last executing test programs: 45.213082144s ago: executing program 1 (id=3): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$KVM_GET_API_VERSION(r0, 0xae00, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x3e) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000002c0)=[{0x0, &(0x7f0000000040)=[@code={0xa, 0x9c, {"000028d5c0db9dd20020b8f2c10080d2820180d2a30180d2840080d2020000d4c0c192d200a0b0f2610180d2420180d2030080d2a40080d2020000d4007008d50000009c0060000d0000601f007008d5005289d20060b8f2e10080d2220080d2230080d2c40180d2020000d460db85d200e0b8f2810180d2220180d2a30180d2c40080d2020000d4"}}, @msr={0x14, 0x20, {0x603000000013e6df, 0xb}}, @mrs={0xbe, 0x18, {0x603000000013c708}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x100, 0x5, 0xa}}, @its_send_cmd={0xaa, 0x28, {0xa, 0x1, 0x2, 0xa, 0xb3d, 0x2, 0x4}}, @memwrite={0x6e, 0x30, @generic={0x1, 0x1ce, 0xfffffffffffffffb}}, @uexit={0x0, 0x18, 0x73e4}, @mrs={0xbe, 0x18, {0x603000000013e642}}, @uexit={0x0, 0x18, 0x1}, @eret={0xe6, 0x18, 0x5}, @svc={0x122, 0x40, {0x84000006, [0x2, 0x2, 0x4, 0xc0]}}, @svc={0x122, 0x40, {0x3000000, [0x7, 0x4, 0x0, 0x2, 0x9ea4]}}, @eret={0xe6, 0x18, 0xfffffffffffff801}], 0x254}], 0x1, 0x0, &(0x7f0000000300)=[@featur2={0x1, 0x8}], 0x1) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000340)={0x20002, 0x18000, 0x1}) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x305000, 0x0) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000400)=@other={0x4, &(0x7f00000003c0)=0xffffffffffffffff}) r4 = ioctl$KVM_GET_STATS_FD_cpu(r2, 0xaece) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x18) ioctl$KVM_CAP_DIRTY_LOG_RING(r5, 0x4068aea3, &(0x7f0000000440)) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f00000004c0)={0x7, 0x0, [{0x2, 0x3, 0x0, 0x0, @msi={0xc3, 0x8, 0x8, 0x10000}}, {0xd, 0x3, 0x0, 0x0, @adapter={0x9, 0xff, 0xfffffffffffffffd, 0x400, 0x9}}, {0xd5e, 0x3, 0x1, 0x0, @msi={0x3, 0x9c3, 0x2, 0x26}}, {0x7ff, 0x5, 0x0, 0x0, @irqchip={0xe, 0x9}}, {0x3, 0x1, 0x1, 0x0, @msi={0x200, 0xfffffffb, 0x5, 0xa2}}, {0x6, 0x4, 0x1, 0x0, @adapter={0x8, 0x7, 0xff, 0x7a7, 0x81dc}}, {0x0, 0x5, 0x1, 0x0, @msi={0x101, 0x6, 0x5, 0x4}}]}) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000640)={0x200000000000000, 0xeeee1004, 0x1, r4}) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r5, 0x4068aea3, &(0x7f0000000680)={0xe4, 0x0, 0x400}) munmap(&(0x7f0000f9e000/0x2000)=nil, 0x2000) ioctl$KVM_CAP_ARM_USER_IRQ(r5, 0x4068aea3, &(0x7f0000000700)) ioctl$KVM_GET_SREGS(r4, 0x8000ae83, &(0x7f0000000780)) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f00000008c0)={0xa, 0x0, [{0x7ff, 0x2, 0x1, 0x0, @irqchip={0xd6, 0x9}}, {0xa0, 0x5, 0x1, 0x0, @irqchip={0x5, 0xa72b}}, {0x7, 0x4, 0x0, 0x0, @sint={0x6, 0x7fffffff}}, {0xfffffffb, 0x4, 0x0, 0x0, @msi={0x7, 0x0, 0x30, 0x3}}, {0x9, 0x2, 0x1, 0x0, @adapter={0x3ff00, 0x8, 0x6, 0x0, 0x3}}, {0x800, 0x1, 0x1, 0x0, @sint={0xfd, 0xfff}}, {0x3f0, 0x1, 0x0, 0x0, @sint={0xfe, 0x1}}, {0x6, 0x4, 0x1, 0x0, @adapter={0x9, 0x0, 0x0, 0x8, 0xf607}}, {0xc578, 0x5, 0x1, 0x0, @sint={0x9, 0x5}}, {0x80, 0x5, 0x0, 0x0, @msi={0x0, 0x4, 0x81, 0x89d5}}]}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x22) ioctl$KVM_CAP_ARM_MTE(r6, 0x4068aea3, &(0x7f0000000ac0)) ioctl$KVM_GET_API_VERSION(r3, 0xae00, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r4, 0xc008ae67, &(0x7f0000000b40)={0xffff, 0xfffffffd}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r7, &(0x7f0000991000/0x400000)=nil, &(0x7f0000001040)=[{0x0, &(0x7f0000000b80)=[@its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x0, 0x9, 0x8, 0x0, 0x2}}, @hvc={0x32, 0x40, {0x84000013, [0x6, 0x4, 0xffffffffffffffff, 0x4, 0x7]}}, @smc={0x1e, 0x40, {0x84000007, [0x7, 0xf, 0x2, 0xfffffffffffffffe, 0x8]}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x27}}, @hvc={0x32, 0x40, {0x0, [0x1, 0x400000000, 0x0, 0x80000001, 0x1]}}, @smc={0x1e, 0x40, {0x200, [0x9e, 0x2, 0xffffffffffffffff, 0x6e0, 0x1]}}, @eret={0xe6, 0x18, 0x7}, @eret={0xe6, 0x18, 0xf8f}, @eret={0xe6, 0x18, 0xfff}, @uexit={0x0, 0x18, 0xfffffffffffffffd}, @svc={0x122, 0x40, {0x28527274c4f3062, [0x1ff, 0xb24, 0x0, 0x4, 0x4]}}, @hvc={0x32, 0x40, {0xc4000014, [0x0, 0x274, 0xb4de, 0xfff, 0x945]}}, @code={0xa, 0x84, {"00800008007008d5607097d20020b8f2210080d2820180d2630080d2c40180d2020000d400f684d200c0b0f2810080d2420080d2630080d2640180d2020000d40000402c007c209b0000407c60878fd20080b8f2e10180d2c20080d2030080d2c40080d2020000d4000028d5010000d4"}}, @eret={0xe6, 0x18, 0x2}, @mrs={0xbe, 0x18, {0x603000000013804d}}, @irq_setup={0x46, 0x18, {0x4, 0x203}}, @uexit={0x0, 0x18, 0x1ff}, @its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x1, 0x7, 0x7, 0xa80}}, @smc={0x1e, 0x40, {0x20, [0x9, 0x1, 0x2, 0xbd, 0x4]}}, @hvc={0x32, 0x40, {0x84000005, [0x8, 0x5, 0x2, 0x9, 0x2]}}, @svc={0x122, 0x40, {0xc4000004, [0x1, 0x2, 0x7f, 0x3, 0x8000000000000000]}}, @eret={0xe6, 0x18, 0x5}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x300, 0x8, 0x1}}, @eret={0xe6, 0x18, 0x1}, @svc={0x122, 0x40, {0x84000013, [0x3, 0x5, 0x5, 0x437b16fa, 0x1]}}], 0x49c}], 0x1, 0x0, &(0x7f0000001080)=[@featur1={0x1, 0x2}], 0x1) ioctl$KVM_IRQFD(r6, 0x4020ae76, &(0x7f00000010c0)={r4, 0x9, 0x0, r4}) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r4, 0x4068aea3, &(0x7f0000001100)={0xe4, 0x0, 0x81}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000011c0)=@attr_arm64={0x0, 0x8, 0x3, &(0x7f0000001180)=0xfffffffffffffffd}) 41.492328808s ago: executing program 0 (id=4): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x46) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0xc400000d, [0x99b, 0x100000003, 0x5, 0x101]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r4, 0xae80, 0x0) 38.387402906s ago: executing program 1 (id=5): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x8280, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) r4 = eventfd2(0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce5, 0x7fff}}, @msr={0x14, 0x20, {0x603000000013dce8, 0x8000}}, @msr={0x14, 0x20, {0x603000000013dce9, 0x8000}}], 0x60}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000000)={0xa, 0x4}}) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x191181, 0x0) ioctl$KVM_CHECK_EXTENSION(r9, 0xae03, 0x7) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) r10 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_setup_syzos_vm$arm64(r11, &(0x7f0000c00000/0x400000)=nil) r13 = syz_kvm_add_vcpu$arm64(r12, &(0x7f0000000b80)={0x0, &(0x7f0000000100)=[@hvc={0x32, 0x40, {0x84000015, [0xf6, 0x100, 0xffffffffffffffff, 0xee24, 0xfffffffffffeffff]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r13, 0xae80, 0x0) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r8, 0x4018aee3, &(0x7f0000000100)=@attr_pmu_init) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000280)={0xb, 0xffffffffffffffff, 0x1}) ioctl$KVM_RUN(r8, 0xae80, 0x0) close(r4) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01) write$eventfd(r4, &(0x7f0000000180)=0x5, 0xfffffde3) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) 33.323909067s ago: executing program 0 (id=6): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) (async) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000009000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) 27.369665504s ago: executing program 1 (id=7): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000000)={0x800035a3, 0x9}) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, 0x0) r4 = syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, 0x0) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x28) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) syz_kvm_setup_cpu$arm64(r6, r8, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000c40)=ANY=[], 0x318}], 0x1, 0x0, &(0x7f0000000080)=[@featur2={0x1, 0x2}], 0x1) 25.651381533s ago: executing program 0 (id=8): munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f00005c1000/0xe000)=nil, 0xe000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r1, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, r1, 0xe, 0x16831, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x4019032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, r1, 0x6000002, 0x4d832, 0xffffffffffffffff, 0x0) 18.38445678s ago: executing program 0 (id=9): r0 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x4}}], 0x50}, 0x0, 0x0) (async) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x200, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3}}], 0x68}, 0x0, 0x0) r10 = syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) (async) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x6, 0x4, 0x0}) syz_kvm_vgic_v3_setup(r3, 0x4, 0x220) (async) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r11, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) r12 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) r14 = syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_add_vcpu$arm64(r14, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r15, 0x4040aea0, &(0x7f0000000140)=@arm64={0x2, 0x3, 0x1, '\x00', 0x6}) (async) ioctl$KVM_RUN(r15, 0xae80, 0x0) (async) r16 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000500), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r16, 0xae03, 0xa2) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f00000001c0)=0x2}) 17.262378368s ago: executing program 1 (id=10): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x4000)=nil, r4, 0x2000003, 0x11, r2, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000000000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000009000/0x2000)=nil, r4, 0x2000009, 0x11, r2, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x4000)=nil, r4, 0x2000003, 0x11, r2, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000000000/0x400000)=nil) (async) mmap$KVM_VCPU(&(0x7f0000009000/0x2000)=nil, r4, 0x2000009, 0x11, r2, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) (async) 9.939660936s ago: executing program 1 (id=11): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) ioctl$KVM_GET_REG_LIST(r5, 0xc008aeb0, 0x0) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x0, 0x0, 0x6, 0x2, 0x4}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 8.743611173s ago: executing program 0 (id=12): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x8, 0x80800) r3 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x7ffffffffffffffe, 0xeeee2001, 0x8, r3}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x1, r2, 0x2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x7fff, 0x5000, 0x2, r3}) 2.401443886s ago: executing program 0 (id=13): r0 = eventfd2(0x3, 0x0) write$eventfd(r0, &(0x7f0000000400)=0xfffffffffffffffc, 0x8) openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0) close(0x3) write$eventfd(r0, &(0x7f0000000280)=0x2, 0x8) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_DIRTY_LOG(r2, 0x4010ae42, &(0x7f0000000240)={0x3, 0x0, &(0x7f0000ccf000/0x2000)=nil}) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000100), 0x80402, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2c) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000040)=@arm64_sys={0x603000000013c021, &(0x7f0000000140)=0x9}) r9 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x4800, 0x0) r10 = syz_kvm_vgic_v3_setup(r9, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r10, 0x4018aee2, &(0x7f0000000080)=@attr_other={0x0, 0x9, 0x5660b638, 0x0}) r11 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x0, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x3, 0xfffffffd, 0x0, 0x0, 0x0, 0x4}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r2, 0x1, 0x100) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r11, 0xae80, 0x0) 0s ago: executing program 1 (id=14): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x8001, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000b10000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) syz_kvm_assert_reg(r6, 0x603000000013df19, 0x8000) r7 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000b80)={0x0, &(0x7f00000009c0)=[@hvc={0x32, 0x40, {0x84000006, [0x4, 0x1, 0x8000000000000000, 0x427f, 0x400003]}}], 0x40}, &(0x7f0000000bc0)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r7, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000ba0000/0x400000)=nil) kernel console output (not intermixed with test programs): [ 375.450765][ T3156] 8021q: adding VLAN 0 to HW filter on device bond0 [ 410.505688][ T3156] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:59425' (ED25519) to the list of known hosts. [ 587.576445][ T25] audit: type=1400 audit(586.770:61): avc: denied { name_bind } for pid=3311 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 589.089588][ T25] audit: type=1400 audit(588.280:62): avc: denied { execute } for pid=3312 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 589.129868][ T25] audit: type=1400 audit(588.310:63): avc: denied { execute_no_trans } for pid=3312 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 611.304974][ T25] audit: type=1400 audit(610.500:64): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 611.342082][ T25] audit: type=1400 audit(610.530:65): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 611.423784][ T3312] cgroup: Unknown subsys name 'net' [ 611.472096][ T25] audit: type=1400 audit(610.670:66): avc: denied { unmount } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 611.845469][ T3312] cgroup: Unknown subsys name 'cpuset' [ 611.945806][ T3312] cgroup: Unknown subsys name 'rlimit' [ 612.844681][ T25] audit: type=1400 audit(612.040:67): avc: denied { setattr } for pid=3312 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 612.863504][ T25] audit: type=1400 audit(612.060:68): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 612.893325][ T25] audit: type=1400 audit(612.090:69): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 614.113310][ T3315] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 614.133333][ T25] audit: type=1400 audit(613.330:70): avc: denied { relabelto } for pid=3315 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 614.161806][ T25] audit: type=1400 audit(613.350:71): avc: denied { write } for pid=3315 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 614.331069][ T25] audit: type=1400 audit(613.520:72): avc: denied { read } for pid=3312 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 614.350069][ T25] audit: type=1400 audit(613.540:73): avc: denied { open } for pid=3312 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 614.390523][ T3312] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 664.784548][ T25] audit: type=1400 audit(663.980:74): avc: denied { execmem } for pid=3316 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 669.373877][ T25] audit: type=1400 audit(668.570:76): avc: denied { open } for pid=3319 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 669.389227][ T25] audit: type=1400 audit(668.550:75): avc: denied { read } for pid=3318 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 669.458622][ T25] audit: type=1400 audit(668.650:77): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 669.742256][ T25] audit: type=1400 audit(668.910:78): avc: denied { module_request } for pid=3319 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 670.803546][ T25] audit: type=1400 audit(669.990:79): avc: denied { sys_module } for pid=3318 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 694.586624][ T3318] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 694.695679][ T3318] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 695.963102][ T3319] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 696.143775][ T3319] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 712.553422][ T3318] hsr_slave_0: entered promiscuous mode [ 712.582504][ T3318] hsr_slave_1: entered promiscuous mode [ 713.650273][ T3319] hsr_slave_0: entered promiscuous mode [ 713.684107][ T3319] hsr_slave_1: entered promiscuous mode [ 713.714600][ T3319] debugfs: 'hsr0' already exists in 'hsr' [ 713.722774][ T3319] Cannot create hsr debugfs directory [ 719.069922][ T25] audit: type=1400 audit(718.260:80): avc: denied { create } for pid=3318 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 719.105791][ T25] audit: type=1400 audit(718.300:81): avc: denied { write } for pid=3318 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 719.179799][ T25] audit: type=1400 audit(718.370:82): avc: denied { read } for pid=3318 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 719.299260][ T3318] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 719.613706][ T3318] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 719.880937][ T3318] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 720.056843][ T3318] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 721.730256][ T3319] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 721.971626][ T3319] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 722.191425][ T3319] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 722.366936][ T3319] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 734.662859][ T3318] 8021q: adding VLAN 0 to HW filter on device bond0 [ 737.212618][ T3319] 8021q: adding VLAN 0 to HW filter on device bond0 [ 792.652953][ T3318] veth0_vlan: entered promiscuous mode [ 793.035729][ T3318] veth1_vlan: entered promiscuous mode [ 794.754315][ T3318] veth0_macvtap: entered promiscuous mode [ 795.301393][ T3318] veth1_macvtap: entered promiscuous mode [ 795.863280][ T3319] veth0_vlan: entered promiscuous mode [ 796.440905][ T3319] veth1_vlan: entered promiscuous mode [ 797.710825][ T2151] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 797.716891][ T2151] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 797.743065][ T2151] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 797.794289][ T21] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 799.603102][ T3319] veth0_macvtap: entered promiscuous mode [ 800.103548][ T25] audit: type=1400 audit(799.300:83): avc: denied { mount } for pid=3318 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 800.141117][ T3319] veth1_macvtap: entered promiscuous mode [ 800.303202][ T25] audit: type=1400 audit(799.490:84): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/syzkaller.Fev97m/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 800.609974][ T25] audit: type=1400 audit(799.800:85): avc: denied { mount } for pid=3318 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 800.923399][ T25] audit: type=1400 audit(800.100:86): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/syzkaller.Fev97m/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 801.057026][ T25] audit: type=1400 audit(800.250:87): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/syzkaller.Fev97m/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3739 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 801.536728][ T25] audit: type=1400 audit(800.730:88): avc: denied { unmount } for pid=3318 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 801.812545][ T25] audit: type=1400 audit(800.950:89): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 801.995243][ T25] audit: type=1400 audit(801.120:90): avc: denied { mount } for pid=3318 comm="syz-executor" name="/" dev="gadgetfs" ino=3748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 802.292333][ T3421] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.296111][ T3421] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.322291][ T3421] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.331030][ T3421] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 802.458705][ T25] audit: type=1400 audit(801.650:91): avc: denied { mount } for pid=3318 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 802.554202][ T25] audit: type=1400 audit(801.750:92): avc: denied { mounton } for pid=3318 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 804.125349][ T3318] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 805.139569][ T25] kauditd_printk_skb: 1 callbacks suppressed [ 805.140449][ T25] audit: type=1400 audit(804.290:94): avc: denied { read write } for pid=3318 comm="syz-executor" name="loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 805.141333][ T25] audit: type=1400 audit(804.330:95): avc: denied { open } for pid=3318 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 805.156504][ T25] audit: type=1400 audit(804.350:96): avc: denied { ioctl } for pid=3318 comm="syz-executor" path="/dev/loop1" dev="devtmpfs" ino=639 ioctlcmd=0x4c01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=blk_file permissive=1 [ 814.016300][ T25] audit: type=1400 audit(813.210:97): avc: denied { read } for pid=3469 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 814.073431][ T25] audit: type=1400 audit(813.270:98): avc: denied { open } for pid=3469 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 814.244652][ T25] audit: type=1400 audit(813.440:99): avc: denied { ioctl } for pid=3469 comm="syz.1.2" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0x1500 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 818.510879][ T25] audit: type=1400 audit(817.700:100): avc: denied { execute } for pid=3471 comm="syz.0.1" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=3826 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 827.775436][ T25] audit: type=1400 audit(826.970:101): avc: denied { write } for pid=3481 comm="syz.1.5" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 865.124115][ T25] audit: type=1400 audit(864.310:102): avc: denied { append } for pid=3506 comm="syz.0.13" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 869.305440][ T3506] ================================================================== [ 869.306032][ T3506] BUG: KASAN: invalid-access in __kvm_pgtable_walk+0x8e4/0xa68 [ 869.307793][ T3506] Read of size 8 at addr 3bf000001e4af000 by task syz.0.13/3506 [ 869.308016][ T3506] Pointer tag: [3b], memory tag: [fe] [ 869.308127][ T3506] [ 869.309110][ T3506] CPU: 0 UID: 0 PID: 3506 Comm: syz.0.13 Not tainted syzkaller #0 PREEMPT [ 869.309647][ T3506] Hardware name: linux,dummy-virt (DT) [ 869.310078][ T3506] Call trace: [ 869.310459][ T3506] show_stack+0x2c/0x3c (C) [ 869.311036][ T3506] __dump_stack+0x30/0x40 [ 869.311309][ T3506] dump_stack_lvl+0xd8/0x12c [ 869.311519][ T3506] print_address_description+0xac/0x288 [ 869.311776][ T3506] print_report+0x84/0xa0 [ 869.312012][ T3506] kasan_report+0xb0/0x110 [ 869.312219][ T3506] kasan_tag_mismatch+0x28/0x3c [ 869.312475][ T3506] __hwasan_tag_mismatch+0x30/0x60 [ 869.312777][ T3506] __kvm_pgtable_walk+0x8e4/0xa68 [ 869.313050][ T3506] kvm_pgtable_walk+0x294/0x468 [ 869.313321][ T3506] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 869.313602][ T3506] kvm_free_stage2_pgd+0x198/0x28c [ 869.313861][ T3506] kvm_uninit_stage2_mmu+0x20/0x38 [ 869.314112][ T3506] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 869.314406][ T3506] kvm_mmu_notifier_release+0x48/0xa8 [ 869.314668][ T3506] mmu_notifier_unregister+0x128/0x42c [ 869.314913][ T3506] kvm_put_kvm+0x6a0/0xfa8 [ 869.315097][ T3506] kvm_vm_release+0x58/0x78 [ 869.315347][ T3506] __fput+0x4ac/0x980 [ 869.315534][ T3506] ____fput+0x20/0x58 [ 869.315714][ T3506] task_work_run+0x1bc/0x254 [ 869.315911][ T3506] do_notify_resume+0x1bc/0x270 [ 869.316133][ T3506] el0_svc+0xb8/0x164 [ 869.316373][ T3506] el0t_64_sync_handler+0x84/0x12c [ 869.316597][ T3506] el0t_64_sync+0x198/0x19c [ 869.317096][ T3506] [ 869.317282][ T3506] The buggy address belongs to the physical page: [ 869.318355][ T3506] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e4af [ 869.318713][ T3506] flags: 0x1fff10000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0xc4) [ 869.319827][ T3506] raw: 01fff10000000000 ffffc1ffc051c888 ffffc1ffc0791288 0000000000000000 [ 869.320051][ T3506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 869.320253][ T3506] page dumped because: kasan: bad access detected [ 869.320394][ T3506] [ 869.320482][ T3506] Memory state around the buggy address: [ 869.320836][ T3506] fff000001e4aee00: c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 [ 869.321031][ T3506] fff000001e4aef00: c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 c1 [ 869.321210][ T3506] >fff000001e4af000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 869.321360][ T3506] ^ [ 869.321588][ T3506] fff000001e4af100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 869.321749][ T3506] fff000001e4af200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe [ 869.321935][ T3506] ================================================================== [ 869.544533][ T3506] Disabling lock debugging due to kernel taint [ 869.566608][ T3506] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e4af [ 869.604663][ T3506] flags: 0x1fff10000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0xc4) [ 869.629496][ T3506] raw: 01fff10000000000 ffffc1ffc051c888 ffffc1ffc0791288 0000000000000000 [ 869.638488][ T3506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 869.649217][ T3506] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) [ 869.652953][ T3506] ------------[ cut here ]------------ [ 869.653139][ T3506] kernel BUG at ./include/linux/mm.h:1036! [ 869.654005][ T3506] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 869.658751][ T3506] Modules linked in: [ 869.660567][ T3506] CPU: 0 UID: 0 PID: 3506 Comm: syz.0.13 Tainted: G B syzkaller #0 PREEMPT [ 869.662264][ T3506] Tainted: [B]=BAD_PAGE [ 869.663001][ T3506] Hardware name: linux,dummy-virt (DT) [ 869.664067][ T3506] pstate: 61402009 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 869.665437][ T3506] pc : kvm_s2_put_page+0x374/0x3a0 [ 869.666469][ T3506] lr : kvm_s2_put_page+0x374/0x3a0 [ 869.667454][ T3506] sp : ffff8000a3c17830 [ 869.668216][ T3506] x29: ffff8000a3c17830 x28: 3bf000001e4af000 x27: 3bf000001e4af000 [ 869.669896][ T3506] x26: 00000000000000ff x25: ffff800087396000 x24: ffffc1ffc0000000 [ 869.671315][ T3506] x23: ffffc1ffc0792bc8 x22: 0000000000000000 x21: ffffc1ffc0792bf4 [ 869.672648][ T3506] x20: 0000000000000000 x19: ffffc1ffc0792bc0 x18: 000000003bc286b6 [ 869.673962][ T3506] x17: 000000000484c93f x16: 000000003bc272b6 x15: 0000000030cfc9e6 [ 869.675357][ T3506] x14: 00000000000000b8 x13: fff00000172c3b08 x12: 0000000000000001 [ 869.676781][ T3506] x11: 0000000000000000 x10: 0000000000ff0100 x9 : d261a472e8f76d00 [ 869.678241][ T3506] x8 : d261a472e8f76d00 x7 : 0000000000000400 x6 : ffff80008039fbc8 [ 869.679626][ T3506] x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800080390dd0 [ 869.680851][ T3506] x2 : 0000000000000002 x1 : 0000000100000000 x0 : 000000000000003e [ 869.682306][ T3506] Call trace: [ 869.682973][ T3506] kvm_s2_put_page+0x374/0x3a0 (P) [ 869.683998][ T3506] stage2_free_walker+0xdc/0x264 [ 869.685011][ T3506] __kvm_pgtable_walk+0x7d8/0xa68 [ 869.685956][ T3506] kvm_pgtable_walk+0x294/0x468 [ 869.686924][ T3506] kvm_pgtable_stage2_destroy_range+0x60/0xb4 [ 869.688005][ T3506] kvm_free_stage2_pgd+0x198/0x28c [ 869.688989][ T3506] kvm_uninit_stage2_mmu+0x20/0x38 [ 869.689974][ T3506] kvm_arch_flush_shadow_all+0x1a8/0x1e0 [ 869.691031][ T3506] kvm_mmu_notifier_release+0x48/0xa8 [ 869.692049][ T3506] mmu_notifier_unregister+0x128/0x42c [ 869.693094][ T3506] kvm_put_kvm+0x6a0/0xfa8 [ 869.693904][ T3506] kvm_vm_release+0x58/0x78 [ 869.694799][ T3506] __fput+0x4ac/0x980 [ 869.695569][ T3506] ____fput+0x20/0x58 [ 869.696355][ T3506] task_work_run+0x1bc/0x254 [ 869.697221][ T3506] do_notify_resume+0x1bc/0x270 [ 869.698166][ T3506] el0_svc+0xb8/0x164 [ 869.699006][ T3506] el0t_64_sync_handler+0x84/0x12c [ 869.699918][ T3506] el0t_64_sync+0x198/0x19c [ 869.701317][ T3506] Code: 900377c1 910e9421 aa1303e0 97f9c9f2 (d4210000) [ 869.706718][ T3506] ---[ end trace 0000000000000000 ]--- [ 869.708355][ T3506] Kernel panic - not syncing: Oops - BUG: Fatal exception [ 869.710197][ T3506] Kernel Offset: disabled [ 869.710845][ T3506] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 869.711822][ T3506] Memory Limit: none [ 869.713380][ T3506] Rebooting in 86400 seconds.. VM DIAGNOSIS: 03:08:09 Registers: info registers vcpu 0 CPU#0 PC=ffff800082159154 X00=0000000000000003 X01=0000000000000002 X02=0000000000000001 X03=ffff800082159050 X04=0000000000000001 X05=0000000000000001 X06=0000000000000000 X07=ffff800081f1ef70 X08=f5f000000d9b9d80 X09=0000000000000000 X10=0000000000ff0100 X11=00000000000000fe X12=0000000000000002 X13=0000000000000002 X14=0000000000000000 X15=000000001d9c1048 X16=00000000288eb918 X17=0000000000000000 X18=00000000288ef9a0 X19=efff800000000000 X20=def000000dcb4880 X21=0fff80008c4bb018 X22=0000000000000002 X23=def000000dcb497c X24=00000000000000de X25=def000000dcb4ac8 X26=def000000dcb48c8 X27=00000000000000de X28=00000000000000de X29=ffff80008c4f7b40 X30=ffff800082159154 SP=ffff80008c4f7b30 PSTATE=814020c9 N--- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=0e00000000000000:0e00000000000000 Z01=0000000e00000000:0000000000000000 Z02=000000000000000e:0000000000000000 Z03=00d000a800000000:0000000000000000 Z04=0000000000000000:0000000000000002 Z05=000000000000000e:0000000000000002 Z06=6edc4d3a2914b135:d8e9c869e2695c88 Z07=b20fae707afde253:388e9c6c4fa85ca0 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffde69a610:0000ffffde69a610 Z17=ffffff80ffffffd0:0000ffffde69a5e0 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000