last executing test programs: 1h30m35.741110088s ago: executing program 1 (id=28): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000b97000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000280)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r8, 0x4010aeac, &(0x7f0000000100)=@arm64_sys={0x603000000013c090, &(0x7f00000000c0)=0xfffffffffffffffe}) r9 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r10 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x2800008, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r9, 0x0) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r11, 0xae03, 0x24) r12 = eventfd2(0x0, 0x0) close(r12) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01) write$eventfd(r12, &(0x7f0000000180)=0x5, 0xfffffde3) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x10002, 0x0) ioctl$KVM_CHECK_EXTENSION(r13, 0xae03, 0x1) r14 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_INTERRUPT(r9, 0x4004ae86, &(0x7f0000000140)=0x17) r15 = syz_kvm_vgic_v3_setup(r14, 0x1, 0x100) ioctl$KVM_GET_DEVICE_ATTR(r15, 0x4018aee2, &(0x7f0000000080)=@attr_arm64={0x0, 0x0, 0x0, 0x0}) 1h30m25.691864036s ago: executing program 1 (id=31): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x33) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x7, 0x88000002}}) syz_kvm_vgic_v3_setup(r1, 0x2, 0x100) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r8 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r7, 0x3, 0x11, r3, 0x0) r9 = mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, r7, 0x3, 0x11, r4, 0x0) mmap$KVM_VCPU(&(0x7f0000f1e000/0x1000)=nil, r7, 0x0, 0x10, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r9, 0xffffffffffffffff) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r8, 0xfffffffffffffffe) 1h29m39.865532305s ago: executing program 32 (id=31): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, &(0x7f0000000140)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x33) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000100)={0xef000000, 0x1000, 0x2}}) ioctl$KVM_SET_DEVICE_ATTR_vm(r6, 0x4018aee1, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x7, 0x88000002}}) syz_kvm_vgic_v3_setup(r1, 0x2, 0x100) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r8 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r7, 0x3, 0x11, r3, 0x0) r9 = mmap$KVM_VCPU(&(0x7f000000a000/0x1000)=nil, r7, 0x3, 0x11, r4, 0x0) mmap$KVM_VCPU(&(0x7f0000f1e000/0x1000)=nil, r7, 0x0, 0x10, r4, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r9, 0xffffffffffffffff) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_kvm_assert_syzos_uexit$arm64(r8, 0xfffffffffffffffe) 1h29m35.931728366s ago: executing program 33 (id=32): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000300)=[@memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0xa0, 0x1, 0xa}}], 0x30}, 0x0, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r3, 0xae03, 0x7e) (async, rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x399e01, 0x0) (rerun: 64) ioctl$KVM_CHECK_EXTENSION(r4, 0x5421, 0xfffffffefffffffe) (async) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) 1h23m50.480305568s ago: executing program 34 (id=33): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x11b002, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000280)=0x400000080a00ed}) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) (async) r8 = openat$kvm(0x0, &(0x7f0000000340), 0x109000, 0x0) ioctl$KVM_CAP_ARM_USER_IRQ(r1, 0x4068aea3, &(0x7f00000002c0)) (async) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x31) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000700)={0x0, 0x0}, 0x0, 0x0) (async) r11 = syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x1, 0x8}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x3, 0xfffffffd, 0xf}}], 0x50}, 0x0, 0x0) (async, rerun: 64) syz_kvm_vgic_v3_setup(r6, 0x1, 0x100) (async, rerun: 64) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r9, 0x4010ae68, &(0x7f0000000380)={0x166673004, 0x92000, 0x1}) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR_vm(r9, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0xc, 0x0, 0x2}}) (async) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) (async) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r14, r15, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x20}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 32) ioctl$KVM_GET_ONE_REG(r15, 0x4010aeab, &(0x7f0000000280)=@arm64_fp={0x60400000001001a4, 0x0}) (rerun: 32) ioctl$KVM_RUN(r11, 0xae80, 0x0) (async, rerun: 64) ioctl$KVM_CAP_ARM_EAGER_SPLIT_CHUNK_SIZE(r1, 0x4068aea3, &(0x7f0000000040)={0xe4, 0x0, 0x1000}) (async, rerun: 64) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) 1h16m41.382381083s ago: executing program 4 (id=36): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000000)={0x5, 0x18}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r2, 0x4018aee1, &(0x7f00000001c0)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000140)={0xc, 0xfff9, 0x1}}) 1h16m29.413573305s ago: executing program 4 (id=68): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x1, 0x2, &(0x7f0000000240)=0x8}) r6 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000100)={0x0, &(0x7f0000000340)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x3460, 0x133, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x0, 0x17}}, @hvc={0x32, 0x40, {0xa0006f03, [0x4, 0x6, 0x985, 0x1, 0x8]}}, @mrs={0xbe, 0x18, {0x6030000000138055}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x364}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x1, 0x4, 0x10, 0x987, 0x6, 0x3}}, @smc={0x1e, 0x40, {0xc2000451, [0x7, 0xfff, 0x4, 0x9c, 0x100000001]}}, @hvc={0x32, 0x40, {0x84000053, [0x7fffffff, 0xfffffffffffeffff, 0xffffffffffffff58, 0x5e0, 0x2]}}, @svc={0x122, 0x40, {0x0, [0x9, 0x0, 0x7, 0x5282, 0x2]}}, @svc={0x122, 0x40, {0x80000000, [0x1, 0x949, 0x100000001, 0x4c0adfd4, 0x8]}}, @msr={0x14, 0x20, {0x603000000013df59, 0xfbeb}}, @eret={0xe6, 0x18, 0x6}, @code={0xa, 0xb4, {"00a8200e007008d5a0b78fd20060b8f2e10180d2020180d2630080d2840180d2020000d4007008d50008403860698fd20000b8f2810180d2420080d2030080d2240180d2020000d460d99ed200e0b0f2410180d2620180d2430080d2840080d2020000d4608880d20080b0f2210080d2a20180d2030080d2c40180d2020000d4a0029ad200e0b8f2c10180d2c20080d2e30080d2a40080d2020000d400000037"}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x100, 0xc0, 0x1}}, @eret={0xe6, 0x18, 0x2}, @hvc={0x32, 0x40, {0x40, [0x6, 0x5, 0xffffffff, 0x101, 0x6a5]}}, @svc={0x122, 0x40, {0x80007fff, [0x2, 0xffffffff, 0x8, 0x0, 0x800]}}, @smc={0x1e, 0x40, {0x10a00001f, [0x7, 0x6, 0x800, 0x9, 0x7]}}, @mrs={0xbe, 0x18, {0x50280000001a3321}}, @irq_setup={0x46, 0x18, {0x2, 0x3a3}}, @mrs={0xbe, 0x18, {0x603000000013c4cd}}, @mrs={0xbe, 0x18, {0x603000000013c608}}, @hvc={0x32, 0x40, {0x4000, [0x200, 0x2, 0x5, 0x8f5, 0x6]}}, @uexit={0x0, 0x18, 0x81}, @hvc={0x32, 0x40, {0x84000004, [0x6, 0x100, 0x6, 0x7, 0x8]}}, @code={0xa, 0x84, {"007008d50000c0ac008008d5008008d50070df0c20729ed20040b0f2e10080d2820080d2230080d2a40180d2020000d4408491d200c0b0f2810180d2e20080d2c30180d2e40080d2020000d4007008d5c05a98d20020b8f2610080d2c20180d2c30080d2a40080d2020000d4007008d5"}}, @svc={0x122, 0x40, {0x10, [0x6a18, 0xd, 0x2a34, 0xffffffffffffffff, 0xfffffffffffffff9]}}, @mrs={0xbe, 0x18, {0x60300000001383c6}}, @uexit={0x0, 0x18, 0x5}], 0x5e0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) ioctl$KVM_SET_MP_STATE(r7, 0x4004ae99, &(0x7f0000000200)=0x3) r8 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0x30}) 1h16m13.316908296s ago: executing program 4 (id=71): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async, rerun: 32) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (rerun: 32) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000000)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x8400000e, [0x99b, 0x100000003, 0x5, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) (async, rerun: 32) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x20001, 0x0) (rerun: 32) ioctl$KVM_CREATE_VM(r4, 0xc0189436, 0x20004000) r5 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) mmap$KVM_VCPU(&(0x7f0000ffb000/0x3000)=nil, 0x0, 0x200000e, 0x110, r5, 0x0) 1h16m0.085216655s ago: executing program 4 (id=73): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x28) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) close(r2) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_GET_API_VERSION(r4, 0xae00, 0x0) close(r2) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xe5) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f0000000100)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x31) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CLEAR_DIRTY_LOG(r6, 0xc018aec0, &(0x7f00000000c0)={0x10004, 0x280, 0x200, &(0x7f0000000580)=[0x1000, 0xd52, 0xfffffffffffffffd, 0x4, 0x8, 0x10, 0x401, 0x5, 0xffffffffffffffff, 0x8001, 0x9, 0x8000, 0x9, 0x2, 0x7ff, 0xfffffffffffffff9, 0x5, 0x9, 0x6, 0x80000001, 0x8, 0x5, 0x6, 0x7ff, 0xfffffffffffffffc, 0x7fff, 0x0, 0x8, 0xff, 0x6, 0x40, 0x39, 0x120, 0x4000000000000009, 0xa, 0x9, 0x2, 0xffffffffffffff62, 0x2, 0x0, 0xa, 0xd, 0x7, 0x6, 0x1a7, 0x4, 0xfffffffffffffffe, 0xd, 0x2, 0x2, 0x1ff, 0x8, 0x100, 0x6, 0xbdf0, 0x6, 0xe, 0x8, 0x0, 0x7, 0x5, 0x0, 0x7, 0x5, 0x0, 0x9, 0x1, 0x7, 0x0, 0x3c00000000, 0x9, 0xffff, 0x6, 0xfffffffffffffffa, 0x4, 0xffffffffffff47ef, 0xfffffffffffffff9, 0xc33, 0x5, 0x5, 0x5, 0xa00000, 0x8, 0x4, 0x0, 0xd3, 0x8, 0xd8, 0x4, 0x998, 0x9, 0x5, 0x4, 0x200, 0x6, 0x8, 0x8c, 0x9, 0xffffffffffff70e9, 0x400, 0x4, 0x100, 0x5, 0x6bc, 0x2, 0x6, 0xdd78, 0xfffffffffffffffa, 0x0, 0x7, 0x400, 0xfffffffffffffffa, 0x8, 0xffffffffffffffff, 0xf39, 0x9, 0x0, 0x2, 0x7, 0x9, 0xfffffffffffffff8, 0x2, 0x80, 0xffff, 0x5, 0x0, 0x3ff, 0x7]}) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004c, 0x0}) 1h15m11.591265241s ago: executing program 35 (id=73): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x28) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) close(r2) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_GET_API_VERSION(r4, 0xae00, 0x0) close(r2) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r5, 0xae03, 0xe5) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee3, &(0x7f0000000100)=@attr_irq_timer={0x0, 0x1, 0x0, 0x0}) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x31) r9 = syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CLEAR_DIRTY_LOG(r6, 0xc018aec0, &(0x7f00000000c0)={0x10004, 0x280, 0x200, &(0x7f0000000580)=[0x1000, 0xd52, 0xfffffffffffffffd, 0x4, 0x8, 0x10, 0x401, 0x5, 0xffffffffffffffff, 0x8001, 0x9, 0x8000, 0x9, 0x2, 0x7ff, 0xfffffffffffffff9, 0x5, 0x9, 0x6, 0x80000001, 0x8, 0x5, 0x6, 0x7ff, 0xfffffffffffffffc, 0x7fff, 0x0, 0x8, 0xff, 0x6, 0x40, 0x39, 0x120, 0x4000000000000009, 0xa, 0x9, 0x2, 0xffffffffffffff62, 0x2, 0x0, 0xa, 0xd, 0x7, 0x6, 0x1a7, 0x4, 0xfffffffffffffffe, 0xd, 0x2, 0x2, 0x1ff, 0x8, 0x100, 0x6, 0xbdf0, 0x6, 0xe, 0x8, 0x0, 0x7, 0x5, 0x0, 0x7, 0x5, 0x0, 0x9, 0x1, 0x7, 0x0, 0x3c00000000, 0x9, 0xffff, 0x6, 0xfffffffffffffffa, 0x4, 0xffffffffffff47ef, 0xfffffffffffffff9, 0xc33, 0x5, 0x5, 0x5, 0xa00000, 0x8, 0x4, 0x0, 0xd3, 0x8, 0xd8, 0x4, 0x998, 0x9, 0x5, 0x4, 0x200, 0x6, 0x8, 0x8c, 0x9, 0xffffffffffff70e9, 0x400, 0x4, 0x100, 0x5, 0x6bc, 0x2, 0x6, 0xdd78, 0xfffffffffffffffa, 0x0, 0x7, 0x400, 0xfffffffffffffffa, 0x8, 0xffffffffffffffff, 0xf39, 0x9, 0x0, 0x2, 0x7, 0x9, 0xfffffffffffffff8, 0x2, 0x80, 0xffff, 0x5, 0x0, 0x3ff, 0x7]}) r10 = syz_kvm_add_vcpu$arm64(r9, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004c, 0x0}) 1h15m9.974828656s ago: executing program 3 (id=76): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x1, 0x2, &(0x7f0000000240)=0x8}) r6 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000100)={0x0, &(0x7f0000000340)=[@memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x3460, 0x133, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x0, 0x17}}, @hvc={0x32, 0x40, {0xa0006f03, [0x4, 0x6, 0x985, 0x1, 0x8]}}, @mrs={0xbe, 0x18, {0x6030000000138055}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x364}}, @its_send_cmd={0xaa, 0x28, {0xd, 0x1, 0x4, 0x10, 0x987, 0x6, 0x3}}, @smc={0x1e, 0x40, {0xc2000451, [0x7, 0xfff, 0x4, 0x9c, 0x100000001]}}, @hvc={0x32, 0x40, {0x84000053, [0x7fffffff, 0xfffffffffffeffff, 0xffffffffffffff58, 0x5e0, 0x2]}}, @svc={0x122, 0x40, {0x0, [0x9, 0x0, 0x7, 0x5282, 0x2]}}, @svc={0x122, 0x40, {0x80000000, [0x1, 0x949, 0x100000001, 0x4c0adfd4, 0x8]}}, @msr={0x14, 0x20, {0x603000000013df59, 0xfbeb}}, @eret={0xe6, 0x18, 0x6}, @code={0xa, 0xb4, {"00a8200e007008d5a0b78fd20060b8f2e10180d2020180d2630080d2840180d2020000d4007008d50008403860698fd20000b8f2810180d2420080d2030080d2240180d2020000d460d99ed200e0b0f2410180d2620180d2430080d2840080d2020000d4608880d20080b0f2210080d2a20180d2030080d2c40180d2020000d4a0029ad200e0b8f2c10180d2c20080d2e30080d2a40080d2020000d400000037"}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0x100, 0xc0, 0x1}}, @eret={0xe6, 0x18, 0x2}, @hvc={0x32, 0x40, {0x40, [0x6, 0x5, 0xffffffff, 0x101, 0x6a5]}}, @svc={0x122, 0x40, {0x80007fff, [0x2, 0xffffffff, 0x8, 0x0, 0x800]}}, @smc={0x1e, 0x40, {0x10a00001f, [0x7, 0x6, 0x800, 0x9, 0x7]}}, @mrs={0xbe, 0x18, {0x50280000001a3321}}, @irq_setup={0x46, 0x18, {0x2, 0x3a3}}, @mrs={0xbe, 0x18, {0x603000000013c4cd}}, @mrs={0xbe, 0x18, {0x603000000013c608}}, @hvc={0x32, 0x40, {0x4000, [0x200, 0x2, 0x5, 0x8f5, 0x6]}}, @uexit={0x0, 0x18, 0x81}, @hvc={0x32, 0x40, {0x84000004, [0x6, 0x100, 0x6, 0x7, 0x8]}}, @code={0xa, 0x84, {"007008d50000c0ac008008d5008008d50070df0c20729ed20040b0f2e10080d2820080d2230080d2a40180d2020000d4408491d200c0b0f2810180d2e20080d2c30180d2e40080d2020000d4007008d5c05a98d20020b8f2610080d2c20180d2c30080d2a40080d2020000d4007008d5"}}, @svc={0x122, 0x40, {0x10, [0x6a18, 0xd, 0x2a34, 0xffffffffffffffff, 0xfffffffffffffff9]}}, @mrs={0xbe, 0x18, {0x60300000001383c6}}, @uexit={0x0, 0x18, 0x5}], 0x5e0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) ioctl$KVM_SET_MP_STATE(r7, 0x4004ae99, &(0x7f0000000200)=0x3) r8 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000180)={0x8}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0x30}) 1h14m45.302738492s ago: executing program 3 (id=77): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = eventfd2(0x5, 0x800) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r2, 0x8}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000000c0)={0x8000000008000800, 0x0, 0x0, r2, 0x2}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r2, 0x6}) openat$kvm(0x0, &(0x7f0000000280), 0x505001, 0x0) 1h14m33.729861746s ago: executing program 3 (id=78): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000080)="fb0149dd033be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa76c869d22627e700", 0x0, 0x29) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) r4 = eventfd2(0x0, 0x0) close(r4) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x1f01) write$eventfd(r4, &(0x7f0000000180)=0x5, 0xfffffde3) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x100010, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x7, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x6, 0x5, &(0x7f0000000080)=0x8}) ioctl$KVM_REGISTER_COALESCED_MMIO(r7, 0x4010ae67, &(0x7f0000000140)={0x6000, 0x10000}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000240)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000280)=0x400000080a0000}) r9 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_ARM_VCPU_INIT(r2, 0x4020aeae, &(0x7f0000000000)={0xe, 0x4}) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000300)={0x0, &(0x7f0000000480)=[@smc={0x1e, 0x40, {0xc4000001, [0x8, 0x939, 0xe, 0x7f, 0x4]}}], 0x40}, &(0x7f00000001c0)=[@featur1={0x1, 0xc}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r11, 0x4018aee1, &(0x7f00000002c0)=@attr_pmu_init) ioctl$KVM_RUN(r11, 0xae80, 0x0) 1h14m17.562699618s ago: executing program 3 (id=79): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x1, 0x100) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) (async) r6 = eventfd2(0x5, 0x800) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r6, 0x8}) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f00000000c0)={0x8000000008000800, 0x0, 0x0, r6, 0x2}) (async) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000180)=@attr_set_pmu={0x0, 0x0, 0x3, &(0x7f0000000140)=0x4a8}) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_cpu$arm64(r8, 0xffffffffffffffff, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_DEVICE_ATTR_vm(r8, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x80000000, 0x2}}) (async) ioctl$KVM_IOEVENTFD(r5, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r6, 0x6}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000000)={0x1fd, 0x2, 0x6000, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) syz_kvm_vgic_v3_setup(r3, 0x0, 0x60) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x28) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000080)={0x101fd, 0x2, 0xdddd1000, 0x1000, &(0x7f0000ecd000/0x1000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) (async) r11 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r13 = openat$kvm(0x0, &(0x7f0000000040), 0x140, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000c00000/0x400000)=nil) r15 = syz_kvm_vgic_v3_setup(r5, 0x1, 0x465cd3ee2bb5c0f4) ioctl$KVM_GET_DEVICE_ATTR(r15, 0x4018aee2, &(0x7f0000000100)=@attr_arm64={0x0, 0x1, 0x0, &(0x7f0000000080)=0x4}) 1h14m6.0920049s ago: executing program 3 (id=80): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) (async, rerun: 32) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f00000003c0)=@arm64={0xd2, 0x3, 0x1}) (async, rerun: 32) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x8, 0x23ac5f9b426ec4b1, 0xffffffffffffffff, 0x0) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r4, r5, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013c038, &(0x7f0000000200)=0x3}) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0xdc032, 0xffffffffffffffff, 0x0) 1h13m55.050947735s ago: executing program 3 (id=81): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x31) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$arm64(r1, r5, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000140)=[@hvc={0x32, 0x40, {0x84000009, [0x2, 0x4, 0x8, 0x1, 0x3e]}}, @irq_setup={0x46, 0x18, {0x0, 0x11d}}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x13c}}, @svc={0x122, 0x40, {0xc4000053, [0x100000000, 0x9, 0xe8, 0x3, 0x10]}}, @msr={0x14, 0x20, {0x603000000013df61, 0x8000000000000001}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x4, 0xd, 0x7ff, 0x7, 0x5}}, @msr={0x14, 0x20, {0x603000000013e6de, 0x7fff}}, @svc={0x122, 0x40, {0xfe000008, [0x10001, 0xff, 0xfffffffffffffff3, 0x2adb69f2, 0x7]}}, @svc={0x122, 0x40, {0x84000008, [0x80, 0xd83, 0x80000000, 0xdc37]}}, @msr={0x14, 0x20, {0x603000000013c029, 0x40}}, @eret={0xe6, 0x18, 0x3}, @hvc={0x32, 0x40, {0x40007f88, [0x100, 0x9, 0x100000001, 0x16, 0x4]}}, @uexit={0x0, 0x18, 0x93}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x341}}, @uexit={0x0, 0x18, 0x5078}, @irq_setup={0x46, 0x18, {0x3, 0x27d}}, @hvc={0x32, 0x40, {0x2000000, [0x34b, 0x2, 0xffff, 0xfffffffffffffeff, 0x7]}}, @msr={0x14, 0x20, {0x603000000013e6cd, 0xd9a9}}, @hvc={0x32, 0x40, {0x0, [0x6, 0x10001, 0x8, 0x4]}}, @hvc={0x32, 0x40, {0x8, [0x3ff, 0x6, 0x8ead, 0x2b9e, 0x8]}}, @eret={0xe6, 0x18, 0xaaf}], 0x388}], 0x1, 0x0, &(0x7f00000000c0)=[@featur1={0x1, 0xc4}], 0x1) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r6, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013e110, 0x0}) 1h13m6.100434829s ago: executing program 36 (id=81): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x31) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_cpu$arm64(r1, r5, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000140)=[@hvc={0x32, 0x40, {0x84000009, [0x2, 0x4, 0x8, 0x1, 0x3e]}}, @irq_setup={0x46, 0x18, {0x0, 0x11d}}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x13c}}, @svc={0x122, 0x40, {0xc4000053, [0x100000000, 0x9, 0xe8, 0x3, 0x10]}}, @msr={0x14, 0x20, {0x603000000013df61, 0x8000000000000001}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x4, 0xd, 0x7ff, 0x7, 0x5}}, @msr={0x14, 0x20, {0x603000000013e6de, 0x7fff}}, @svc={0x122, 0x40, {0xfe000008, [0x10001, 0xff, 0xfffffffffffffff3, 0x2adb69f2, 0x7]}}, @svc={0x122, 0x40, {0x84000008, [0x80, 0xd83, 0x80000000, 0xdc37]}}, @msr={0x14, 0x20, {0x603000000013c029, 0x40}}, @eret={0xe6, 0x18, 0x3}, @hvc={0x32, 0x40, {0x40007f88, [0x100, 0x9, 0x100000001, 0x16, 0x4]}}, @uexit={0x0, 0x18, 0x93}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x341}}, @uexit={0x0, 0x18, 0x5078}, @irq_setup={0x46, 0x18, {0x3, 0x27d}}, @hvc={0x32, 0x40, {0x2000000, [0x34b, 0x2, 0xffff, 0xfffffffffffffeff, 0x7]}}, @msr={0x14, 0x20, {0x603000000013e6cd, 0xd9a9}}, @hvc={0x32, 0x40, {0x0, [0x6, 0x10001, 0x8, 0x4]}}, @hvc={0x32, 0x40, {0x8, [0x3ff, 0x6, 0x8ead, 0x2b9e, 0x8]}}, @eret={0xe6, 0x18, 0xaaf}], 0x388}], 0x1, 0x0, &(0x7f00000000c0)=[@featur1={0x1, 0xc4}], 0x1) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r6, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013e110, 0x0}) 1h4m49.542622664s ago: executing program 6 (id=95): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x2}}, @msr={0x14, 0x20, {0x603000000013dcf3, 0x8000}}], 0x40}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = eventfd2(0x0, 0x80000) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x9, 0x2, r4}) syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x3, 0x0) 1h4m36.753540947s ago: executing program 5 (id=96): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x21) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r4, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000003c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r4, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x60871, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x7) syz_kvm_setup_cpu$arm64(r4, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x51, 0x0, 0x0, 0xfffffffffffffe86) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x7, 0x1, 0x0}) syz_kvm_add_vcpu$arm64(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@msr={0x14, 0x20, {0x603000000013f518, 0x3}}, @code={0xa, 0x6c, {"0004403c0094007f20139fd200a0b8f2210180d2620080d2030080d2c40080d2020000d4007008d5209b83d200c0b0f2410180d2020180d2a30180d2440180d2020000d40004805a000008d5008008d50000002e0030000e"}}, @uexit={0x0, 0x18, 0x8}], 0xa4}, &(0x7f0000000300)=[@featur2], 0x1) r9 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000000180)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000000140)=0x7}) 1h4m34.555348238s ago: executing program 6 (id=97): syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000c86000/0x3000)=nil, r1, 0x2000003, 0xaf832, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) r4 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r3, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r4, 0x20, &(0x7f00000000c0)="e65bf643e6e1a3ffc871fcc8064f26b4d9f94b6f1ccd7b41443d2b5486580143226c0ead9a1620b6709fafba2af023314cc4bf610d6a743ad4913910b8364e5f73ea2fc43ac1ebfc", 0x0, 0x48) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000040)=[{0x0, &(0x7f00000001c0)=[@uexit={0x0, 0x18}], 0x18}], 0x1, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) ioctl$KVM_UNREGISTER_COALESCED_MMIO(0xffffffffffffffff, 0x4010ae68, &(0x7f0000000080)={0x6000, 0x1000, 0x1}) 1h4m18.413819164s ago: executing program 6 (id=98): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_add_vcpu$arm64(0x0, 0x0, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x2, 0x160) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000040)=@arm64={0x3, 0x3, 0x0, '\x00', 0x9}) r3 = openat$kvm(0x0, 0x0, 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, 0x0) ioctl$KVM_SET_GSI_ROUTING(r4, 0x4020ae46, &(0x7f0000000180)=ANY=[@ANYBLOB="01000000010000000040"]) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x181900, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r7, 0x400454e2, 0x110c230020) 1h4m10.402449674s ago: executing program 5 (id=99): mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x17) ioctl$KVM_SET_GSI_ROUTING(r0, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x4, 0x3, 0x1, 0x0, @irqchip={0x1000, 0x9}}]}) syz_kvm_setup_syzos_vm$arm64(r0, &(0x7f0000c00000/0x400000)=nil) r1 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r1, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xf, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) 1h4m1.445230913s ago: executing program 6 (id=100): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x28) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x18b080, 0x0) ioctl$KVM_CREATE_VM(r5, 0xc0189436, 0x20004000) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r4, 0x4068aea3, &(0x7f0000000280)={0xdf, 0x0, 0x2000}) ioctl$KVM_CLEAR_DIRTY_LOG(r4, 0xc018aec0, &(0x7f00000001c0)={0x1fe, 0x80, 0x280, 0x0}) r6 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x10000000027) syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x0, 0x140) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x100) ioctl$KVM_SIGNAL_MSI(r12, 0x4020aea5, &(0x7f0000000280)={0x100000, 0x6000, 0x0, 0x2000000}) r13 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r14 = ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r14, 0x4020aeae, &(0x7f0000000100)={0x5, 0x18}) ioctl$KVM_SET_ONE_REG(r14, 0x4010aeac, &(0x7f00000001c0)=@arm64_sve_vls={0x606000000015ffff, &(0x7f0000000080)=0x1}) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000040)={0x1fe, 0x5, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000000000/0x400000)=nil) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000000)={0x3, 0x4, 0xeeee0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$arm64(r6, r7, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100042, 0x0}) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) 1h3m55.332667229s ago: executing program 5 (id=101): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) syz_kvm_vgic_v3_setup(r4, 0x3, 0xa0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r1, 0x4068aea3, &(0x7f0000000080)={0xdf, 0x0, 0x1000}) ioctl$KVM_IRQ_LINE(r4, 0x4008ae61, &(0x7f0000000140)={0x3, 0xff}) r5 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r2, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x200000, 0x0) 1h3m39.279816131s ago: executing program 5 (id=102): r0 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x27) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r6, 0x4010aeab, &(0x7f00000000c0)=@arm64_core={0x6030000000100038, &(0x7f0000000000)=0x78}) r7 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000300)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x4, 0xd}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}}], 0x50}, 0x0, 0x0) r9 = syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_SET_DEVICE_ATTR(r9, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x4, 0x3, &(0x7f0000000000)=0x4}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1a) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 1h3m36.610194616s ago: executing program 6 (id=103): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) close(r3) r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, &(0x7f0000000000)=[@hvc={0x32, 0x40, {0x80000001, [0xfffffffffffffde5, 0x3ff, 0x1, 0x4, 0x9]}}], 0x40}, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0x80111500, 0x20000000) r9 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r9, 0xae04) mmap$KVM_VCPU(&(0x7f0000e5f000/0x3000)=nil, r10, 0x3, 0x13, r8, 0x0) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r12 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r13, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) r15 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r14, 0x4018aee1, &(0x7f0000000080)=@attr_arm64={0x0, 0x1, 0x2, &(0x7f0000000240)=0x8}) ioctl$KVM_CREATE_VM(r11, 0x80111500, 0x20000000) r16 = eventfd2(0x7f, 0x801) write$eventfd(r16, &(0x7f00000000c0), 0x8) ioctl$KVM_RUN(r6, 0xae80, 0x0) r17 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r18 = ioctl$KVM_CREATE_VM(r17, 0xae01, 0x0) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r18, 0x4068aea3, &(0x7f0000000180)={0xa8, 0x0, 0x2}) ioctl$KVM_SET_GSI_ROUTING(r1, 0x4008ae6a, &(0x7f0000000300)=ANY=[@ANYBLOB="0100000000000000000a00000200000001000000000000000e0000000800"/56]) 1h3m11.599644303s ago: executing program 5 (id=104): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013df4d, &(0x7f00000000c0)}) (async) ioctl$KVM_GET_ONE_REG(r2, 0x4010aeab, &(0x7f0000000100)=@arm64_sys={0x603000000013df4d, &(0x7f00000000c0)}) 1h3m7.263260918s ago: executing program 6 (id=105): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xe) r3 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@mrs={0xbe, 0x18, {0xe4e70dd895aaf09b}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x3, 0xfffffffd, 0x0, 0xffffffff, 0x1}}], 0x40}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8}) r5 = ioctl$KVM_GET_STATS_FD_cpu(r4, 0xaece) write$eventfd(r5, &(0x7f0000000000)=0x9, 0x8) r6 = openat$kvm(0x0, &(0x7f0000000000), 0x222000, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r9, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x18b080, 0x0) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) r13 = syz_kvm_vgic_v3_setup(r12, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r13, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x1, 0x4, &(0x7f00000004c0)=0x1}) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1h2m57.541993045s ago: executing program 5 (id=106): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x31) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000ab9000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010001a, 0x0}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000000280)=@arm64_sys={0x603000000013808c, &(0x7f00000001c0)}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x800008, 0x10b, &(0x7f0000000340)=0xfffffffffffffffc}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) 1h2m19.145868563s ago: executing program 37 (id=105): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0xe) r3 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@mrs={0xbe, 0x18, {0xe4e70dd895aaf09b}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x3, 0xfffffffd, 0x0, 0xffffffff, 0x1}}], 0x40}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8}) r5 = ioctl$KVM_GET_STATS_FD_cpu(r4, 0xaece) write$eventfd(r5, &(0x7f0000000000)=0x9, 0x8) r6 = openat$kvm(0x0, &(0x7f0000000000), 0x222000, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x2) r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r9, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r9, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x18b080, 0x0) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) r13 = syz_kvm_vgic_v3_setup(r12, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r13, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x1, 0x4, &(0x7f00000004c0)=0x1}) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 1h2m7.050471737s ago: executing program 38 (id=106): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) openat$kvm(0x0, 0x0, 0x0, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x31) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000ab9000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_ONE_REG(r5, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010001a, 0x0}) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r9, 0x4010aeac, &(0x7f0000000280)=@arm64_sys={0x603000000013808c, &(0x7f00000001c0)}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x800008, 0x10b, &(0x7f0000000340)=0xfffffffffffffffc}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x4, 0x1, 0x0}) 53m54.512458405s ago: executing program 7 (id=107): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x5, 0x800) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r4, 0x8}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000000c0)={0x8000000008000800, 0x0, 0x0, r4, 0x2}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r4, 0x6}) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x2c) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x2, 0x4f832, 0xffffffffffffffff, 0x1000000) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r7 = syz_kvm_add_vcpu$arm64(r6, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r7, &(0x7f0000bfe000/0x400000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r7, 0x4010aeac, &(0x7f0000000140)=@arm64_ccsidr={0x602000000011000b, &(0x7f00000000c0)=0x8000000}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) r8 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) eventfd2(0x2, 0x80000) ioctl$KVM_ARM_SET_DEVICE_ADDR(r8, 0x4010aeab, 0x0) 53m45.24174833s ago: executing program 8 (id=108): mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000f69000/0x3000)=nil, 0x3000) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x32) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r0, r1, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000280)=[{0x0, &(0x7f0000000340)=[@hvc={0x32, 0x40, {0x84000014, [0x5, 0x8000000000000000, 0x7, 0x1, 0x6]}}, @uexit={0x0, 0x18}, @code={0xa, 0xcc, {"00ff83d20060b8f2010180d2620180d2830180d2640180d2020000d400a8310e0004002f0028285e40099fd20040b8f2610180d2a20080d2830180d2440080d2020000d4400593d20060b8f2810180d2e20180d2630080d2840080d2020000d4400288d20020b0f2410180d2a20080d2630080d2440180d2020000d4c0c98cd20060b8f2c10080d2e20180d2e30180d2e40180d2020000d4806d9cd20020b0f2c10180d2620080d2030080d2440080d2020000d40000005e"}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x0, 0x1, 0x0, 0x8, 0xd, 0x4}}, @memwrite={0x6e, 0x30, @generic={0xdddd0000, 0x89, 0x8001, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x0, 0xd, 0x4, 0x1, 0x3}}, @its_setup={0x82, 0x28, {0x3, 0x1, 0x2a7}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x2, 0x266}}, @smc={0x1e, 0x40, {0x400, [0x1, 0x5, 0x9, 0x2, 0x5]}}, @svc={0x122, 0x40, {0xc400000e, [0x3, 0x1, 0x9385, 0xb5, 0x400]}}, @msr={0x14, 0x20, {0x6030000000138037, 0xf}}, @mrs={0xbe, 0x18, {0x603000000013c00e}}, @uexit={0x0, 0x18, 0x5d5b}, @eret={0xe6, 0x18, 0x100000000}, @memwrite={0x6e, 0x30, @generic={0x80a0000, 0xa1a, 0x0, 0x4}}, @eret={0xe6, 0x18, 0x7}, @uexit={0x0, 0x18, 0xc}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x85}}, @smc={0x1e, 0x40, {0x84000012, [0x3ff, 0x4, 0x8, 0xf, 0x5]}}, @memwrite={0x6e, 0x30, @generic={0xffff1000, 0x6e3, 0x5, 0xf}}, @svc={0x122, 0x40, {0x4000000, [0x1e61, 0xb, 0x8000000000000000, 0x3f8000, 0xf317]}}, @uexit={0x0, 0x18, 0x2}, @eret={0xe6, 0x18, 0xffff}, @irq_setup={0x46, 0x18, {0x3, 0x171}}, @mrs={0xbe, 0x18, {0x603000000013f528}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x4, 0xd, 0x73b74421, 0x4, 0x1}}, @mrs={0xbe, 0x18, {0x6030000000138080}}], 0x4bc}], 0x1, 0x0, &(0x7f00000002c0)=[@featur1={0x1, 0xc}], 0x1) r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r2, 0xae04) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000000c0)={0x0, &(0x7f0000000300)=[@memwrite={0x6e, 0x30, @vgic_gicr={0x80a0000, 0xa0, 0x1, 0xa}}], 0x30}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) syz_kvm_setup_cpu$arm64(r3, r5, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1400000000000000200000000000000010ff130000003060ffffffffffffffff320000000000000040000000000000000010000000000000090000000000000000000000fdffffff520b000000000000090000000000000006000000000000006e0000000000000030000000000000000000080800000000d0ff0000000000ff7f00e6ff000000000f00000000000000e60000000000000018000000000000000300000000000000be000000000000001800000000000000fc653400000050a01e000000000000004000000000000000039000440000002001000000000000ff0f000000000000090000000000000000092a000000000005000000000000006e00000000000000300000000000000000000008000000000000000000000000040000000000000004000000000000003200000000000000400000000000000007000084000000000e00000000000000050000000000000000010000000000000600000000000000010000000000f50088"], 0x170}], 0x1, 0x0, &(0x7f0000000040)=[@featur1={0x1, 0x74}], 0x1) ioctl$KVM_RUN(r5, 0xae80, 0x0) 53m26.819744817s ago: executing program 7 (id=109): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x40, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1) r5 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r4, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) (async) r6 = eventfd2(0xd, 0x1) close(r6) (async) openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0) (async) write$eventfd(r6, 0x0, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) (async) r11 = ioctl$KVM_GET_STATS_FD_vm(r9, 0xaece) mmap$KVM_VCPU(&(0x7f00007ee000/0x3000)=nil, r10, 0x1, 0x11, r11, 0x0) (async) r12 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@msr={0x14, 0x20, {0x603000000013e7fc, 0x8000}}], 0x20}, 0x0, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r12, 0x4018aee1, 0x0) ioctl$KVM_RUN(r12, 0xae80, 0x0) 53m18.993394835s ago: executing program 8 (id=110): munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x0, r4, 0x2}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r4, 0x6}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r5, 0x5460, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x1, r8, 0x2}) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000040)={0x4, 0xd000, 0x8, r8, 0xa}) ioctl$KVM_IOEVENTFD(r7, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x2, r8, 0x3}) syz_kvm_vgic_v3_setup(r1, 0x2, 0x220) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0) 53m4.075238177s ago: executing program 7 (id=111): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r4, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xfb7f0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r8 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r9, 0xaece) r11 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r12 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r11, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r11, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x60871, 0x0) 52m53.030446695s ago: executing program 8 (id=112): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x0, 0x200000000000001}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x2, 0x9}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) r4 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) syz_kvm_assert_reg(r11, 0x603000000013df1a, 0x8000) r12 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x27) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000300)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x4, 0xd}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x100) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3e) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xa2) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r14, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x1a) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r16, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 52m16.090772856s ago: executing program 39 (id=111): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r4, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0xfb7f0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r8 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r9, 0xae80, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_GET_STATS_FD_cpu(r9, 0xaece) r11 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r12 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r11, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r12, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r11, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x60871, 0x0) 51m59.604198387s ago: executing program 40 (id=112): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x0, 0x200000000000001}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x0, 0x2, 0x9}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) r4 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0) syz_kvm_assert_reg(r11, 0x603000000013df1a, 0x8000) r12 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x27) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000300)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x4, 0xd}}, @its_send_cmd={0xaa, 0x28, {0x9, 0x0, 0x0, 0x0, 0x6, 0x0, 0x4}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r12, 0x1, 0x100) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3e) ioctl$KVM_CHECK_EXTENSION(0xffffffffffffffff, 0xae03, 0xa2) ioctl$KVM_CREATE_DEVICE(r12, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r15, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r14, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x1a) syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r16, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 42m42.011292351s ago: executing program 1 (id=114): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x2, 0xc, 0x0, 0x80, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = syz_kvm_vgic_v3_setup(r8, 0x1, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r9, 0x4018aee2, &(0x7f0000000080)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f00000000c0)=0x1}) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000000)={0x7, 0xffffffffffffffff}) ioctl$KVM_HAS_DEVICE_ATTR(r10, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0x7, 0x7fffffffffffffff, 0x0}) r11 = openat$kvm(0x0, &(0x7f0000000040), 0xc0083, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x0, 0x11, r11, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r1, 0x4068aea3, &(0x7f0000000000)={0xa8, 0x0, 0x5}) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r8, 0x4068aea3, &(0x7f0000000240)={0xdf, 0x0, 0xc000}) ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b656592f1, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 42m17.688251231s ago: executing program 1 (id=115): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000700)={0x7, 0x0}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000240)={0x200002f}) r2 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x80111500, 0x20000000) ioctl$KVM_CREATE_VM(r3, 0x541b, 0x2000001c) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x2000001, 0x810, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x3000000, 0x4f831, 0xffffffffffffffff, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x2e) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(r5, r6, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0xc) syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r8, 0xae03, 0x7f) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) r10 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r11 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r10, 0xae04) mmap$KVM_VCPU(&(0x7f0000007000/0x2000)=nil, r11, 0x3, 0x11, r9, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r9, 0x0) 41m46.779949181s ago: executing program 1 (id=116): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r4, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000040)={0x4, 0xffda, 0x1}}) r5 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x2}}], 0x20}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013df19, 0x8003}}], 0x20}, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_GET_MP_STATE(r9, 0x8004ae98, &(0x7f0000000040)) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) r14 = syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000b80)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000002, [0x99b, 0x100000001, 0x5, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_RUN(r14, 0xae80, 0x0) ioctl$KVM_CREATE_VM(r10, 0x5452, 0xa00000000000000) ioctl$KVM_IRQ_LINE_STATUS(r7, 0xc008ae67, &(0x7f0000000000)={0xd3, 0x8}) 41m25.13982375s ago: executing program 1 (id=117): munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x2000) r4 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000000)={0x101ff, 0x0, &(0x7f0000ffd000/0x2000)=nil}) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) (async) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x2000) (async) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) (async) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000000)={0x101ff, 0x0, &(0x7f0000ffd000/0x2000)=nil}) (async) 40m35.233005612s ago: executing program 41 (id=117): munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x2000) r4 = ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000000)={0x101ff, 0x0, &(0x7f0000ffd000/0x2000)=nil}) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) (async) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, 0x0}, &(0x7f0000000100)=[@featur2={0x1, 0x12}], 0x1) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x2000) (async) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) (async) ioctl$KVM_GET_DIRTY_LOG(r4, 0x4010ae42, &(0x7f0000000000)={0x101ff, 0x0, &(0x7f0000ffd000/0x2000)=nil}) (async) 19m4.436743253s ago: executing program 0 (id=155): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000002000/0x4000)=nil, 0x4000) munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f00000000c0)={0x0, &(0x7f0000000240)=[@smc={0x1e, 0x40, {0x84000053, [0x80000000000, 0x6, 0xf1, 0x6f4, 0x1]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r6, 0x4010ae67, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r10 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) r11 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) r13 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x0) syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000000000/0x400000)=nil) ioctl$KVM_SET_DEVICE_ATTR(r13, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x2, 0x0, &(0x7f0000000000)=0xf4020000}) r14 = ioctl$KVM_GET_STATS_FD_vm(r9, 0xaece) mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, r10, 0xa, 0x11, r14, 0x0) 18m47.967825997s ago: executing program 0 (id=156): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = eventfd2(0x5, 0x800) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000040)={0x5, 0x8080000, 0x2, r3, 0x8}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000000c0)={0x8000000008000800, 0x0, 0x0, r3, 0x2}) ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000000)={0x1, 0x0, 0x0, r3, 0x6}) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000040)={0x7}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000380)=0x800012}) 18m29.770715086s ago: executing program 0 (id=157): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x4}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x3, 0xfffffffd}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 18m14.179807362s ago: executing program 0 (id=158): munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) (async) mmap$KVM_VCPU(&(0x7f0000ff5000/0x3000)=nil, 0x930, 0x100000f, 0x24132, 0xffffffffffffffff, 0x0) (async) munmap(&(0x7f0000ff5000/0x1000)=nil, 0x1000) (async, rerun: 32) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0xef5fd16b24ea3757, 0x0) (rerun: 32) close(r0) (async) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) 18m2.571513516s ago: executing program 0 (id=159): openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0xb) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x0, 0x0) close(r4) openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20100, 0x0) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000140)={0x1ff, 0xdddc1000, 0x0, r4, 0x4}) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, 0x0, 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x2f) r6 = mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r6, 0x20, &(0x7f00000000c0)="d5f5f543d3681d26b4d9f0ffffffff7b41445c085486580143226c0ead9a1620ba24f023314cc4bf610d6a743ad4913923b8364e5f73ea2fc43ac1abfc00", 0x0, 0xffffffffffffff32) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x7150c0, 0x0) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04) r9 = mmap$KVM_VCPU(&(0x7f0000c60000/0x2000)=nil, r8, 0x300000a, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, 0x0, 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0) openat$kvm(0x0, 0x0, 0x80, 0x0) r10 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r10, &(0x7f0000e8a000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r10, 0x4010aeac, &(0x7f0000000200)=@arm64_core={0x603000000010003a, &(0x7f00000001c0)=0x9}) ioctl$KVM_SET_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee1, &(0x7f00000002c0)=@attr_other={0x0, 0x4, 0x3, 0x0}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r11 = openat$kvm(0x0, &(0x7f0000000240), 0x24400, 0x0) ioctl$KVM_CREATE_VM(r11, 0xae01, 0x0) 17m44.879445054s ago: executing program 0 (id=160): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = openat$kvm(0x0, &(0x7f0000000180), 0xa0080, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_vgic_v3_setup(r3, 0x2, 0x100) close(r3) close(r4) r5 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@hvc={0x32, 0x40, {0x86000000, [0x2, 0x1, 0x2, 0x3, 0x3]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, r9, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) r10 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x2, 0x1b, &(0x7f00000000c0)=0xef}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004c, 0x0}) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x800) 16m56.230185714s ago: executing program 42 (id=160): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31) r2 = openat$kvm(0x0, &(0x7f0000000180), 0xa0080, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_vgic_v3_setup(r3, 0x2, 0x100) close(r3) close(r4) r5 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r6 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@hvc={0x32, 0x40, {0x86000000, [0x2, 0x1, 0x2, 0x3, 0x3]}}], 0x40}, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, r9, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) r10 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000100)=@attr_other={0x0, 0x2, 0x1b, &(0x7f00000000c0)=0xef}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_ONE_REG(r10, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004c, 0x0}) ioctl$KVM_CHECK_EXTENSION(r6, 0xae03, 0x800) 2m37.118111939s ago: executing program 9 (id=183): r0 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) (async, rerun: 32) r1 = openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0) (rerun: 32) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000140)={0x0, 0x0}, &(0x7f0000000280)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_ONE_REG(r4, 0x4010aeac, &(0x7f00000000c0)=@arm64_sys={0x603000000013df48, &(0x7f0000000040)=0x2}) r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x35) syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000000000/0x400000)=nil) (async) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="37d3116035d7513e9a000200018000", 0x0, 0x43) (async) r7 = ioctl$KVM_CREATE_VM(r5, 0x40086602, 0x20000000) (async) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x20080, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r10 = eventfd2(0xeffffffd, 0x801) ioctl$KVM_IOEVENTFD(r9, 0x4040ae79, &(0x7f0000001340)={0x3, 0x0, 0x2, r10, 0x3}) r11 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r12 = ioctl$KVM_CREATE_VM(r11, 0xae01, 0x28) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r12, 0x4010ae74, &(0x7f0000000500)={0x5, 0x0, 0x81}) (async, rerun: 64) r13 = syz_kvm_setup_syzos_vm$arm64(r12, &(0x7f0000c00000/0x400000)=nil) (rerun: 64) syz_kvm_add_vcpu$arm64(r13, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2={0x1, 0x2}], 0x1) (async) r14 = ioctl$KVM_CREATE_VCPU(r12, 0xae41, 0x2) ioctl$KVM_SET_VCPU_EVENTS(r14, 0x4040aea0, &(0x7f00000011c0)=@arm64={0x5, 0xff, 0xc, '\x00', 0x1e00000000000}) (async, rerun: 32) ioctl$KVM_IOEVENTFD(r9, 0x4040ae79, &(0x7f00000000c0)={0x3, 0x0, 0x2, r10, 0xf}) (rerun: 32) r15 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000080)="f475bf8922d5724f158a89019355fd70698d99bc64ed48dd3a90117d97aa6241ff8db942ced07b0ba60b28b4cd42e52849576e6969b2762fd063c7e8a134825d99fdd12b0863e37a", 0x0, 0x48) syz_memcpy_off$KVM_EXIT_MMIO(r0, 0x20, &(0x7f0000000180)="e1da050e71b8b7b1e52ba39f943cde6ea30e33cde9b4162e", 0x0, 0x18) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) syz_kvm_setup_cpu$arm64(r7, r4, &(0x7f0000a45000/0x400000)=nil, &(0x7f0000000480)=[{0x0, &(0x7f00000002c0)=[@msr={0x14, 0x20, {0x6030000000139828, 0x7}}, @smc={0x1e, 0x40, {0x200, [0x58, 0xd, 0x6, 0xe3, 0x64]}}, @smc={0x1e, 0x40, {0x10, [0x3, 0x0, 0xff, 0x400, 0x9]}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0x103}}, @eret={0xe6, 0x18, 0x30}, @smc={0x1e, 0x40, {0x10, [0x9, 0x6, 0x6, 0x10, 0x8000000000000000]}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x0, 0x0, 0x8, 0x0, 0x4, 0x3}}, @eret={0xe6, 0x18, 0x1}, @hvc={0x32, 0x40, {0x80, [0x0, 0x7, 0x7, 0xfffffffffffffffa, 0x7]}}], 0x1a0}], 0x1, 0x0, &(0x7f00000004c0)=[@featur2={0x1, 0x10}], 0x1) 2m28.590154966s ago: executing program 2 (id=184): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(0xffffffffffffffff, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0xe7}) 2m15.945663851s ago: executing program 9 (id=185): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x80, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2e) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r4, 0xae03, 0x5d) syz_kvm_setup_cpu$arm64(r1, r2, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0, 0x30}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_SET_ONE_REG(r2, 0x4010aeac, &(0x7f0000000140)=@arm64_core={0x6030000000100042, &(0x7f0000000000)=0x13}) 2m11.973381215s ago: executing program 2 (id=186): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13) ioctl$KVM_SET_DEVICE_ATTR_vm(r0, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x7, 0x2, &(0x7f0000000100)=0x3}) (async) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r1, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000004000000000000000ad770081000000000800000000000000010000000000000002000000000000000300000000000000040000000000000032000000000000004000000000000000530000c400000000000080"], 0x80}], 0x1, 0x0, 0x0, 0x0) (async) ioctl$KVM_RUN(r1, 0xae80, 0x0) 1m59.668181745s ago: executing program 2 (id=187): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@mrs={0xbe, 0x18, {0x603000000013df40}}], 0x18}, &(0x7f0000000100)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000140)=@attr_pmu_init) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000000)={0x5}) r4 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) r5 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r4, 0x3, 0x11, r3, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) syz_kvm_assert_syzos_uexit$arm64(r5, 0xffffffffffffffff) 1m49.299438238s ago: executing program 9 (id=188): munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r1, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CHECK_EXTENSION(r2, 0x40086602, 0x110e22ffff) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x6, 0x8032, 0xffffffffffffffff, 0x0) r4 = eventfd2(0xfffffffa, 0x80001) write$eventfd(r4, &(0x7f0000000200)=0x8, 0x8) syz_memcpy_off$KVM_EXIT_MMIO(0x0, 0x20, &(0x7f0000000000)="37d3116035d7513e9a000200018000", 0x0, 0x43) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0x40086602, 0x20000000) ioctl$KVM_CHECK_EXTENSION(r3, 0x40086602, 0x110e228001) mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x80, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x28) r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000540)={0x0, 0x0}, &(0x7f0000000580)=[@featur2], 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil) r9 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000200)={0x0, 0x0}, 0x0, 0x0) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r12, &(0x7f0000e8a000/0x18000)=nil, &(0x7f0000000080)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$arm64(r6, r8, &(0x7f0000c00000/0x400000)=nil, &(0x7f0000000000)=[{0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="be000000000000001800000000000000dde6130000003060aa00000000000000280000000000000003010400000000000000090000000e0000000000000000003200000000000000400000000000000000000006000000000000000000000000f7780000000000000800000000000000030000000000000009000000000000001e0000000000000040000000000000000900008400000000050000000000000010000000000000007f0d0000000000000010000000000000050000000000000046000000000000000800000000000000000000005a000000be00000000000000180000000000000028981300000030601400000000000000200000000000000085c0130000003060010000000100000032000000000000fa63287400000000000d0000c400000000ffffffff000000000001000000000000060000000000000007000000000000000000000000000080320000000000000040000000000000000b000084000000000400000000000000080000000000000006000000000000000600000000000000dd000c0000000000be000000000000001800000000000000fe77000000000000"], 0x1a8}], 0x1, 0x0, 0x0, 0x0) munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500) 1m46.303354022s ago: executing program 2 (id=189): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x100, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x8, 0x80800) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0x0, 0x1, r4, 0x2}) ioctl$KVM_IOEVENTFD(r3, 0x4040ae79, &(0x7f0000000000)={0x8000, 0x0, 0x1, r4, 0x3}) syz_kvm_vgic_v3_setup(r1, 0x2, 0x220) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f0000000180)={0x1010020, 0x1}) 1m25.743348309s ago: executing program 9 (id=190): r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) syz_kvm_vgic_v3_setup(r1, 0x1, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r3, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0xe7}) 1m21.641434045s ago: executing program 2 (id=191): r0 = eventfd2(0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x302, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0) ioctl$KVM_SET_ONE_REG(r5, 0x4010aeac, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r7 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f00000000c0)=@arm64_fw={0x6030000000140001}) r9 = eventfd2(0x8, 0x80800) r10 = openat$kvm(0x0, &(0x7f0000000080), 0x40000, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r11, 0xae03, 0xe) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f00000000c0)={0x8000000000000000, 0xeeef0000, 0x0, r9}) ioctl$KVM_IOEVENTFD(r6, 0x4040ae79, &(0x7f0000000000)={0x3, 0x0, 0x0, r0, 0x4}) 1m9.786034928s ago: executing program 9 (id=192): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x20080, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x21) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = eventfd2(0xfffffffa, 0x80001) ioctl$KVM_IOEVENTFD(r4, 0x4040ae79, &(0x7f0000000180)={0x80, 0xd5d77004, 0x4, r5}) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) ioctl$KVM_REGISTER_COALESCED_MMIO(r4, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616}) r6 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000a30000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0x1000009, 0x16831, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x10201, 0x2, 0x1, 0x2000, &(0x7f0000f31000/0x2000)=nil}) munmap(&(0x7f0000b7c000/0x2000)=nil, 0x2000) 58.390742523s ago: executing program 2 (id=193): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x265b82, 0x0) (async) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, &(0x7f0000000280)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000002c0)={0x3, 0x87e}}) (async) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xa) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f00000000c0)={0x10000, 0x1, 0x1000, 0x2000, &(0x7f0000ffb000/0x2000)=nil, 0x3, r1}) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 32) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x34) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x34) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0xff3a) (async) r12 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000fb6000/0x2000)=nil, r12, 0x2000000, 0x110, r11, 0x0) (async) r13 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x28) (async) r14 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) (async) close(r13) (async) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x2e) (async) r15 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r16 = ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r16, 0xae03, 0x9) (async, rerun: 32) close(r13) (rerun: 32) ioctl$KVM_CAP_ARM_SYSTEM_SUSPEND(r5, 0x4068aea3, 0x0) r17 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1d) ioctl$KVM_CREATE_DEVICE(r17, 0xc00caee0, &(0x7f00000001c0)={0x8}) 49.750669119s ago: executing program 9 (id=194): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x240) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f0000000100)={0x3, 0x2, 0xeeef0000, 0x2000, &(0x7f0000c0c000/0x2000)=nil, 0xfffffffffffffff0}) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) 10.681279398s ago: executing program 43 (id=193): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x265b82, 0x0) (async) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r1, 0x4018aee1, &(0x7f0000000280)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f00000002c0)={0x3, 0x87e}}) (async) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0xa) ioctl$KVM_SET_USER_MEMORY_REGION2(r2, 0x40a0ae49, &(0x7f00000000c0)={0x10000, 0x1, 0x1000, 0x2000, &(0x7f0000ffb000/0x2000)=nil, 0x3, r1}) (async, rerun: 32) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 32) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r4 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x34) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x34) r10 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_add_vcpu$arm64(r10, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0xff3a) (async) r12 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r8, 0xae04) mmap$KVM_VCPU(&(0x7f0000fb6000/0x2000)=nil, r12, 0x2000000, 0x110, r11, 0x0) (async) r13 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x28) (async) r14 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfe000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r14, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0) (async) close(r13) (async) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x2e) (async) r15 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r16 = ioctl$KVM_CREATE_VM(r15, 0xae01, 0x0) ioctl$KVM_CHECK_EXTENSION_VM(r16, 0xae03, 0x9) (async, rerun: 32) close(r13) (rerun: 32) ioctl$KVM_CAP_ARM_SYSTEM_SUSPEND(r5, 0x4068aea3, 0x0) r17 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1d) ioctl$KVM_CREATE_DEVICE(r17, 0xc00caee0, &(0x7f00000001c0)={0x8}) 0s ago: executing program 44 (id=194): r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x240) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION2(r7, 0x40a0ae49, &(0x7f0000000100)={0x3, 0x2, 0xeeef0000, 0x2000, &(0x7f0000c0c000/0x2000)=nil, 0xfffffffffffffff0}) syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) kernel console output (not intermixed with test programs): [ 383.492576][ T3150] 8021q: adding VLAN 0 to HW filter on device bond0 [ 419.426640][ T3150] eql: remember to turn off Van-Jacobson compression on your slave devices Warning: Permanently added '[localhost]:55415' (ED25519) to the list of known hosts. [ 597.178046][ T25] audit: type=1400 audit(596.390:60): avc: denied { name_bind } for pid=3305 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 598.515977][ T25] audit: type=1400 audit(597.720:61): avc: denied { execute } for pid=3306 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 598.534831][ T25] audit: type=1400 audit(597.750:62): avc: denied { execute_no_trans } for pid=3306 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 620.957192][ T25] audit: type=1400 audit(620.170:63): avc: denied { mounton } for pid=3306 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 620.990132][ T25] audit: type=1400 audit(620.200:64): avc: denied { mount } for pid=3306 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 621.074277][ T3306] cgroup: Unknown subsys name 'net' [ 621.120740][ T25] audit: type=1400 audit(620.340:65): avc: denied { unmount } for pid=3306 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 621.533233][ T3306] cgroup: Unknown subsys name 'cpuset' [ 621.639379][ T3306] cgroup: Unknown subsys name 'rlimit' [ 622.548459][ T25] audit: type=1400 audit(621.770:66): avc: denied { setattr } for pid=3306 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 622.572960][ T25] audit: type=1400 audit(621.780:67): avc: denied { mounton } for pid=3306 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 622.586018][ T25] audit: type=1400 audit(621.800:68): avc: denied { mount } for pid=3306 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 623.808990][ T3309] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 623.829926][ T25] audit: type=1400 audit(623.050:69): avc: denied { relabelto } for pid=3309 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 623.856305][ T25] audit: type=1400 audit(623.070:70): avc: denied { write } for pid=3309 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 624.031207][ T25] audit: type=1400 audit(623.250:71): avc: denied { read } for pid=3306 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 624.055644][ T25] audit: type=1400 audit(623.270:72): avc: denied { open } for pid=3306 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 624.099491][ T3306] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 674.888054][ T25] audit: type=1400 audit(674.110:73): avc: denied { execmem } for pid=3310 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 679.315884][ T25] audit: type=1400 audit(678.530:74): avc: denied { read } for pid=3313 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 679.341161][ T25] audit: type=1400 audit(678.560:75): avc: denied { open } for pid=3313 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 679.417877][ T25] audit: type=1400 audit(678.620:76): avc: denied { mounton } for pid=3313 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 679.678869][ T25] audit: type=1400 audit(678.900:77): avc: denied { module_request } for pid=3313 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 680.772525][ T25] audit: type=1400 audit(679.990:78): avc: denied { sys_module } for pid=3312 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 709.307789][ T3312] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 710.252074][ T3312] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 710.327444][ T3313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 710.539623][ T3313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 722.529154][ T3312] hsr_slave_0: entered promiscuous mode [ 722.557607][ T3312] hsr_slave_1: entered promiscuous mode [ 723.540808][ T3313] hsr_slave_0: entered promiscuous mode [ 723.615006][ T3313] hsr_slave_1: entered promiscuous mode [ 723.632161][ T3313] debugfs: 'hsr0' already exists in 'hsr' [ 723.657927][ T3313] Cannot create hsr debugfs directory [ 728.842190][ T25] audit: type=1400 audit(728.060:79): avc: denied { create } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 728.902536][ T25] audit: type=1400 audit(728.120:80): avc: denied { write } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 728.955871][ T25] audit: type=1400 audit(728.160:81): avc: denied { read } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 729.111638][ T3312] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 729.569566][ T3312] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 729.818585][ T3312] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 730.129126][ T3312] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 731.768232][ T3313] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 731.990471][ T3313] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 732.129989][ T3313] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 732.450825][ T3313] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 744.482122][ T3312] 8021q: adding VLAN 0 to HW filter on device bond0 [ 747.168705][ T3313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 802.747736][ T3312] veth0_vlan: entered promiscuous mode [ 803.332691][ T3312] veth1_vlan: entered promiscuous mode [ 805.030678][ T3312] veth0_macvtap: entered promiscuous mode [ 805.461259][ T3312] veth1_macvtap: entered promiscuous mode [ 806.168574][ T3313] veth0_vlan: entered promiscuous mode [ 807.051877][ T3313] veth1_vlan: entered promiscuous mode [ 807.724819][ T21] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 807.730130][ T21] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 807.825408][ T21] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 807.826656][ T21] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 810.189955][ T25] audit: type=1400 audit(809.290:82): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 810.369927][ T3313] veth0_macvtap: entered promiscuous mode [ 810.429888][ T25] audit: type=1400 audit(809.650:83): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/syzkaller.MMsTej/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 810.567170][ T25] audit: type=1400 audit(809.780:84): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 810.658341][ T3313] veth1_macvtap: entered promiscuous mode [ 810.847435][ T25] audit: type=1400 audit(810.070:85): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/syzkaller.MMsTej/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 810.952880][ T25] audit: type=1400 audit(810.170:86): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/syzkaller.MMsTej/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3738 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 811.525506][ T25] audit: type=1400 audit(810.720:87): avc: denied { unmount } for pid=3312 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 811.851347][ T25] audit: type=1400 audit(811.000:88): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1544 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 811.942923][ T25] audit: type=1400 audit(811.100:89): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="gadgetfs" ino=3747 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 812.370138][ T25] audit: type=1400 audit(811.590:90): avc: denied { mount } for pid=3312 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 812.482218][ T25] audit: type=1400 audit(811.660:91): avc: denied { mounton } for pid=3312 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 812.631450][ T49] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.652799][ T49] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.709499][ T49] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 812.710735][ T49] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 814.128183][ T3312] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 826.118459][ T25] kauditd_printk_skb: 4 callbacks suppressed [ 826.125507][ T25] audit: type=1400 audit(825.340:96): avc: denied { read } for pid=3465 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 826.166492][ T25] audit: type=1400 audit(825.380:97): avc: denied { open } for pid=3465 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 826.996225][ T25] audit: type=1400 audit(826.030:98): avc: denied { ioctl } for pid=3465 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 831.780977][ T25] audit: type=1400 audit(830.960:99): avc: denied { execute } for pid=3465 comm="syz.0.1" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=3955 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 855.080386][ T25] audit: type=1400 audit(854.300:100): avc: denied { setattr } for pid=3483 comm="syz.0.7" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 894.491974][ T25] audit: type=1400 audit(893.710:101): avc: denied { append } for pid=3513 comm="syz.1.16" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 932.268927][ T25] audit: type=1400 audit(931.490:102): avc: denied { write } for pid=3533 comm="syz.1.22" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1051.603204][ T3349] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1052.969691][ T3349] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.229860][ T3349] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1055.455929][ T3349] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1073.249860][ T3349] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1073.408083][ T3349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1073.500655][ T3349] bond0 (unregistering): Released all slaves [ 1077.380500][ T3349] hsr_slave_0: left promiscuous mode [ 1077.568242][ T3349] hsr_slave_1: left promiscuous mode [ 1078.405062][ T3349] veth1_macvtap: left promiscuous mode [ 1078.408070][ T3349] veth0_macvtap: left promiscuous mode [ 1078.418399][ T3349] veth1_vlan: left promiscuous mode [ 1078.446549][ T3349] veth0_vlan: left promiscuous mode [ 1095.232630][ T3349] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1096.619398][ T3349] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.599077][ T3349] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.556960][ T3349] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1112.192596][ T3349] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1112.272074][ T3349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1112.332971][ T3349] bond0 (unregistering): Released all slaves [ 1113.678184][ T3349] hsr_slave_0: left promiscuous mode [ 1113.757885][ T3349] hsr_slave_1: left promiscuous mode [ 1113.988445][ T3349] veth1_macvtap: left promiscuous mode [ 1114.005049][ T3349] veth0_macvtap: left promiscuous mode [ 1114.009408][ T3349] veth1_vlan: left promiscuous mode [ 1114.019690][ T3349] veth0_vlan: left promiscuous mode [ 1152.459029][ T3573] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1152.698483][ T3573] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1156.482267][ T3576] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1156.707341][ T3576] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1174.002558][ T3573] hsr_slave_0: entered promiscuous mode [ 1174.092338][ T3573] hsr_slave_1: entered promiscuous mode [ 1177.986229][ T3576] hsr_slave_0: entered promiscuous mode [ 1178.026919][ T3576] hsr_slave_1: entered promiscuous mode [ 1178.052897][ T3576] debugfs: 'hsr0' already exists in 'hsr' [ 1178.066949][ T3576] Cannot create hsr debugfs directory [ 1190.662801][ T3573] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1191.466998][ T3573] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1192.028892][ T3573] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1193.335313][ T3573] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1197.521985][ T3576] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1198.031938][ T3576] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1198.442780][ T3576] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1198.943068][ T3576] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1218.899473][ T3573] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1223.680414][ T3576] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1317.020318][ T3573] veth0_vlan: entered promiscuous mode [ 1317.989155][ T3573] veth1_vlan: entered promiscuous mode [ 1321.187768][ T3573] veth0_macvtap: entered promiscuous mode [ 1322.417796][ T3573] veth1_macvtap: entered promiscuous mode [ 1323.875636][ T3576] veth0_vlan: entered promiscuous mode [ 1325.577536][ T3576] veth1_vlan: entered promiscuous mode [ 1327.505897][ T3349] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1327.516024][ T3349] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1327.581313][ T3276] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1327.808583][ T3276] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1331.200174][ T3576] veth0_macvtap: entered promiscuous mode [ 1332.517160][ T3576] veth1_macvtap: entered promiscuous mode [ 1335.705429][ T3352] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1335.747340][ T3352] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1335.752567][ T3352] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1335.791730][ T3352] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1407.351510][ T3349] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1408.921951][ T3349] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1412.081609][ T3349] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1414.161679][ T3349] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1432.018274][ T3856] kvm [3856]: Failed to find VMA for hva 0x21016000 [ 1435.200594][ T3858] kvm [3858]: Failed to find VMA for hva 0x21016000 [ 1440.002016][ T3349] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1440.552900][ T3349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1440.757445][ T3349] bond0 (unregistering): Released all slaves [ 1443.747633][ T3349] hsr_slave_0: left promiscuous mode [ 1443.888131][ T3349] hsr_slave_1: left promiscuous mode [ 1444.756783][ T3349] veth1_macvtap: left promiscuous mode [ 1444.798863][ T3349] veth0_macvtap: left promiscuous mode [ 1444.816727][ T3349] veth1_vlan: left promiscuous mode [ 1444.860976][ T3349] veth0_vlan: left promiscuous mode [ 1542.649578][ T3840] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1543.039773][ T3840] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1581.989814][ T3840] hsr_slave_0: entered promiscuous mode [ 1582.126654][ T3840] hsr_slave_1: entered promiscuous mode [ 1600.712290][ T3840] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1601.121201][ T3840] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1601.505544][ T3840] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1601.810013][ T3840] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1638.669985][ T3840] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1795.959630][ T3840] veth0_vlan: entered promiscuous mode [ 1797.110726][ T3840] veth1_vlan: entered promiscuous mode [ 1800.952825][ T3840] veth0_macvtap: entered promiscuous mode [ 1801.761973][ T3840] veth1_macvtap: entered promiscuous mode [ 1805.919531][ T3580] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1805.921232][ T3580] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1805.925039][ T3580] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1805.925992][ T3580] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1939.520790][ T3349] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1942.079114][ T3349] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1944.427475][ T3349] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1946.701971][ T3349] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1975.716108][ T3349] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1976.299079][ T3349] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1976.687174][ T3349] bond0 (unregistering): Released all slaves [ 1979.697879][ T3349] hsr_slave_0: left promiscuous mode [ 1979.927914][ T3349] hsr_slave_1: left promiscuous mode [ 1980.848612][ T3349] veth1_macvtap: left promiscuous mode [ 1980.865548][ T3349] veth0_macvtap: left promiscuous mode [ 1980.917852][ T3349] veth1_vlan: left promiscuous mode [ 1980.937679][ T3349] veth0_vlan: left promiscuous mode [ 2049.711279][ T42] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2051.478960][ T42] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2053.479018][ T42] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2055.912662][ T42] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2074.666069][ T42] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2075.172148][ T42] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2075.739934][ T42] bond0 (unregistering): Released all slaves [ 2077.798131][ T42] hsr_slave_0: left promiscuous mode [ 2077.885313][ T42] hsr_slave_1: left promiscuous mode [ 2078.556453][ T42] veth1_macvtap: left promiscuous mode [ 2078.561641][ T42] veth0_macvtap: left promiscuous mode [ 2078.596472][ T42] veth1_vlan: left promiscuous mode [ 2078.610692][ T42] veth0_vlan: left promiscuous mode [ 2103.430325][ T4177] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2103.884957][ T4177] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2130.370725][ T4177] hsr_slave_0: entered promiscuous mode [ 2130.408291][ T4177] hsr_slave_1: entered promiscuous mode [ 2148.290696][ T4236] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2148.397466][ T4177] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2149.185599][ T4236] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2150.155218][ T4177] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2151.335561][ T4177] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2151.731171][ T4177] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2181.422692][ T4177] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2186.371591][ T4236] hsr_slave_0: entered promiscuous mode [ 2186.452514][ T4236] hsr_slave_1: entered promiscuous mode [ 2186.535986][ T4236] debugfs: 'hsr0' already exists in 'hsr' [ 2186.558643][ T4236] Cannot create hsr debugfs directory [ 2203.923061][ T4236] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2204.337582][ T4236] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2204.753139][ T4236] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2205.447931][ T4236] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2242.467994][ T4236] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2331.381285][ T4177] veth0_vlan: entered promiscuous mode [ 2332.678058][ T4177] veth1_vlan: entered promiscuous mode [ 2336.495992][ T4177] veth0_macvtap: entered promiscuous mode [ 2337.276780][ T4177] veth1_macvtap: entered promiscuous mode [ 2341.280144][ T3276] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2341.291870][ T3276] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2341.325286][ T3276] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2341.341050][ T3276] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2407.121747][ T4236] veth0_vlan: entered promiscuous mode [ 2408.797492][ T4236] veth1_vlan: entered promiscuous mode [ 2413.396732][ T4236] veth0_macvtap: entered promiscuous mode [ 2414.557713][ T4236] veth1_macvtap: entered promiscuous mode [ 2419.041437][ T4427] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2419.075050][ T4427] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2419.120584][ T42] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2419.224538][ T3862] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2610.429574][ T25] audit: type=1400 audit(2609.620:103): avc: denied { map } for pid=4560 comm="syz.6.103" path="pipe:[10394]" dev="pipefs" ino=10394 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 2698.277571][ T3276] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2700.675810][ T3276] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2703.309839][ T3276] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2706.221843][ T3276] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2736.670596][ T3276] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2736.829596][ T3276] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2736.966841][ T3276] bond0 (unregistering): Released all slaves [ 2740.829743][ T3276] hsr_slave_0: left promiscuous mode [ 2740.995301][ T3276] hsr_slave_1: left promiscuous mode [ 2741.722857][ T3276] veth1_macvtap: left promiscuous mode [ 2741.742681][ T3276] veth0_macvtap: left promiscuous mode [ 2741.769424][ T3276] veth1_vlan: left promiscuous mode [ 2741.786964][ T3276] veth0_vlan: left promiscuous mode [ 2774.647276][ T3276] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2776.073038][ T3276] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2777.672347][ T3276] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2779.058328][ T3276] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2799.099930][ T3276] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2799.341452][ T3276] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2799.508138][ T3276] bond0 (unregistering): Released all slaves [ 2802.365844][ T3276] hsr_slave_0: left promiscuous mode [ 2802.568067][ T3276] hsr_slave_1: left promiscuous mode [ 2803.068751][ T3276] veth1_macvtap: left promiscuous mode [ 2803.072229][ T3276] veth0_macvtap: left promiscuous mode [ 2803.097148][ T3276] veth1_vlan: left promiscuous mode [ 2803.120454][ T3276] veth0_vlan: left promiscuous mode [ 2871.559541][ T4598] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2872.456732][ T4598] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2873.322545][ T4607] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2874.295883][ T4607] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2908.501974][ T4598] hsr_slave_0: entered promiscuous mode [ 2908.599557][ T4598] hsr_slave_1: entered promiscuous mode [ 2911.597767][ T4607] hsr_slave_0: entered promiscuous mode [ 2911.757639][ T4607] hsr_slave_1: entered promiscuous mode [ 2911.826879][ T4607] debugfs: 'hsr0' already exists in 'hsr' [ 2911.836404][ T4607] Cannot create hsr debugfs directory [ 2930.390581][ T4598] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2931.448706][ T4598] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2932.102330][ T4598] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2932.769825][ T4598] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 2941.050648][ T4607] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 2941.627912][ T4607] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 2942.170748][ T4607] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 2942.795515][ T4607] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 2974.570828][ T4598] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2981.379283][ T4607] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3152.944203][ T4598] veth0_vlan: entered promiscuous mode [ 3154.399213][ T4598] veth1_vlan: entered promiscuous mode [ 3158.999281][ T4598] veth0_macvtap: entered promiscuous mode [ 3160.491870][ T4598] veth1_macvtap: entered promiscuous mode [ 3160.926066][ T4607] veth0_vlan: entered promiscuous mode [ 3163.050373][ T4607] veth1_vlan: entered promiscuous mode [ 3166.625237][ T21] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3166.647974][ T21] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3166.714368][ T21] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3166.739096][ T4427] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3171.098304][ T4607] veth0_macvtap: entered promiscuous mode [ 3172.870751][ T4607] veth1_macvtap: entered promiscuous mode [ 3179.330508][ T3407] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.338312][ T3407] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.369325][ T4427] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3179.456347][ T21] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3343.247471][ T4907] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3345.823110][ T4907] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3348.141157][ T4907] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3350.792663][ T4907] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3384.508559][ T4907] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3385.898590][ T4907] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3386.687280][ T4907] bond0 (unregistering): Released all slaves [ 3389.955731][ T4907] hsr_slave_0: left promiscuous mode [ 3390.088192][ T4907] hsr_slave_1: left promiscuous mode [ 3391.045482][ T4907] veth1_macvtap: left promiscuous mode [ 3391.046744][ T4907] veth0_macvtap: left promiscuous mode [ 3391.089205][ T4907] veth1_vlan: left promiscuous mode [ 3391.127043][ T4907] veth0_vlan: left promiscuous mode [ 3444.276850][ T4907] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3445.580704][ T4907] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3447.092560][ T4907] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3448.811501][ T4907] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3477.190875][ T4907] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3477.591090][ T4907] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3478.047578][ T4907] bond0 (unregistering): Released all slaves [ 3481.147040][ T4907] hsr_slave_0: left promiscuous mode [ 3481.244358][ T4907] hsr_slave_1: left promiscuous mode [ 3481.986080][ T4907] veth1_macvtap: left promiscuous mode [ 3481.987493][ T4907] veth0_macvtap: left promiscuous mode [ 3482.026414][ T4907] veth1_vlan: left promiscuous mode [ 3482.065273][ T4907] veth0_vlan: left promiscuous mode [ 3541.268004][ T4895] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3541.561058][ T4902] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3541.920983][ T4895] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3542.276256][ T4902] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3585.616978][ T4902] hsr_slave_0: entered promiscuous mode [ 3585.698734][ T4902] hsr_slave_1: entered promiscuous mode [ 3587.199976][ T4895] hsr_slave_0: entered promiscuous mode [ 3587.301676][ T4895] hsr_slave_1: entered promiscuous mode [ 3587.372633][ T4895] debugfs: 'hsr0' already exists in 'hsr' [ 3587.397045][ T4895] Cannot create hsr debugfs directory [ 3625.112562][ T4895] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 3626.029283][ T4895] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 3626.760540][ T4895] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 3628.475666][ T4895] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 3634.316558][ T4902] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 3634.900576][ T4902] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 3635.242110][ T4902] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 3635.757832][ T4902] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 3672.599032][ T4895] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3679.669499][ T4902] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3834.441354][ T4902] veth0_vlan: entered promiscuous mode [ 3835.906580][ T4902] veth1_vlan: entered promiscuous mode [ 3840.431221][ T4902] veth0_macvtap: entered promiscuous mode [ 3841.298853][ T4902] veth1_macvtap: entered promiscuous mode [ 3845.717319][ T4427] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3845.775543][ T21] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3845.907313][ T5075] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3845.908808][ T5075] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3864.875956][ T4895] veth0_vlan: entered promiscuous mode [ 3866.692293][ T4895] veth1_vlan: entered promiscuous mode [ 3872.059648][ T4895] veth0_macvtap: entered promiscuous mode [ 3873.238718][ T4895] veth1_macvtap: entered promiscuous mode [ 3879.037313][ T35] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3879.085356][ T3862] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3879.086262][ T3862] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3879.086967][ T3862] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3947.681986][ T49] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3951.080250][ T49] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3953.958359][ T49] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3956.821933][ T49] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3997.625714][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3998.477358][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3998.929283][ T49] bond0 (unregistering): Released all slaves [ 4003.397663][ T49] hsr_slave_0: left promiscuous mode [ 4003.610084][ T49] hsr_slave_1: left promiscuous mode [ 4005.005244][ T49] veth1_macvtap: left promiscuous mode [ 4005.006533][ T49] veth0_macvtap: left promiscuous mode [ 4005.050237][ T49] veth1_vlan: left promiscuous mode [ 4005.099384][ T49] veth0_vlan: left promiscuous mode [ 4088.947072][ T3407] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4091.779457][ T3407] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4094.196346][ T3407] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4096.639480][ T3407] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 4124.729669][ T3407] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 4125.189419][ T3407] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 4125.550446][ T3407] bond0 (unregistering): Released all slaves [ 4128.627331][ T3407] hsr_slave_0: left promiscuous mode [ 4128.713282][ T3407] hsr_slave_1: left promiscuous mode [ 4129.260216][ T3407] veth1_macvtap: left promiscuous mode [ 4129.316200][ T3407] veth0_macvtap: left promiscuous mode [ 4129.340844][ T3407] veth1_vlan: left promiscuous mode [ 4129.368270][ T3407] veth0_vlan: left promiscuous mode [ 4183.322057][ T5172] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 4184.729597][ T5172] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 4203.722997][ T5192] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 4205.328592][ T5192] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 4232.621435][ T5172] hsr_slave_0: entered promiscuous mode [ 4232.831856][ T5172] hsr_slave_1: entered promiscuous mode [ 4251.231378][ T5192] hsr_slave_0: entered promiscuous mode [ 4251.359822][ T5192] hsr_slave_1: entered promiscuous mode [ 4251.587582][ T5192] debugfs: 'hsr0' already exists in 'hsr' [ 4251.600433][ T5192] Cannot create hsr debugfs directory [ 4275.819803][ T5172] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 4277.256449][ T5172] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 4278.240477][ T5172] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 4280.957050][ T5172] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 4300.071997][ T5192] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 4300.672720][ T5192] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 4301.401816][ T5192] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 4301.962872][ T5192] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 4327.553087][ T5172] 8021q: adding VLAN 0 to HW filter on device bond0 [ 4342.946237][ T5192] 8021q: adding VLAN 0 to HW filter on device bond0 [ 4500.527411][ T5192] veth0_vlan: entered promiscuous mode [ 4503.569670][ T5192] veth1_vlan: entered promiscuous mode [ 4512.949979][ T5192] veth0_macvtap: entered promiscuous mode [ 4515.010419][ T5192] veth1_macvtap: entered promiscuous mode [ 4523.512327][ T42] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 4523.528826][ T42] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 4523.529725][ T42] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 4523.530514][ T42] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 4597.240734][ T25] audit: type=1400 audit(4596.370:104): avc: denied { map } for pid=5448 comm="syz.0.120" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 4597.249280][ T25] audit: type=1400 audit(4596.460:105): avc: denied { execute } for pid=5448 comm="syz.0.120" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 4599.429705][ T21] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 4600.140942][ T21] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 4600.626274][ T21] bond0 (unregistering): Released all slaves [ 4604.857517][ T21] hsr_slave_0: left promiscuous mode [ 4605.048603][ T21] hsr_slave_1: left promiscuous mode [ 4758.678317][ T5426] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 4759.316123][ T5426] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 4815.752551][ T5426] hsr_slave_0: entered promiscuous mode [ 4816.010862][ T5426] hsr_slave_1: entered promiscuous mode [ 4858.363136][ T5426] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 4859.212489][ T5426] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 4859.902204][ T5426] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 4861.147591][ T5426] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 4914.088066][ T5426] 8021q: adding VLAN 0 to HW filter on device bond0 [ 5209.765052][ T4907] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 5210.389479][ T4907] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 5210.838335][ T4907] bond0 (unregistering): Released all slaves [ 5215.248663][ T4907] hsr_slave_0: left promiscuous mode [ 5215.440425][ T4907] hsr_slave_1: left promiscuous mode [ 5359.359929][ T5724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5359.882480][ T5724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5412.340927][ T5724] hsr_slave_0: entered promiscuous mode [ 5412.659862][ T5724] hsr_slave_1: entered promiscuous mode [ 5445.389813][ T3862] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5448.327516][ T3862] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5451.220058][ T3862] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5454.362759][ T3862] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 5484.852270][ T3862] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 5485.374954][ T3862] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 5485.650253][ T3862] bond0 (unregistering): Released all slaves [ 5489.375899][ T3862] hsr_slave_0: left promiscuous mode [ 5489.536727][ T3862] hsr_slave_1: left promiscuous mode [ 5490.382052][ T3862] veth1_macvtap: left promiscuous mode [ 5490.469580][ T3862] veth0_macvtap: left promiscuous mode [ 5490.486728][ T3862] veth1_vlan: left promiscuous mode [ 5490.498790][ T3862] veth0_vlan: left promiscuous mode [ 5513.442408][ T5724] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 5514.300274][ T5724] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 5515.436199][ T5724] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 5516.449825][ T5724] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 5563.932659][ T5724] 8021q: adding VLAN 0 to HW filter on device bond0 [ 5580.352949][ T5844] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5580.793171][ T5844] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5628.478858][ T5844] hsr_slave_0: entered promiscuous mode [ 5628.571094][ T5844] hsr_slave_1: entered promiscuous mode [ 5628.656611][ T5844] debugfs: 'hsr0' already exists in 'hsr' [ 5628.718425][ T5844] Cannot create hsr debugfs directory [ 5666.144893][ T5844] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 5666.886467][ T5844] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 5667.339217][ T5844] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 5667.883230][ T5844] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 5705.216555][ T5844] 8021q: adding VLAN 0 to HW filter on device bond0 [ 5784.826601][ T5911] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 5785.610900][ T5911] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 5786.021426][ T5911] bond0 (unregistering): Released all slaves [ 5789.026736][ T5911] hsr_slave_0: left promiscuous mode [ 5789.135342][ T5911] hsr_slave_1: left promiscuous mode [ 5878.460881][ T5999] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 5878.759085][ T5999] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 5888.704333][ T5844] veth0_vlan: entered promiscuous mode [ 5889.942225][ T5844] veth1_vlan: entered promiscuous mode [ 5893.792383][ T5844] veth0_macvtap: entered promiscuous mode [ 5894.622264][ T5844] veth1_macvtap: entered promiscuous mode [ 5898.396108][ T21] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 5898.612875][ T21] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 5898.628137][ T21] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 5898.751640][ T21] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 5929.007509][ T5999] hsr_slave_0: entered promiscuous mode [ 5929.103146][ T5999] hsr_slave_1: entered promiscuous mode [ 5965.989701][ T5999] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 5966.916765][ T5999] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 5967.736930][ T5999] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 5968.339009][ T5999] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 6014.588087][ T5999] 8021q: adding VLAN 0 to HW filter on device bond0 [ 6219.396950][ T5999] veth0_vlan: entered promiscuous mode [ 6220.967396][ T5999] veth1_vlan: entered promiscuous mode [ 6225.826997][ T5999] veth0_macvtap: entered promiscuous mode [ 6226.851972][ T5999] veth1_macvtap: entered promiscuous mode [ 6231.885501][ T4597] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 6231.886992][ T4597] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 6231.959592][ T3862] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 6232.037193][ T3407] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 6576.498519][ T6349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 6577.041144][ T6349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 6587.478652][ T6353] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 6588.059943][ T6353] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 6635.278537][ T6349] hsr_slave_0: entered promiscuous mode [ 6635.489835][ T6349] hsr_slave_1: entered promiscuous mode [ 6635.646064][ T6349] debugfs: 'hsr0' already exists in 'hsr' [ 6635.647051][ T6349] Cannot create hsr debugfs directory [ 6647.242863][ T6353] hsr_slave_0: entered promiscuous mode [ 6647.467094][ T6353] hsr_slave_1: entered promiscuous mode [ 6647.527420][ T6353] debugfs: 'hsr0' already exists in 'hsr' [ 6647.548160][ T6353] Cannot create hsr debugfs directory [ 6698.059254][ T6349] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 6701.465703][ T6349] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 6704.826044][ T6349] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 6705.966994][ T6349] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 6721.572073][ T6353] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 6722.507894][ T6353] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 6723.488984][ T6353] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 6724.348486][ T6353] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 6760.819394][ T6349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 6776.420742][ T6353] 8021q: adding VLAN 0 to HW filter on device bond0 [ 6826.216025][ T27] INFO: task syz.9.194:6332 blocked for more than 430 seconds. [ 6826.257885][ T27] Not tainted syzkaller #0 [ 6826.261538][ T27] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 6826.262191][ T27] task:syz.9.194 state:D stack:0 pid:6332 tgid:6332 ppid:5999 task_flags:0x400040 flags:0x00000019 [ 6826.316273][ T27] Call trace: [ 6826.378404][ T27] __switch_to+0x584/0xb20 (T) [ 6826.380647][ T27] __schedule+0x1eec/0x33a4 [ 6826.381269][ T27] schedule+0xac/0x27c [ 6826.381787][ T27] schedule_timeout+0x5c/0x1e4 [ 6826.382229][ T27] do_wait_for_common+0x28c/0x444 [ 6826.382739][ T27] wait_for_completion+0x44/0x5c SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 6826.487799][ T27] __synchronize_srcu+0x2a4/0x320 [ 6826.488747][ T27] synchronize_srcu+0x3cc/0x4f0 [ 6826.489534][ T27] mmu_notifier_unregister+0x320/0x42c [ 6826.490120][ T27] kvm_put_kvm+0x6a0/0xfa8 [ 6826.490556][ T27] kvm_vm_release+0x58/0x78 [ 6826.491009][ T27] __fput+0x4ac/0x980 [ 6826.491472][ T27] ____fput+0x20/0x58 [ 6826.491942][ T27] task_work_run+0x1bc/0x254 [ 6826.492401][ T27] do_notify_resume+0x1bc/0x270 [ 6826.492868][ T27] el0_svc+0xb8/0x164 [ 6826.569842][ T27] el0t_64_sync_handler+0x84/0x12c [ 6826.614436][ T27] el0t_64_sync+0x198/0x19c [ 6826.616261][ T27] [ 6826.616261][ T27] Showing all locks held in the system: [ 6826.616784][ T27] 1 lock held by khungtaskd/27: [ 6826.617194][ T27] #0: ffff800087806858 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire+0x4/0x48 [ 6826.619787][ T27] 1 lock held by syslogd/3109: [ 6826.620206][ T27] 2 locks held by dhcpcd/3150: [ 6826.620575][ T27] 2 locks held by getty/3180: [ 6826.620909][ T27] #0: 3df0000011c468a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 6826.622614][ T27] #1: 08ff80008c54b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x310/0x12b8 [ 6826.767419][ T27] 2 locks held by syz-executor/3306: [ 6826.767825][ T27] 3 locks held by kworker/u4:8/3407: [ 6826.768213][ T27] 2 locks held by kworker/u4:5/4597: [ 6826.768543][ T27] #0: 9cf000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 6826.770312][ T27] #1: ffff80008ce47c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 6826.772154][ T27] 3 locks held by kworker/u4:15/4907: [ 6826.772513][ T27] 3 locks held by kworker/u4:7/5637: [ 6826.772867][ T27] 2 locks held by kworker/u4:2/5911: [ 6826.773194][ T27] #0: 9cf000000cc20948 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7c8/0x1a18 [ 6827.006651][ T27] #1: ffff80008e7a7c78 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x854/0x1a18 [ 6827.008521][ T27] 2 locks held by syz.2.193/6328: [ 6827.008876][ T27] 3 locks held by kworker/u4:12/6363: [ 6827.009234][ T27] 2 locks held by kworker/u4:13/6505: [ 6827.009544][ T27] 1 lock held by modprobe/6506: [ 6827.009863][ T27] 4 locks held by dhcpcd/6507: [ 6827.010172][ T27] 2 locks held by modprobe/6508: [ 6827.010714][ T27] [ 6827.010976][ T27] ============================================= [ 6827.010976][ T27] [ 6827.011797][ T27] Kernel panic - not syncing: hung_task: blocked tasks [ 6827.023208][ T27] CPU: 0 UID: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 6827.024709][ T27] Hardware name: linux,dummy-virt (DT) [ 6827.025655][ T27] Call trace: [ 6827.026487][ T27] show_stack+0x2c/0x3c (C) [ 6827.027517][ T27] __dump_stack+0x30/0x40 [ 6827.028402][ T27] dump_stack_lvl+0x30/0x12c [ 6827.029295][ T27] dump_stack+0x1c/0x28 [ 6827.030170][ T27] vpanic+0x22c/0x59c [ 6827.031032][ T27] vpanic+0x0/0x59c [ 6827.031898][ T27] hung_task_panic+0x0/0x2c [ 6827.032831][ T27] kthread+0x794/0x9a0 [ 6827.033739][ T27] ret_from_fork+0x10/0x20 [ 6827.037481][ T27] Kernel Offset: disabled [ 6827.038288][ T27] CPU features: 0x000000,0001a300,5f7c67c1,057ffe1f [ 6827.039455][ T27] Memory Limit: none [ 6827.041768][ T27] Rebooting in 86400 seconds.. VM DIAGNOSIS: 10:39:38 Registers: info registers vcpu 0 CPU#0 PC=ffff800085a058ec X00=0000000000000000 X01=00000000ffffffff X02=0000000000000008 X03=0000000000000002 X04=0000000000000000 X05=0000000000000000 X06=0000000000000000 X07=ffff800085b2bfd8 X08=daf000000d84bb00 X09=00000000000000fe X10=0000000000ff0100 X11=00000000000000fe X12=daf000000d84c5b0 X13=0000000000000028 X14=ffffffffffffffff X15=ffff800080007680 X16=ffff800080010e20 X17=000000000000004a X18=00000000000000ff X19=0000000000000000 X20=efff800000000000 X21=0000000000000001 X22=41f000001e06ec10 X23=0000000000000041 X24=0000000000000000 X25=0000000000000041 X26=ffff800087b85000 X27=41f000001e06ec58 X28=41f000001e06ec00 X29=ffff8000800074a0 X30=ffff800081992fb0 SP=ffff8000800074f0 PSTATE=60402009 -ZC- EL2h SVCR=00000000 -- BTYPE=0 FPCR=00000000 FPSR=00000000 P00=0000 P01=0000 P02=0000 P03=0000 P04=0000 P05=0000 P06=0000 P07=0000 P08=0000 P09=0000 P10=0000 P11=0000 P12=0000 P13=0000 P14=0000 P15=0000 FFR=0000 Z00=ffffffffffffffff:ffffffffffffffff Z01=0000000000000006:00001fff01000045 Z02=0000000f00000054:0000000000000050 Z03=0000001100010015:0000000900000050 Z04=0000000600000048:0000000000000006 Z05=000000f000000054:0000000000000050 Z06=0000000000000006:0000004000010015 Z07=0000000000000000:0000000000000000 Z08=0000000000000000:0000000000000000 Z09=0000000000000000:0000000000000000 Z10=0000000000000000:0000000000000000 Z11=0000000000000000:0000000000000000 Z12=0000000000000000:0000000000000000 Z13=0000000000000000:0000000000000000 Z14=0000000000000000:0000000000000000 Z15=0000000000000000:0000000000000000 Z16=0000ffffe2474f20:0000ffffe2474f20 Z17=ffffff80ffffffd8:0000ffffe2474ef0 Z18=0000000000000000:0000000000000000 Z19=0000000000000000:0000000000000000 Z20=0000000000000000:0000000000000000 Z21=0000000000000000:0000000000000000 Z22=0000000000000000:0000000000000000 Z23=0000000000000000:0000000000000000 Z24=0000000000000000:0000000000000000 Z25=0000000000000000:0000000000000000 Z26=0000000000000000:0000000000000000 Z27=0000000000000000:0000000000000000 Z28=0000000000000000:0000000000000000 Z29=0000000000000000:0000000000000000 Z30=0000000000000000:0000000000000000 Z31=0000000000000000:0000000000000000