603000000010001e, &(0x7f0000000180)=0x2}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x22) (async) r10 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x22) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000000)={0x0, 0x3, 0xffff1000, 0x1000, &(0x7f00003f1000/0x1000)=nil}) 10m53.366067597s ago: executing program 5 (id=176): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(r3, 0x4008ae61, &(0x7f0000000000)={0x8000000, 0x3}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) write$eventfd(r5, &(0x7f0000000200)=0x8, 0x8) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 10m51.798289774s ago: executing program 4 (id=193): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000004}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x0, &(0x7f0000000000)=0x10}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r8, 0x4010aeab, &(0x7f0000000000)={0x1, 0x8000001}) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000040)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0xfffffe1a, 0xfffffffffffffffc, 0x0}) 10m5.907785184s ago: executing program 36 (id=176): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_IRQ_LINE(r3, 0x4008ae61, &(0x7f0000000000)={0x8000000, 0x3}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) write$eventfd(r5, &(0x7f0000000200)=0x8, 0x8) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 10m0.223033784s ago: executing program 37 (id=193): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000004}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x0, &(0x7f0000000000)=0x10}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(r8, 0x4010aeab, &(0x7f0000000000)={0x1, 0x8000001}) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000040)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0xfffffe1a, 0xfffffffffffffffc, 0x0}) 2m27.182090595s ago: executing program 6 (id=194): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r1 = eventfd2(0x0, 0x80000) mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, 0x930, 0x0, 0x110, r1, 0x0) r2 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$KVM_PPC_ALLOCATE_HTAB(r2, 0xc004aea7, &(0x7f0000000040)=0x4) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) r8 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r9 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x0, 0x0, 0x11, r7, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610f3ff67521cd66f8f1f447d35b20700000000000000000000000100", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r7, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xb00f2, 0x0) r10 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000340)=[@code={0xa, 0x84, {"007008d5007008d51020601e60189dd20080b8f2c10180d2020080d2a30080d2a40080d2020000d480f69ed200a0b0f2810180d2a20180d2630080d2040080d2020000d4000028d5008008d5c0659cd200a0b0f2210080d2620180d2c30080d2840080d2020000d4007008d5e003005a"}}, @msr={0x14, 0x20, {0x603000000013e643, 0x4}}, @mrs={0xbe, 0x18, {0x603000000013e6d7}}, @uexit={0x0, 0x18, 0x80000001}, @irq_setup={0x46, 0x18, {0x4, 0x203}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x3, 0x5, 0x5, 0x1000, 0x2}}, @msr={0x14, 0x20, {0x603000000013df47, 0x1}}, @its_setup={0x82, 0x28, {0x1, 0x4, 0x18a}}, @mrs={0xbe, 0x18, {0x6030000000138075}}, @uexit={0x0, 0x18, 0xffffffffffffffff}, @svc={0x122, 0x40, {0x10, [0x21bd2a65, 0x2ba, 0x3, 0x7, 0x8]}}, @hvc={0x32, 0x40, {0x80000000, [0x8, 0x4, 0x1, 0xe, 0x6]}}, @code={0xa, 0x84, {"001c005340149ed20060b0f2e10180d2020080d2830080d2040080d2020000d4000581d200c0b8f2610080d2620180d2630180d2840080d2020000d4000008d5202892d20060b0f2610180d2c20080d2c30080d2c40180d2020000d400b8a17e007008d5000008d500a0004f00b4200e"}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x0, 0x4, 0x7, 0x2, 0x2}}, @code={0xa, 0x84, {"000008d520109ed200e0b8f2410080d2820180d2030080d2040180d2020000d4002c004e007008d500558ad200e0b0f2e10080d2220080d2830080d2640080d2020000d4007008d5007008d50040800d008008d5205f8dd20080b0f2010180d2220080d2e30180d2c40180d2020000d4"}}, @uexit={0x0, 0x18, 0x8}, @uexit={0x0, 0x18, 0x2e0}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x3, 0xb, 0x81, 0xffffffff, 0x2}}, @irq_setup={0x46, 0x18, {0x1, 0x2a5}}, @smc={0x1e, 0x40, {0x84000052, [0x0, 0x4, 0x9, 0xcfb, 0x7]}}, @smc={0x1e, 0x40, {0xc400000c, [0x7, 0x7, 0x7, 0x0, 0x7d]}}, @smc={0x1e, 0x40, {0xc4000001, [0x2, 0x2, 0x7, 0xffffffffffff0001, 0x96]}}], 0x46c}, 0x0, 0x0) r13 = syz_kvm_vgic_v3_setup(r10, 0x4, 0x220) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000180)={0x8}) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f0000000280)=@attr_other={0x0, 0x2, 0xfffffffffffffffa, &(0x7f00000001c0)=0x40000000005}) ioctl$KVM_RUN(r12, 0xae80, 0x0) r14 = eventfd2(0x2, 0x80000) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000240)={r14, 0x8, 0x2, r1}) r15 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfd000/0x400000)=nil) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000b80)={0x0, &(0x7f00000009c0)=[@hvc={0x32, 0x40, {0xc4000004, [0x4, 0xfffffffffffffffa, 0x8000000000000000, 0x427f, 0x400003]}}], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) r17 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000de0000/0x4000)=nil, r17, 0x1000005, 0x810, r16, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) 2m10.512421291s ago: executing program 7 (id=195): mmap$KVM_VCPU(&(0x7f0000c81000/0x2000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) (async) munmap(&(0x7f0000647000/0x1000)=nil, 0x1000) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) (async, rerun: 64) munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000) (async, rerun: 64) munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000) munmap(&(0x7f000075a000/0xb000)=nil, 0xb000) (async) munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000) munmap(&(0x7f0000482000/0x2000)=nil, 0x2000) munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000) (async, rerun: 32) munmap(&(0x7f0000f06000/0x4000)=nil, 0x4000) (async, rerun: 32) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20001, 0x0) (async) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async, rerun: 64) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (rerun: 64) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) (async, rerun: 64) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) (rerun: 64) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x400000, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000657000/0x3000)=nil, r3, 0x100000d, 0x810, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x0, 0x3000003, 0x4010, 0xffffffffffffffff, 0x0) (async, rerun: 32) munmap(&(0x7f0000e9d000/0x1000)=nil, 0x1000) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, r1, 0x3, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) (async) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) (async) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) mmap$KVM_VCPU(&(0x7f0000c58000/0x1000)=nil, r1, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000834000/0x3000)=nil, 0x930, 0x100000a, 0x13, 0xffffffffffffffff, 0x0) (rerun: 32) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x0, 0x80010, 0xffffffffffffffff, 0x0) 2m1.582491618s ago: executing program 6 (id=196): openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x8521, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CLEAR_DIRTY_LOG(r3, 0xc018aec0, &(0x7f0000000000)={0x0, 0x100, 0x1c0, 0x0}) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f0000000000)=@attr_other={0x0, 0x9, 0x7, &(0x7f0000000080)=0x2}) ioctl$KVM_GET_API_VERSION(r0, 0xae03, 0x42) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) 1m55.45253264s ago: executing program 7 (id=197): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x3000, 0x0, 0x1}) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000380)={0x2, 0x25000, 0x1}) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r1, 0x4010ae68, &(0x7f0000000240)={0xffff1000, 0xa000}) (fail_nth: 1) 1m42.357755207s ago: executing program 6 (id=198): r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) munmap(&(0x7f0000ce0000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x1000000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r3, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) r5 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r4, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000001c0)="04198bd844c9e8a7b82d748f0f0244293d28bd9440bfc2ed44db9969759357abab8d85c8e856a4606c2e979f98d67e4ff39fb6df9547f6a9506c610dc37b2e5c3ad3c9952305abf0", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) 1m39.643500626s ago: executing program 7 (id=199): munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x800000) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000080)={0xffffffffffffffd0, 0xeeef0000, 0x4, 0xffffffffffffffff, 0x4}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r2, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$eventfd(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, &(0x7f0000000140)={0x80, 0x8000000, 0x0, r6}) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 1m19.775723807s ago: executing program 6 (id=200): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x140, 0x0) ioctl$KVM_PPC_ALLOCATE_HTAB(r1, 0xc004aea7, &(0x7f0000000000)=0x4) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000000100)=@arm64_core={0x6030000000100008, &(0x7f0000000240)=0x2}) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r2, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0x8, 0x4, 0x0}) 1m17.681283208s ago: executing program 7 (id=201): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000140)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f0000000080)=@arm64_extra={0x603000000013c103, &(0x7f0000000000)=0x2}) r6 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, 0x0) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x0, 0x1, 0x8}}, @eret={0xe6, 0x18, 0x4}], 0x40}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r10, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000000)={0x0, &(0x7f0000000240)=[@eret={0xe6, 0x18, 0x4}, @its_send_cmd={0xaa, 0x28, {0x9, 0x1, 0x4, 0x7, 0xffffffff, 0x8, 0x4}}, @msr={0x14, 0x20, {0x603000000013c118, 0x81}}, @irq_setup={0x46, 0x18, {0x0, 0x37e}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x39a}}, @msr={0x14, 0x20, {0x603000000013e6c7, 0x2}}, @hvc={0x32, 0x40, {0x84000004, [0x6, 0x9, 0x0, 0x3, 0x7]}}, @hvc={0x32, 0x40, {0x1000, [0x1, 0x3, 0x1, 0x481, 0x82]}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x2, 0xd, 0x100, 0x200}}, @smc={0x1e, 0x40, {0xc5000020, [0x3, 0xa0000000000, 0x9, 0x7f, 0x6]}}, @hvc={0x32, 0x40, {0x86000001, [0x5, 0x10, 0x3880, 0x9]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x2, 0x1, 0x1688, 0xffffffc0}}, @mrs={0xbe, 0x18, {0x603000000013e602}}, @code={0xa, 0x6c, {"0000c06800f4a02e000028d5007008d5e02d81d200a0b0f2210180d2e20180d2630080d2640180d2020000d4007008d5c0f58bd200a0b0f2410080d2020080d2a30180d2440080d2020000d4000028d500a49f0d008008d5"}}, @eret={0xe6, 0x18, 0xffff}, @mrs={0xbe, 0x18, {0x603000000013c10b}}, @eret={0xe6, 0x18, 0xffe0000000000000}, @msr={0x14, 0x20, {0x603000000013df44, 0x1}}, @smc={0x1e, 0x40, {0x8400000e, [0x2, 0x7fff, 0xf, 0xffffffff, 0x2]}}], 0x33c}, &(0x7f0000000580)=[@featur2={0x1, 0x32}], 0x1) ioctl$KVM_RUN(r12, 0xae80, 0x0) r14 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@mrs={0xbe, 0x18, {0x603000000013df40}}], 0x18}, &(0x7f0000000100)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r14, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_init) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r15 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r15, 0x3, 0x11, r14, 0x0) ioctl$KVM_RUN(r14, 0xae80, 0x0) r16 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0) 1m0.469898662s ago: executing program 6 (id=202): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x81400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0xcb3993e4c7433bb8, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000ebf000/0x1000)=nil, r5, 0x2000009, 0x110, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x1000006, 0x24132, r3, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x3, 0xa0) (async, rerun: 64) r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x27) (rerun: 64) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) (async) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000780000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, &(0x7f0000000200)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xc, 0x401, 0x4}}], 0x30}, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) (async) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) r12 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r12, 0x4020ae46, &(0x7f0000000080)={0x5, 0x3, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) 50.879752506s ago: executing program 7 (id=203): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3}}], 0x68}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) r4 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000300)={0x0, 0x0}, &(0x7f00000001c0)=[@featur1={0x1, 0xc}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000002c0)={0x7, 0xbe}}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000180)={0x9, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r10 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r9, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r10, 0xfffffffffffffffe) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r10, 0xffffffffffffffff) r11 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x10000000000000) ioctl$KVM_SET_DEVICE_ATTR_vm(r12, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r13 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r14, 0x40a0ae49, &(0x7f0000000040)={0x1fd, 0x2, 0xffff1000, 0x2000, &(0x7f0000ffd000/0x2000)=nil, 0x1ff}) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000bff000/0x400000)=nil) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x7ffc}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r16, 0x4018aee1, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) 12.165667776s ago: executing program 38 (id=202): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x81400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)}, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0xcb3993e4c7433bb8, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000ebf000/0x1000)=nil, r5, 0x2000009, 0x110, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x1000006, 0x24132, r3, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x3, 0xa0) (async, rerun: 64) r9 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x27) (rerun: 64) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) (async) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000780000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f00000000c0)={0x0, &(0x7f0000000200)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xc, 0x401, 0x4}}], 0x30}, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000}) (async) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r4, 0xae04) (async) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) r12 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r12, 0x4020ae46, &(0x7f0000000080)={0x5, 0x3, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) 0s ago: executing program 39 (id=203): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3}}], 0x68}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) r4 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000300)={0x0, 0x0}, &(0x7f00000001c0)=[@featur1={0x1, 0xc}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000002c0)={0x7, 0xbe}}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000180)={0x9, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x4, 0x0, 0x0}) r9 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r10 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r9, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r10, 0xfffffffffffffffe) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r10, 0xffffffffffffffff) r11 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x10000000000000) ioctl$KVM_SET_DEVICE_ATTR_vm(r12, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) r13 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r14, 0x40a0ae49, &(0x7f0000000040)={0x1fd, 0x2, 0xffff1000, 0x2000, &(0x7f0000ffd000/0x2000)=nil, 0x1ff}) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000bff000/0x400000)=nil) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x7ffc}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r16, 0x4018aee1, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) kernel console output (not intermixed with test programs): [ 384.759563][ T3151] 8021q: adding VLAN 0 to HW filter on device bond0 [ 432.039794][ T3151] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:61322' (ED25519) to the list of known hosts. [ 601.373323][ T25] audit: type=1400 audit(600.590:61): avc: denied { name_bind } for pid=3302 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 603.333160][ T25] audit: type=1400 audit(602.550:62): avc: denied { execute } for pid=3303 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 603.373308][ T25] audit: type=1400 audit(602.590:63): avc: denied { execute_no_trans } for pid=3303 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 623.113864][ T25] audit: type=1400 audit(622.330:64): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 623.146287][ T25] audit: type=1400 audit(622.370:65): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 623.229846][ T3303] cgroup: Unknown subsys name 'net' [ 623.284702][ T25] audit: type=1400 audit(622.500:66): avc: denied { unmount } for pid=3303 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 623.678330][ T3303] cgroup: Unknown subsys name 'cpuset' [ 623.778460][ T3303] cgroup: Unknown subsys name 'rlimit' [ 624.694631][ T25] audit: type=1400 audit(623.910:67): avc: denied { setattr } for pid=3303 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 624.717466][ T25] audit: type=1400 audit(623.930:68): avc: denied { mounton } for pid=3303 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 624.743711][ T25] audit: type=1400 audit(623.950:69): avc: denied { mount } for pid=3303 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 626.319203][ T3306] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 626.338542][ T25] audit: type=1400 audit(625.560:70): avc: denied { relabelto } for pid=3306 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 626.359606][ T25] audit: type=1400 audit(625.580:71): avc: denied { write } for pid=3306 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 626.550310][ T25] audit: type=1400 audit(625.770:72): avc: denied { read } for pid=3303 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 626.569386][ T25] audit: type=1400 audit(625.790:73): avc: denied { open } for pid=3303 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 626.617431][ T3303] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 677.663015][ T25] audit: type=1400 audit(676.880:74): avc: denied { execmem } for pid=3307 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 682.270364][ T25] audit: type=1400 audit(681.490:75): avc: denied { read } for pid=3309 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 682.304543][ T25] audit: type=1400 audit(681.520:76): avc: denied { open } for pid=3309 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 682.395614][ T25] audit: type=1400 audit(681.590:77): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 682.674885][ T25] audit: type=1400 audit(681.900:78): avc: denied { module_request } for pid=3309 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 683.830687][ T25] audit: type=1400 audit(683.050:79): avc: denied { sys_module } for pid=3309 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 713.476417][ T3309] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 713.708188][ T3309] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 713.771859][ T3310] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 714.004960][ T3310] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 726.244604][ T3309] hsr_slave_0: entered promiscuous mode [ 726.273324][ T3309] hsr_slave_1: entered promiscuous mode [ 727.355817][ T3310] hsr_slave_0: entered promiscuous mode [ 727.385467][ T3310] hsr_slave_1: entered promiscuous mode [ 727.418965][ T3310] debugfs: 'hsr0' already exists in 'hsr' [ 727.433813][ T3310] Cannot create hsr debugfs directory [ 732.913392][ T25] audit: type=1400 audit(732.130:80): avc: denied { create } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 732.962792][ T25] audit: type=1400 audit(732.180:81): avc: denied { write } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 733.004744][ T25] audit: type=1400 audit(732.180:82): avc: denied { read } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 733.099252][ T3309] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 733.440132][ T3309] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 733.714671][ T3309] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 734.194969][ T3309] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 735.603766][ T3310] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 735.835479][ T3310] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 736.103532][ T3310] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 736.258248][ T3310] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 749.277812][ T3309] 8021q: adding VLAN 0 to HW filter on device bond0 [ 751.414220][ T3310] 8021q: adding VLAN 0 to HW filter on device bond0 [ 813.057284][ T3309] veth0_vlan: entered promiscuous mode [ 813.449600][ T3309] veth1_vlan: entered promiscuous mode [ 815.014076][ T3310] veth0_vlan: entered promiscuous mode [ 815.748064][ T3309] veth0_macvtap: entered promiscuous mode [ 816.044906][ T3310] veth1_vlan: entered promiscuous mode [ 816.304208][ T3309] veth1_macvtap: entered promiscuous mode [ 818.965033][ T3310] veth0_macvtap: entered promiscuous mode [ 819.717810][ T21] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.788547][ T3310] veth1_macvtap: entered promiscuous mode [ 819.888886][ T21] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.906030][ T21] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 820.023368][ T21] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 823.494007][ T25] audit: type=1400 audit(822.700:83): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 823.760143][ T25] audit: type=1400 audit(822.920:84): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.C04AGa/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 823.902302][ T3388] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 823.976758][ T21] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 823.979220][ T21] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 823.998178][ T21] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 824.065106][ T25] audit: type=1400 audit(823.280:85): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 824.554381][ T25] audit: type=1400 audit(823.770:86): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.C04AGa/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 824.893471][ T25] audit: type=1400 audit(824.030:87): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/syzkaller.C04AGa/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3771 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 825.828414][ T25] audit: type=1400 audit(824.940:88): avc: denied { unmount } for pid=3309 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 826.135542][ T25] audit: type=1400 audit(825.350:89): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 826.273467][ T25] audit: type=1400 audit(825.490:90): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="gadgetfs" ino=3784 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 826.888067][ T25] audit: type=1400 audit(826.100:91): avc: denied { mount } for pid=3309 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 827.023984][ T25] audit: type=1400 audit(826.230:92): avc: denied { mounton } for pid=3309 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 828.399807][ T3309] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 829.462955][ T25] kauditd_printk_skb: 1 callbacks suppressed [ 829.463727][ T25] audit: type=1400 audit(828.660:94): avc: denied { read write } for pid=3309 comm="syz-executor" name="loop0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 829.464686][ T25] audit: type=1400 audit(828.680:95): avc: denied { open } for pid=3309 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 829.589901][ T25] audit: type=1400 audit(828.680:96): avc: denied { ioctl } for pid=3309 comm="syz-executor" path="/dev/loop0" dev="devtmpfs" ino=637 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 840.022785][ T25] audit: type=1400 audit(839.230:97): avc: denied { read } for pid=3467 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 840.037650][ T25] audit: type=1400 audit(839.260:98): avc: denied { open } for pid=3467 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 840.123979][ T25] audit: type=1400 audit(839.330:99): avc: denied { ioctl } for pid=3467 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae04 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 902.886522][ T25] audit: type=1400 audit(902.030:100): avc: denied { execute } for pid=3510 comm="syz.0.11" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4377 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 915.075512][ T25] audit: type=1400 audit(914.290:101): avc: denied { write } for pid=3519 comm="syz.0.15" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 930.400231][ T25] audit: type=1400 audit(929.620:102): avc: denied { append } for pid=3531 comm="syz.1.19" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 985.355526][ T25] audit: type=1400 audit(984.570:103): avc: denied { setattr } for pid=3572 comm="syz.0.31" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1010.158112][ T3594] kvm [3593]: Unsupported guest access at: eeef0000 [ 1010.158112][ T3594] { Op0( 2), Op1( 5), CRn(11), CRm(11), Op2( 3), func_write }, [ 1277.059936][ T3790] kvm [3790]: Failed to find VMA for hva 0x20c01000 [ 1277.324893][ T3790] kvm [3790]: Failed to find VMA for hva 0x20c01000 [ 1457.375073][ T3908] kvm [3908]: Failed to find VMA for hva 0x20de3000 [ 1484.520045][ T25] audit: type=1400 audit(1483.710:104): avc: denied { map } for pid=3928 comm="syz.1.139" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1627.126876][ T3955] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1627.409469][ T3955] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1629.486504][ T3957] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1629.729243][ T3957] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1654.380143][ T3955] hsr_slave_0: entered promiscuous mode [ 1654.446633][ T3955] hsr_slave_1: entered promiscuous mode [ 1654.523439][ T3955] debugfs: 'hsr0' already exists in 'hsr' [ 1654.527231][ T3955] Cannot create hsr debugfs directory [ 1657.529683][ T3957] hsr_slave_0: entered promiscuous mode [ 1657.626328][ T3957] hsr_slave_1: entered promiscuous mode [ 1657.684020][ T3957] debugfs: 'hsr0' already exists in 'hsr' [ 1657.712142][ T3957] Cannot create hsr debugfs directory [ 1664.288525][ T3403] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1665.430216][ T3403] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1666.704913][ T3403] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1667.856763][ T3403] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1682.116266][ T3403] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1682.235175][ T3403] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1682.315603][ T3403] bond0 (unregistering): Released all slaves [ 1684.194508][ T3403] hsr_slave_0: left promiscuous mode [ 1684.295311][ T3403] hsr_slave_1: left promiscuous mode [ 1684.583473][ T3403] veth1_macvtap: left promiscuous mode [ 1684.587353][ T3403] veth0_macvtap: left promiscuous mode [ 1684.605684][ T3403] veth1_vlan: left promiscuous mode [ 1684.627032][ T3403] veth0_vlan: left promiscuous mode [ 1697.297798][ T3955] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1698.055939][ T3955] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1698.865468][ T3955] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1699.793097][ T3955] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1702.427241][ T3403] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1703.885246][ T3403] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1704.345987][ T3957] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1705.217146][ T3403] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1705.589503][ T3957] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1706.536428][ T3403] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1706.895397][ T3957] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1707.344558][ T3957] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1722.479383][ T3403] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1722.587529][ T3403] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1722.656696][ T3403] bond0 (unregistering): Released all slaves [ 1724.214876][ T3403] hsr_slave_0: left promiscuous mode [ 1724.566805][ T3403] hsr_slave_1: left promiscuous mode [ 1725.265959][ T3403] veth1_macvtap: left promiscuous mode [ 1725.269337][ T3403] veth0_macvtap: left promiscuous mode [ 1725.305879][ T3403] veth1_vlan: left promiscuous mode [ 1725.338953][ T3403] veth0_vlan: left promiscuous mode [ 1757.477411][ T3955] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1757.649500][ T3957] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1850.515239][ T3957] veth0_vlan: entered promiscuous mode [ 1850.609873][ T3955] veth0_vlan: entered promiscuous mode [ 1852.068721][ T3955] veth1_vlan: entered promiscuous mode [ 1852.373830][ T3957] veth1_vlan: entered promiscuous mode [ 1857.096720][ T3957] veth0_macvtap: entered promiscuous mode [ 1857.447213][ T3955] veth0_macvtap: entered promiscuous mode [ 1857.884963][ T3957] veth1_macvtap: entered promiscuous mode [ 1858.564837][ T3955] veth1_macvtap: entered promiscuous mode [ 1862.756632][ T3414] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1862.767618][ T3414] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1862.795851][ T3414] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1862.856557][ T3414] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1863.729298][ T4044] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1863.737818][ T4044] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1863.750511][ T4044] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1863.803781][ T4044] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1999.756297][ T3403] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2002.135321][ T3403] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2004.385383][ T3403] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2006.288678][ T3403] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2032.298781][ T3403] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2032.723470][ T3403] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2032.967826][ T3403] bond0 (unregistering): Released all slaves [ 2035.656104][ T3403] hsr_slave_0: left promiscuous mode [ 2035.794437][ T3403] hsr_slave_1: left promiscuous mode [ 2036.683274][ T3403] veth1_macvtap: left promiscuous mode [ 2036.723011][ T3403] veth0_macvtap: left promiscuous mode [ 2036.725151][ T3403] veth1_vlan: left promiscuous mode [ 2036.726574][ T3403] veth0_vlan: left promiscuous mode [ 2129.279069][ T4234] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2129.627286][ T4234] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2167.443742][ T4234] hsr_slave_0: entered promiscuous mode [ 2167.499217][ T4234] hsr_slave_1: entered promiscuous mode [ 2189.457682][ T4234] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 2189.919638][ T4234] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 2190.228392][ T4234] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 2190.550722][ T4234] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 2224.794247][ T4234] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2293.499337][ T3414] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2295.407825][ T3414] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2297.184284][ T3414] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2298.676577][ T3414] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2319.878683][ T3414] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2320.763783][ T3414] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2321.054552][ T3414] bond0 (unregistering): Released all slaves [ 2323.233822][ T3414] hsr_slave_0: left promiscuous mode [ 2323.318768][ T3414] hsr_slave_1: left promiscuous mode [ 2323.773417][ T3414] veth1_macvtap: left promiscuous mode [ 2323.776695][ T3414] veth0_macvtap: left promiscuous mode [ 2323.806959][ T3414] veth1_vlan: left promiscuous mode [ 2323.817242][ T3414] veth0_vlan: left promiscuous mode [ 2387.484560][ T4409] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2387.740613][ T4409] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2393.536873][ T4234] veth0_vlan: entered promiscuous mode [ 2394.476023][ T4234] veth1_vlan: entered promiscuous mode [ 2397.934934][ T4234] veth0_macvtap: entered promiscuous mode [ 2398.467950][ T4234] veth1_macvtap: entered promiscuous mode [ 2401.644175][ T21] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2401.646807][ T21] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2401.675962][ T21] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2401.685588][ T21] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2431.059766][ T4409] hsr_slave_0: entered promiscuous mode [ 2431.166505][ T4409] hsr_slave_1: entered promiscuous mode [ 2431.243460][ T4409] debugfs: 'hsr0' already exists in 'hsr' [ 2431.272980][ T4409] Cannot create hsr debugfs directory [ 2450.289708][ T4409] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2450.770642][ T4409] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2451.267838][ T4409] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2451.869638][ T4409] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2491.133398][ T4409] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2666.805952][ T4409] veth0_vlan: entered promiscuous mode [ 2668.344560][ T4409] veth1_vlan: entered promiscuous mode [ 2672.533776][ T4409] veth0_macvtap: entered promiscuous mode [ 2673.229749][ T4409] veth1_macvtap: entered promiscuous mode [ 2677.726896][ T4427] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.734695][ T4427] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2677.864585][ T4427] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2678.035262][ T3414] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2765.876469][ T4066] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2768.167166][ T4066] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2770.205816][ T4066] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2772.214561][ T4066] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2797.024258][ T4066] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2797.319863][ T4066] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2797.508398][ T4066] bond0 (unregistering): Released all slaves [ 2800.795314][ T4066] hsr_slave_0: left promiscuous mode [ 2801.144512][ T4066] hsr_slave_1: left promiscuous mode [ 2802.144934][ T4066] veth1_macvtap: left promiscuous mode [ 2802.196924][ T4066] veth0_macvtap: left promiscuous mode [ 2802.208366][ T4066] veth1_vlan: left promiscuous mode [ 2802.244908][ T4066] veth0_vlan: left promiscuous mode [ 2831.667339][ T4066] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2833.469529][ T4066] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2835.080568][ T4066] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2836.700249][ T4066] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2856.880798][ T4066] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2857.090435][ T4066] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2857.309378][ T4066] bond0 (unregistering): Released all slaves [ 2859.295859][ T4066] hsr_slave_0: left promiscuous mode [ 2859.357805][ T4066] hsr_slave_1: left promiscuous mode [ 2859.749238][ T4066] veth1_macvtap: left promiscuous mode [ 2859.758588][ T4066] veth0_macvtap: left promiscuous mode [ 2859.796090][ T4066] veth1_vlan: left promiscuous mode [ 2859.819134][ T4066] veth0_vlan: left promiscuous mode [ 2912.193658][ T4699] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2912.519372][ T4699] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2922.785384][ T4703] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2923.126817][ T4703] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2944.524177][ T4699] hsr_slave_0: entered promiscuous mode [ 2944.615866][ T4699] hsr_slave_1: entered promiscuous mode [ 2959.604781][ T4703] hsr_slave_0: entered promiscuous mode [ 2959.668209][ T4703] hsr_slave_1: entered promiscuous mode [ 2959.789515][ T4703] debugfs: 'hsr0' already exists in 'hsr' [ 2959.803573][ T4703] Cannot create hsr debugfs directory [ 2967.292991][ T4699] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2968.643401][ T4699] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2969.215295][ T4699] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2970.093701][ T4699] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2980.879610][ T4703] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2981.370482][ T4703] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2981.813616][ T4703] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2982.395902][ T4703] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 3006.896175][ T4699] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3018.699858][ T4703] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3168.842912][ T4699] veth0_vlan: entered promiscuous mode [ 3169.959373][ T4699] veth1_vlan: entered promiscuous mode [ 3173.906624][ T4699] veth0_macvtap: entered promiscuous mode [ 3174.754264][ T4699] veth1_macvtap: entered promiscuous mode [ 3178.898332][ T3388] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.063058][ T3388] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.257315][ T3388] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.270696][ T3388] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3183.784568][ T4703] veth0_vlan: entered promiscuous mode [ 3186.206080][ T4703] veth1_vlan: entered promiscuous mode [ 3191.429785][ T4703] veth0_macvtap: entered promiscuous mode [ 3192.315766][ T4703] veth1_macvtap: entered promiscuous mode [ 3197.325905][ T4427] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3197.345125][ T4427] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3197.398853][ T4427] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3197.474385][ T4706] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3232.658772][ T4966] FAULT_INJECTION: forcing a failure. [ 3232.658772][ T4966] name failslab, interval 1, probability 0, space 0, times 1 [ 3232.738544][ T4966] CPU: 0 UID: 0 PID: 4966 Comm: syz.7.197 Not tainted syzkaller #0 PREEMPT [ 3232.739258][ T4966] Hardware name: linux,dummy-virt (DT) [ 3232.739738][ T4966] Call trace: [ 3232.740161][ T4966] show_stack+0x2c/0x3c (C) [ 3232.742062][ T4966] __dump_stack+0x30/0x40 [ 3232.742344][ T4966] dump_stack_lvl+0xd8/0x12c [ 3232.742555][ T4966] dump_stack+0x1c/0x28 [ 3232.742798][ T4966] should_fail_ex+0x570/0x6e0 [ 3232.743087][ T4966] should_failslab+0xb8/0xec [ 3232.743367][ T4966] __kmalloc_noprof+0xdc/0x4b8 [ 3232.743621][ T4966] tomoyo_realpath_from_path+0xdc/0x628 [ 3232.743899][ T4966] tomoyo_path_number_perm+0x13c/0x33c [ 3232.744144][ T4966] tomoyo_file_ioctl+0x2c/0x3c [ 3232.744399][ T4966] security_file_ioctl+0xe8/0x2f0 [ 3232.744674][ T4966] __arm64_sys_ioctl+0xd0/0x244 [ 3232.744964][ T4966] invoke_syscall+0x90/0x2b4 [ 3232.745267][ T4966] el0_svc_common+0x180/0x2f4 [ 3232.745546][ T4966] do_el0_svc+0x58/0x74 [ 3232.745835][ T4966] el0_svc+0x58/0x164 [ 3232.746062][ T4966] el0t_64_sync_handler+0x84/0x12c [ 3232.746285][ T4966] el0t_64_sync+0x198/0x19c [ 3233.108850][ T4966] ERROR: Out of memory at tomoyo_realpath_from_path. [ 3484.746625][ T5017] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3485.346886][ T5017] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3499.304795][ T5022] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3499.824465][ T5022] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3543.766886][ T5017] hsr_slave_0: entered promiscuous mode [ 3543.898051][ T5017] hsr_slave_1: entered promiscuous mode [ 3544.034355][ T5017] debugfs: 'hsr0' already exists in 'hsr' [ 3544.043135][ T5017] Cannot create hsr debugfs directory [ 3559.554078][ T5022] hsr_slave_0: entered promiscuous mode [ 3559.694221][ T5022] hsr_slave_1: entered promiscuous mode [ 3559.777576][ T5022] debugfs: 'hsr0' already exists in 'hsr' [ 3559.832907][ T5022] Cannot create hsr debugfs directory [ 3589.976655][ T5017] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 3591.263246][ T5017] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 3592.067716][ T5017] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 3593.145666][ T5017] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 3604.945923][ T5022] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 3605.766953][ T5022] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 3606.814595][ T5022] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 3607.550218][ T5022] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 3652.588462][ T5017] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3664.656780][ T5022] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3735.655904][ T27] INFO: task syz.7.203:5000 blocked for more than 430 seconds. [ 3735.656704][ T27] Not tainted syzkaller #0 [ 3735.687841][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 3735.688617][ T27] task:syz.7.203 state:D stack:0 pid:5000 tgid:5000 ppid:4703 task_flags:0x400040 flags:0x00000019 [ 3735.689831][ T27] Call trace: [ 3735.690257][ T27] __switch_to+0x584/0xb20 (T) [ 3735.794023][ T27] __schedule+0x1eec/0x33a4 [ 3735.853616][ T27] schedule+0xac/0x27c [ 3735.872709][ T27] schedule_timeout+0x5c/0x1e4 [ 3735.873382][ T27] do_wait_for_common+0x28c/0x444 [ 3735.873904][ T27] wait_for_completion+0x44/0x5c [ 3735.874425][ T27] __synchronize_srcu+0x2a4/0x320 [ 3735.874920][ T27] synchronize_srcu+0x3cc/0x4f0 [ 3735.875406][ T27] mmu_notifier_unregister+0x320/0x42c [ 3735.875900][ T27] kvm_put_kvm+0x6a0/0xfa8 [ 3735.876328][ T27] kvm_vm_release+0x58/0x78 [ 3735.876772][ T27] __fput+0x4ac/0x980 [ 3735.877218][ T27] ____fput+0x20/0x58 [ 3735.877637][ T27] task_work_run+0x1bc/0x254 [ 3735.878055][ T27] do_notify_resume+0x1bc/0x270 [ 3735.878518][ T27] el0_svc+0xb8/0x164 [ 3735.878953][ T27] el0t_64_sync_handler+0x84/0x12c [ 3735.879406][ T27] el0t_64_sync+0x198/0x19c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 3736.062567][ T27] [ 3736.062567][ T27] Showing all locks held in the system: [ 3736.063441][ T27] 1 lock held by khungtaskd/27: [ 3736.063889][ T27] #0: ffff800087806858 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 [ 3736.066495][ T27] 2 locks held by getty/3180: [ 3736.066916][ T27] #0: 2af0000011d0a8a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 3736.068644][ T27] #1: bdff80008c54b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x310/0x12b8 [ 3736.070316][ T27] 4 locks held by sshd-session/3302: [ 3736.070660][ T27] 2 locks held by syz-executor/3303: [ 3736.272672][ T27] 3 locks held by kworker/u4:4/3347: [ 3736.273112][ T27] 2 locks held by kworker/u4:6/3388: [ 3736.273476][ T27] 3 locks held by kworker/u4:7/3403: [ 3736.273770][ T27] 3 locks held by kworker/u4:0/3724: [ 3736.274071][ T27] 3 locks held by kworker/u4:2/3937: [ 3736.274389][ T27] 3 locks held by kworker/u4:3/3987: [ 3736.274709][ T27] 3 locks held by kworker/u4:10/4066: [ 3736.275012][ T27] 2 locks held by kworker/0:2/4162: [ 3736.275359][ T27] 2 locks held by kworker/u4:11/4427: [ 3736.275654][ T27] #0: f4f000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 3736.277344][ T27] #1: ffff80008ea77c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 3736.279023][ T27] 2 locks held by kworker/u4:5/4697: [ 3736.279368][ T27] #0: f4f000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 3736.443060][ T27] #1: ffff80008e9f7c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 3736.444938][ T27] 3 locks held by kworker/u4:12/4706: [ 3736.445335][ T27] 3 locks held by kworker/u4:13/4846: [ 3736.445659][ T27] 2 locks held by syz.6.202/4996: [ 3736.446014][ T27] 2 locks held by dhcpcd-run-hook/5182: [ 3736.446337][ T27] 1 lock held by modprobe/5183: [ 3736.446657][ T27] 1 lock held by modprobe/5184: [ 3736.447190][ T27] [ 3736.447461][ T27] ============================================= [ 3736.447461][ T27] [ 3736.448269][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 3736.458475][ T27] CPU: 0 UID: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 3736.459770][ T27] Hardware name: linux,dummy-virt (DT) [ 3736.460642][ T27] Call trace: [ 3736.461363][ T27] show_stack+0x2c/0x3c (C) [ 3736.462399][ T27] __dump_stack+0x30/0x40 [ 3736.463273][ T27] dump_stack_lvl+0x30/0x12c [ 3736.464013][ T27] dump_stack+0x1c/0x28 [ 3736.464846][ T27] vpanic+0x22c/0x59c [ 3736.465737][ T27] vpanic+0x0/0x59c [ 3736.466553][ T27] hung_task_panic+0x0/0x2c [ 3736.467495][ T27] kthread+0x794/0x9a0 [ 3736.468362][ T27] ret_from_fork+0x10/0x20 [ 3736.470251][ T27] Kernel Offset: disabled [ 3736.471091][ T27] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 3736.472296][ T27] Memory Limit: none [ 3736.474681][ T27] Rebooting in 86400 seconds.. VM DIAGNOSIS: 09:49:51 Registers: info registers vcpu 0 CPU#0 PC=ffff8000800e2d90 X00=ffffffffffffffff X01=0000000000000002 X02=ffff800080007860 X03=0000000000000010 X04=0000000000000001 X05=0000000000000001 X06=0000000000000000 X07=ffff800080caffec X08=68f000000d9b9d80 X09=ffff800080007840 X10=0000000000ff0100 X11=0000000000000068 X12=72f0000026bd1000 X13=00000000000000db X14=0000000000002000 X15=ffff800080007708 X16=ffff800080010e20 X17=00000000000000f6 X18=00000000000000ff X19=ffff80008658ff54 X20=0000000000000000 X21=68f000000d9b9d80 X22=68f000000d9b9d88 X23=00000000072c0137 X24=fff0000072d002a0 X25=fff0000072d7f120 X26=ffff8000876b5000 X27=00000000000000ff X28=0000000000000000 X29=ffff8000800077d0 X30=ffff80008656ddd8 SP=ffff800080007840 PSTATE=404020c9 -Z-- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=2525252525252525:2525252525252525 Z01=65642f000a732520:7325207334362e25 Z02=742065726f6d2072:6f662064656b636f Z03=000000ff0000ff00:00ff0000000000ff Z04=0000000000000000:000f00f00f00000f Z05=64656b636f6c6220:303030353a333032 Z06=203a29315f657661:6c735f646e6f6220 Z07=206e612073612067:6e6976616c736e45 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffcbae4e60:0000ffffcbae4e60 Z17=ffffff80ffffffd0:0000ffffcbae4e30 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000