last executing test programs: 15m5.640878138s ago: executing program 0 (id=50): mmap$KVM_VCPU(&(0x7f0000011000/0x3000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000011000/0x3000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000002000/0x4000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) (async) r0 = mmap$KVM_VCPU(&(0x7f0000002000/0x4000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) (async) syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) r1 = openat$kvm(0x0, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x80000000c) r4 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000200)={0x0, 0x0}, &(0x7f00000002c0)=[@featur1={0x1, 0x8}], 0x1) syz_kvm_vgic_v3_setup(r2, 0x1, 0x0) ioctl$KVM_GET_DEVICE_ATTR_vcpu(r3, 0x4018aee2, &(0x7f0000000300)=@attr_pmu_irq={0x0, 0x0, 0x0, 0x0}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x181b03, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) (async) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) (async) r7 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r6, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, r7, 0x3000000, 0x13, r5, 0x0) r8 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) (async) r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x2) r11 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r10, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r11, 0x20, &(0x7f0000000040)="fb4149dd033b8986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67525673312b01040000000000002627e7000000000000000200", 0x0, 0xfffffffffffffe73) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x12, r10, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x12, r10, 0x0) eventfd2(0x70, 0x0) (async) r12 = eventfd2(0x70, 0x0) close(r12) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x2a) (async) r13 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x2a) ioctl$KVM_CAP_HALT_POLL(r13, 0x4068aea3, &(0x7f0000000140)={0xb6, 0x0, 0x100000001}) openat$kvm(0xffffff9c, &(0x7f0000000100), 0x1a01f2, 0x1800) r14 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x161642, 0x0) ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) (async) r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0) r16 = ioctl$KVM_CREATE_VCPU(r15, 0xae41, 0x3) ioctl$KVM_ARM_VCPU_INIT(r16, 0x4020aeae, &(0x7f0000000400)={0x5, 0x8}) ioctl$KVM_SET_ONE_REG(r16, 0x4010aeac, &(0x7f0000000440)=@arm64_sys={0x603000000013df19, &(0x7f0000000480)=0x5}) 14m46.566186832s ago: executing program 0 (id=53): mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x0, 0x5c1fd1b6565d2f1, 0xffffffffffffffff, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f0000000000)=0x4, 0x8) r0 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, r0, 0x1000006, 0x2010, 0xffffffffffffffff, 0x0) 14m40.911442654s ago: executing program 1 (id=54): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000080)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000100)=0x8080000}) r3 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000140)={0x0, &(0x7f0000000180)=[@irq_setup={0x46, 0x18, {0x1, 0x20}}], 0x18}, 0x0, 0x0) r5 = eventfd2(0x0, 0x0) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f00000001c0)={0x1a64afb6, 0x8000000, 0x0, r5}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20080, 0x0) ioctl$KVM_CREATE_VM(r6, 0xc0189436, 0x20003fff) 14m40.630610685s ago: executing program 0 (id=55): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f0000000080)={0x100000000, 0x3}) ioctl$KVM_SET_USER_MEMORY_REGION2(r4, 0x40a0ae49, &(0x7f0000000140)={0x10200, 0x4, 0xf000, 0x1000, &(0x7f0000e21000/0x1000)=nil, 0x0, r4}) ioctl$KVM_SET_USER_MEMORY_REGION2(r3, 0x40a0ae49, &(0x7f0000000080)={0x1fd, 0x4, 0x8000000, 0x2000, &(0x7f0000ffd000/0x2000)=nil, 0x10000, r4}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000740), 0x40000, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x29) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) syz_kvm_vgic_v3_setup(r7, 0x4, 0x80) ioctl$KVM_IRQ_LINE(r7, 0x4008ae61, &(0x7f0000000780)={0x2000010, 0xbb28}) syz_kvm_setup_cpu$arm64(r1, r5, &(0x7f0000bfe000/0x400000)=nil, &(0x7f00000006c0)=[{0x0, &(0x7f0000000200)=[@svc={0x122, 0x40, {0x84000003, [0x5, 0x1, 0x2e, 0x2, 0xda0]}}, @mrs={0xbe, 0x18, {0x603000000013df6a}}, @its_setup={0x82, 0x28, {0x1, 0x3, 0x230}}, @smc={0x1e, 0x40, {0xc4000005, [0x4fd6769a, 0x80, 0x7, 0x1, 0x4]}}, @smc={0x1e, 0x40, {0x84000002, [0x0, 0xff, 0x9, 0x9, 0xfffffffffffffffe]}}, @uexit={0x0, 0x18, 0x6}, @smc={0x1e, 0x40, {0x30000000, [0x2, 0x8, 0xfffffffffffffff7, 0x7fffffffffffffff, 0x2]}}, @code={0xa, 0x9c, {"00a4200e000440fcc0f196d20000b0f2210180d2420080d2e30080d2040080d2020000d4000080720000409b00fca00e003c8ed200c0b8f2e10180d2420080d2830080d2640180d2020000d4c00f9fd200a0b0f2810080d2c20180d2c30080d2440080d2020000d4007008d540618fd20020b8f2610080d2020180d2830180d2440080d2020000d4"}}, @eret={0xe6, 0x18, 0x2}, @hvc={0x32, 0x40, {0x8000, [0x721, 0x9, 0x1, 0xf658]}}, @hvc={0x32, 0x40, {0x100, [0x7, 0x9, 0xffffffff, 0xffffffffffffffff, 0x8]}}, @svc={0x122, 0x40, {0x8600ff01, [0x0, 0x3, 0x9, 0x1, 0x800]}}, @smc={0x1e, 0x40, {0x80000001, [0x6, 0x8, 0x80, 0xfff, 0x9]}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x13a}}, @uexit={0x0, 0x18, 0x5}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x80, 0x0, 0x9}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0x90, 0x1, 0x7}}, @mrs={0xbe, 0x18, {0x603000000013cc8b}}, @mrs={0xbe, 0x18, {0x603000000013e510}}, @code={0xa, 0x84, {"0000309e008008d5403097d20000b0f2610180d2220180d2230180d2040080d2020000d4000c0078e0ac99d200e0b8f2810180d2c20080d2e30080d2e40080d2020000d400d491d200c0b0f2e10180d2620180d2830080d2040080d2020000d40084c00d0040661e000028d50000000d"}}, @its_setup={0x82, 0x28, {0x70a7, 0x0, 0x253}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x1, 0xc, 0xff, 0x2463}}], 0x4b0}], 0x1, 0x0, &(0x7f0000000700)=[@featur1={0x1, 0x80}], 0x1) ioctl$KVM_GET_REG_LIST(r5, 0x4020aeae, &(0x7f0000000000)={0x5, [0x900000000, 0x0, 0x8000000000000000, 0x52, 0x4000000000000ca]}) 14m32.004350115s ago: executing program 1 (id=56): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x25) r2 = openat$kvm(0x0, &(0x7f00000003c0), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000bfe000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000400)={0x0, &(0x7f0000000440)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x80000, 0x10000, 0x20, 0x0, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000004c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f0000000500)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000540)=0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) r7 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r8 = eventfd2(0x6, 0x800) r9 = openat$kvm(0x0, &(0x7f00000002c0), 0x28000, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_vgic_v3_setup(r10, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r10, 0xc00caee0, &(0x7f0000000300)={0x8}) ioctl$KVM_IOEVENTFD(r10, 0x4040ae79, &(0x7f0000000340)={0xcae, 0x1000, 0x0, r8}) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000380)={0x7, 0xb000, 0x2, r8, 0x4}) r11 = syz_kvm_add_vcpu$arm64(r7, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x2, 0x4, 0x1}}, @its_setup={0x82, 0x28, {0x3, 0x1, 0x3ee}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r11, 0xae80, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0xc8}) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000080)={0xa, 0xffffffffffffffff}) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000240)=@x86={0x67, 0x11, 0xe, 0x0, 0x2, 0x7, 0x81, 0xf, 0x3, 0x0, 0x4f, 0xaa, 0x0, 0x243, 0x6, 0x8, 0x9d, 0x4, 0xb, '\x00', 0x1, 0xe9d}) write$eventfd(r14, &(0x7f0000000280)=0x9, 0x5d) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r11, 0xae80, 0x0) 14m28.938142093s ago: executing program 0 (id=57): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) 14m16.932379857s ago: executing program 0 (id=58): r0 = openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000aba000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, &(0x7f00000002c0)=[@its_setup={0x82, 0x28, {0x1, 0x3, 0x121}}], 0x28}, 0x0, 0x0) r7 = syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000300)={0x0, &(0x7f0000000340)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x8000000000000f6}}], 0x28}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r4, 0xff7ffffffffffffd, 0x360) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000380)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000003c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000400)=0x8080000}) ioctl$KVM_RUN(r7, 0xae80, 0x0) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000440)=@attr_other={0x0, 0x767d15da, 0x4e9, &(0x7f0000000480)=0x5244}) ioctl$KVM_RUN(r6, 0xae80, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x2, 0x4, 0x200000, 0x2000, &(0x7f0000ecc000/0x2000)=nil}) syz_kvm_setup_cpu$arm64(r1, 0xffffffffffffffff, &(0x7f0000001000/0x400000)=nil, &(0x7f0000000140)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0xfffffffffffffe50) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x100, &(0x7f0000000200)=0x8000000000000000}) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) openat$kvm(0x0, &(0x7f0000000240), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f00000001c0)={0x8}) (async) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x4}) (async) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000aba000/0x400000)=nil) (async) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000180)={0x0, &(0x7f00000002c0)=[@its_setup={0x82, 0x28, {0x1, 0x3, 0x121}}], 0x28}, 0x0, 0x0) (async) syz_kvm_add_vcpu$arm64(r5, &(0x7f0000000300)={0x0, &(0x7f0000000340)=[@its_setup={0x82, 0x28, {0x1, 0x1, 0x8000000000000f6}}], 0x28}, 0x0, 0x0) (async) syz_kvm_vgic_v3_setup(r4, 0xff7ffffffffffffd, 0x360) (async) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000380)={0x8}) (async) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000003c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000400)=0x8080000}) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) (async) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000440)=@attr_other={0x0, 0x767d15da, 0x4e9, &(0x7f0000000480)=0x5244}) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x2, 0x4, 0x200000, 0x2000, &(0x7f0000ecc000/0x2000)=nil}) (async) syz_kvm_setup_cpu$arm64(r1, 0xffffffffffffffff, &(0x7f0000001000/0x400000)=nil, &(0x7f0000000140)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0xfffffffffffffe50) (async) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000040)=@attr_other={0x0, 0x8, 0x100, &(0x7f0000000200)=0x8000000000000000}) (async) ioctl$KVM_SET_DEVICE_ATTR(r2, 0x4018aee1, &(0x7f0000000280)=@attr_arm64={0x0, 0x4, 0x2, 0x0}) (async) 14m15.2712796s ago: executing program 1 (id=59): munmap$KVM_VCPU(0x0, 0x1000000000) r0 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000300)={0x0, &(0x7f0000000000)=[@mrs={0xbe, 0x18, {0x603000000013801f}}, @its_send_cmd={0xaa, 0x28, {0xe, 0x1, 0x3, 0x5, 0x6, 0x76, 0x2}}, @eret={0xe6, 0x18, 0xd64}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x2, 0x3, 0xc81e, 0x400, 0x2}}, @svc={0x122, 0x40, {0x2, [0xf2fe, 0x7, 0x10, 0xe, 0x3]}}, @its_setup={0x82, 0x28, {0x0, 0x0, 0xa8}}, @code={0xa, 0x54, {"000008d5007008d500d8217e00c0204e00c8a10e000008d5007008d5a04d82d200e0b8f2a10080d2620180d2c30180d2240180d2020000d4008008d50000229e"}}, @irq_setup={0x46, 0x18, {0x2, 0x1c8}}, @uexit={0x0, 0x18, 0x9}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0xe00, 0x40, 0x4}}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0xffd0, 0x3}}, @svc={0x122, 0x40, {0x8400000a, [0x3, 0x6, 0x9, 0x767, 0x2000000000000005]}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x1, 0x0, 0xb, 0x9, 0x9, 0x2}}, @msr={0x14, 0x20, {0x603000000013dcf0, 0xfffffffffffff999}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0xc9}}, @hvc={0x32, 0x40, {0xc5000020, [0x9, 0x7, 0x101, 0x0, 0x80000000]}}, @eret={0xe6, 0x18, 0x7}], 0x2d4}, &(0x7f0000000340)=[@featur2={0x1, 0x1a}], 0x1) r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, r1, 0x5, 0x4f832, r0, 0x0) mmap$KVM_VCPU(&(0x7f0000ffe000/0x2000)=nil, 0x930, 0x8, 0x20031, 0xffffffffffffffff, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x181900, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = eventfd2(0x0, 0x0) close(r4) r5 = openat$kvm(0x0, &(0x7f0000000440), 0x0, 0x0) mmap$KVM_VCPU(&(0x7f0000b4a000/0x2000)=nil, 0x930, 0x280000f, 0x11, r5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000400), 0x40800, 0x0) mmap$KVM_VCPU(&(0x7f0000008000/0x3000)=nil, 0x930, 0x6000004, 0x2011, r4, 0x0) openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f00000003c0)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_CREATE_VM(r6, 0x5452, 0x110c230300) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0xc, 0x5c1fd1b65647af1, 0xffffffffffffffff, 0x20000000) 14m9.991274463s ago: executing program 1 (id=60): r0 = openat$kvm(0x0, &(0x7f0000000580), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil) r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000005c0)={0x0, &(0x7f0000000600)=[@irq_setup={0x46, 0x18, {0x4, 0xf3}}, @svc={0x122, 0x40, {0x2, [0xffffffffffffffbb, 0x4, 0x1, 0x7, 0x600000000]}}], 0x58}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r1, 0x1, 0x100) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000100)={0x0, &(0x7f0000000000)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x3, 0x40000000, 0x2, 0x0, 0x105, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(0xffffffffffffffff, 0x1, 0x100) r6 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil) r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000140)={0x0, &(0x7f0000000240)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x80003, 0x6, 0x0, 0x2, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r7, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f00000002c0)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000300)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000340)=0x8080000}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r11 = eventfd2(0x1, 0x402) ioctl$KVM_IRQFD(r7, 0x4020ae76, &(0x7f0000000540)={0xffffffffffffffff, 0x2, 0x3, r11}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) ioctl$KVM_SET_GSI_ROUTING(r7, 0x4008ae6a, &(0x7f0000000380)={0x8, 0x0, [{0x13, 0x5, 0x1, 0x0, @adapter={0x0, 0x3ff, 0x80000001, 0x10, 0x764}}, {0xffffffff, 0x5, 0x0, 0x0, @msi={0xe53, 0x92d, 0x3, 0x5}}, {0x6, 0x5, 0x0, 0x0, @msi={0x40, 0x7, 0x41, 0xf62}}, {0x7, 0x5, 0x0, 0x0, @adapter={0x4, 0x100000001, 0x42e, 0x6a2e, 0x7fffffff}}, {0xffffffff, 0x5, 0x0, 0x0, @irqchip={0x0, 0x1}}, {0x4, 0x2, 0x1, 0x0, @msi={0x7, 0x1b4, 0x8, 0x4c9}}, {0x7f, 0x3, 0x1, 0x0, @msi={0x80, 0x84, 0x8, 0x8000}}, {0x0, 0x5, 0x1, 0x0, @sint={0x4, 0x4}}]}) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000180)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r12, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000200)=0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 14m0.031554644s ago: executing program 0 (id=61): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000280)={0xee, 0xdddd1000}) (async, rerun: 64) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) (rerun: 64) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x82040, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) (async, rerun: 64) openat$kvm(0x0, &(0x7f0000000100), 0x4a080, 0x0) (async, rerun: 64) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async) r6 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x40) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x7, 0x2, 0xffffffffffffffff}) r7 = eventfd2(0x0, 0x0) close(r7) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r8, 0x2000004, 0x2011, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000d36000/0x1000)=nil, 0x930, 0x2000007, 0x10, r5, 0x0) mmap$KVM_VCPU(&(0x7f0000ff3000/0x4000)=nil, 0x930, 0x2000006, 0x24132, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x0, 0x10010, 0xffffffffffffffff, 0x9000000) (async) mmap$KVM_VCPU(&(0x7f0000f13000/0x10000)=nil, 0x0, 0x0, 0x8010, r5, 0x0) (async) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) (async, rerun: 64) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x0, 0x23ac5f9b426e84b2, 0xffffffffffffffff, 0x0) (async, rerun: 64) r9 = mmap$KVM_VCPU(&(0x7f0000e13000/0x3000)=nil, r8, 0x2800002, 0x40010, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r2, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x2, 0x8}) (async, rerun: 64) openat$kvm(0x0, 0x0, 0x610500, 0x0) (async, rerun: 64) r10 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) 13m56.687132734s ago: executing program 1 (id=62): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) 13m53.362339782s ago: executing program 1 (id=63): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x80000, 0x10000, 0x0, 0x200, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000280)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000002c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000300)=0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000b7b000/0x400000)=nil) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x3, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f0000000100)=@attr_riscv64=@attr_aplic={0x0, 0x1, @valid=0x2000, &(0x7f00000000c0)}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000240)={0x1fe, 0x3, 0xffff1000, 0x1000, &(0x7f0000b24000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f00008a8000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 13m13.512381123s ago: executing program 32 (id=61): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000280)={0xee, 0xdddd1000}) (async, rerun: 64) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x34) (rerun: 64) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) r3 = openat$kvm(0x0, &(0x7f0000000080), 0x82040, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x1) (async, rerun: 64) openat$kvm(0x0, &(0x7f0000000100), 0x4a080, 0x0) (async, rerun: 64) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) (async) r6 = syz_kvm_vgic_v3_setup(r4, 0x1, 0x40) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f0000000140)=@attr_arm64={0x0, 0x7, 0x2, 0xffffffffffffffff}) r7 = eventfd2(0x0, 0x0) close(r7) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r3, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r8, 0x2000004, 0x2011, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000d36000/0x1000)=nil, 0x930, 0x2000007, 0x10, r5, 0x0) mmap$KVM_VCPU(&(0x7f0000ff3000/0x4000)=nil, 0x930, 0x2000006, 0x24132, 0xffffffffffffffff, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000ffa000/0x1000)=nil, 0x930, 0x0, 0x10010, 0xffffffffffffffff, 0x9000000) (async) mmap$KVM_VCPU(&(0x7f0000f13000/0x10000)=nil, 0x0, 0x0, 0x8010, r5, 0x0) (async) munmap(&(0x7f0000f0f000/0x2000)=nil, 0x2000) (async, rerun: 64) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x0, 0x23ac5f9b426e84b2, 0xffffffffffffffff, 0x0) (async, rerun: 64) r9 = mmap$KVM_VCPU(&(0x7f0000e13000/0x3000)=nil, r8, 0x2800002, 0x40010, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r9, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r2, 0x0) ioctl$KVM_IRQ_LINE(r1, 0x4008ae61, &(0x7f00000000c0)={0x2, 0x8}) (async, rerun: 64) openat$kvm(0x0, 0x0, 0x610500, 0x0) (async, rerun: 64) r10 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) 13m4.533896082s ago: executing program 33 (id=63): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil) r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@its_setup={0x82, 0x28, {0x1, 0x4, 0x2}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x1, 0x80000, 0x10000, 0x0, 0x200, 0x2}}], 0x50}, 0x0, 0x0) syz_kvm_vgic_v3_setup(r3, 0x1, 0x100) ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000280)={0x8, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r6, 0x4018aee1, &(0x7f00000002c0)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000300)=0x8080000}) ioctl$KVM_RUN(r5, 0xae80, 0x0) syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000b7b000/0x400000)=nil) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x3, 0xffffffffffffffff, 0x1}) ioctl$KVM_SET_DEVICE_ATTR(r7, 0x4018aee1, &(0x7f0000000100)=@attr_riscv64=@attr_aplic={0x0, 0x1, @valid=0x2000, &(0x7f00000000c0)}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000240)={0x1fe, 0x3, 0xffff1000, 0x1000, &(0x7f0000b24000/0x1000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xcccc0000, 0x1000, &(0x7f0000f15000/0x1000)=nil}) syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f00008a8000/0x400000)=nil) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x6000006, 0x4d832, 0xffffffffffffffff, 0x0) 7m52.27130165s ago: executing program 2 (id=64): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x3f) r1 = ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x1) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2a) r3 = ioctl$KVM_GET_STATS_FD_vm(r2, 0xaece) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x40) ioctl$KVM_IRQ_LINE_STATUS(r4, 0xc008ae67, &(0x7f0000000000)={0xffffff01, 0xe}) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000000080)=@riscv64_smstateen_csr={0x0, &(0x7f0000000040)=0xffffffff}) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x26) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r5, 0x4068aea3, &(0x7f00000000c0)={0xa8, 0x0, 0x3}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r6, 0x4018aee1, &(0x7f0000000180)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000140)={0x100, 0x5d97}}) ioctl$KVM_IRQ_LINE_STATUS(r3, 0xc008ae67, &(0x7f00000001c0)={0x0, 0xfff}) ioctl$KVM_SET_ONE_REG(r3, 0x4010aeac, &(0x7f0000000240)=@riscv64_smstateen_csr={0x0, &(0x7f0000000200)=0xff}) r7 = ioctl$KVM_GET_STATS_FD_cpu(r1, 0xaece) close(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000280)={0x2710, 0x0, 0x1ff8, 0x1000, &(0x7f0000ffd000/0x1000)=nil}) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000300)=@arm64_fw={0x6030000000140000, &(0x7f00000002c0)=0x8000}) eventfd2(0x2, 0x1) ioctl$KVM_IRQ_LINE(r7, 0x4008ae61, &(0x7f0000000340)={0x4d557323, 0x5}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) close(0xffffffffffffffff) ioctl$KVM_CAP_MANUAL_DIRTY_LOG_PROTECT2(r0, 0x4068aea3, &(0x7f00000003c0)={0xa8, 0x0, 0x3}) r8 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000580)={0x0, &(0x7f0000000440)=[@code={0xa, 0x6c, {"0008c038007008d5007008d5000000fa0000259ee0b29ad20040b8f2610080d2e20180d2430180d2640180d2020000d40040211e00e4a02e000028d5007e88d200e0b8f2210080d2e20180d2830180d2640080d2020000d4"}}, @its_send_cmd={0xaa, 0x28, {0xb, 0x0, 0x3, 0x5, 0x7, 0xffff826d, 0x4}}, @eret={0xe6, 0x18, 0x2}, @mrs={0xbe, 0x18, {0x1a0}}, @irq_setup={0x46, 0x18, {0x1, 0x338}}, @msr={0x14, 0x20, {0x603000000013e602, 0xbff}}, @irq_setup={0x46, 0x18, {0x1, 0x66}}], 0x114}, &(0x7f00000005c0)=[@featur2={0x1, 0x5}], 0x1) ioctl$KVM_DIRTY_TLB(r8, 0x4010aeaa, &(0x7f0000000600)={0xbb, 0x9}) ioctl$KVM_ASSIGN_SET_MSIX_ENTRY(r5, 0x4010ae74, &(0x7f0000000640)={0x6, 0x4, 0x1}) ioctl$KVM_ARM_VCPU_INIT(r8, 0x4020aeae, &(0x7f0000000680)={0x0, 0x4}) r9 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x20) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f00000006c0)={0x2}) r10 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece) ioctl$KVM_HAS_DEVICE_ATTR(r10, 0x4018aee3, &(0x7f0000000740)=@attr_arm64={0x0, 0x8, 0x1, &(0x7f0000000700)=0x3}) 7m40.848296435s ago: executing program 2 (id=66): r0 = openat$kvm(0x0, &(0x7f0000000000), 0xbe3a27edad7be4b2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000dd4000/0x3000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) (async) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SIGNAL_MSI(r3, 0x4020aea5, 0xffffffffffffffff) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r4, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) (async) munmap(&(0x7f0000db7000/0x2000)=nil, 0x2000) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2b) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x5) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r8, 0x2, 0x12, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000010000/0x4000)=nil, r8, 0x100000a, 0x12, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0) (async) r9 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000100), 0x300, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) r13 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) r14 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r9, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffa000/0x4000)=nil, r14, 0x1, 0x12, r13, 0x0) (async) r15 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r12, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r15, 0x8, 0x13, r13, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, r15, 0x1000001, 0x12, r13, 0x6000) (async) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) 7m37.160864336s ago: executing program 3 (id=65): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1f) ioctl$KVM_RESET_DIRTY_RINGS(r0, 0xaec7) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) (async, rerun: 64) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil, &(0x7f00000000c0)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0xc8}) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_vgic_v3_setup(r2, 0x4, 0x100) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000180)={0x5, 0xde}) (async) ioctl$KVM_GET_DEVICE_ATTR(r3, 0x4018aee2, &(0x7f00000001c0)=@attr_arm64={0x0, 0x5, 0x0, &(0x7f00000004c0)=0xcd6c}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000240)={0x0, 0x1, 0xeeee0000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) (async) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) (async, rerun: 64) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000380)={0xffffffffffffffff, 0xc8, 0x1}) (rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000400)={0x4, 0xffffffffffffffff, 0x1}) (async, rerun: 32) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000440)=@x86={0x11, 0x9, 0xf, 0x0, 0x5, 0x6, 0x6, 0x6, 0x47, 0x86, 0xdd, 0x68, 0x0, 0x2, 0x6, 0x4, 0x3, 0x5, 0x8, '\x00', 0x1, 0x400000000002}) (rerun: 32) write$eventfd(r6, &(0x7f0000000480)=0x3, 0x50) (async, rerun: 32) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (rerun: 32) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000002c0)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_RESET_DIRTY_RINGS(0xffffffffffffffff, 0xaec7) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000bfe000/0x400000)=nil) write$eventfd(r9, &(0x7f0000000300)=0x7ffffff, 0xe80) (async) r10 = openat$kvm(0x0, &(0x7f0000000000), 0x101a02, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_vgic_v3_setup(r11, 0x3, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r12, 0x4018aee2, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000080)=0x80000000}) 6m53.747650382s ago: executing program 34 (id=66): r0 = openat$kvm(0x0, &(0x7f0000000000), 0xbe3a27edad7be4b2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000dd4000/0x3000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) (async) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SIGNAL_MSI(r3, 0x4020aea5, 0xffffffffffffffff) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r4, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r4, 0x0) (async) munmap(&(0x7f0000db7000/0x2000)=nil, 0x2000) ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04) (async) r5 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x2b) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x5) r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r5, 0xae04) mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, r8, 0x2, 0x12, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000010000/0x4000)=nil, r8, 0x100000a, 0x12, r7, 0x0) (async) mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0) (async) r9 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0) r10 = openat$kvm(0x0, &(0x7f0000000100), 0x300, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) r13 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x2) r14 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r9, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffa000/0x4000)=nil, r14, 0x1, 0x12, r13, 0x0) (async) r15 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r12, 0xae04) mmap$KVM_VCPU(&(0x7f0000ffe000/0x1000)=nil, r15, 0x8, 0x13, r13, 0x0) mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, r15, 0x1000001, 0x12, r13, 0x6000) (async) munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000) 6m48.95959505s ago: executing program 35 (id=65): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1f) ioctl$KVM_RESET_DIRTY_RINGS(r0, 0xaec7) mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0) (async, rerun: 64) syz_kvm_setup_cpu$arm64(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x400000)=nil, &(0x7f00000000c0)=[{0x0, 0x0}], 0x1, 0x0, 0x0, 0x0) (async, rerun: 64) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000100)={0xffffffffffffffff, 0xc8}) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = syz_kvm_vgic_v3_setup(r2, 0x4, 0x100) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000180)={0x5, 0xde}) (async) ioctl$KVM_GET_DEVICE_ATTR(r3, 0x4018aee2, &(0x7f00000001c0)=@attr_arm64={0x0, 0x5, 0x0, &(0x7f00000004c0)=0xcd6c}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000240)={0x0, 0x1, 0xeeee0000, 0x1000, &(0x7f0000fff000/0x1000)=nil}) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) (async) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) (async, rerun: 64) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000380)={0xffffffffffffffff, 0xc8, 0x1}) (rerun: 64) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r5, 0xc00caee0, &(0x7f0000000400)={0x4, 0xffffffffffffffff, 0x1}) (async, rerun: 32) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000000440)=@x86={0x11, 0x9, 0xf, 0x0, 0x5, 0x6, 0x6, 0x6, 0x47, 0x86, 0xdd, 0x68, 0x0, 0x2, 0x6, 0x4, 0x3, 0x5, 0x8, '\x00', 0x1, 0x400000000002}) (rerun: 32) write$eventfd(r6, &(0x7f0000000480)=0x3, 0x50) (async, rerun: 32) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (rerun: 32) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r8, 0xc00caee0, &(0x7f00000002c0)={0x4, 0xffffffffffffffff, 0x1}) ioctl$KVM_RESET_DIRTY_RINGS(0xffffffffffffffff, 0xaec7) syz_kvm_setup_syzos_vm$arm64(r8, &(0x7f0000bfe000/0x400000)=nil) write$eventfd(r9, &(0x7f0000000300)=0x7ffffff, 0xe80) (async) r10 = openat$kvm(0x0, &(0x7f0000000000), 0x101a02, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = syz_kvm_vgic_v3_setup(r11, 0x3, 0x40) ioctl$KVM_GET_DEVICE_ATTR(r12, 0x4018aee2, &(0x7f0000000040)=@attr_arm64={0x0, 0x0, 0x5, &(0x7f0000000080)=0x80000000}) 1m3.070210077s ago: executing program 4 (id=67): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) 52.375504638s ago: executing program 4 (id=69): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000480), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000005c0)={0x0, 0x0}, &(0x7f0000000500)=[@featur1={0x1, 0xb4}], 0x1) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000540)=@arm64_fw={0x6030000000140000, &(0x7f0000000580)=0x1}) r7 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000000)={0x1, 0xfd91}}) r8 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x9}}, @msr={0x14, 0x20, {0x603000000013df61, 0x7}}], 0x40}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f00000002c0)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000000400)=0x1b}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_SET_ONE_REG(r12, 0x4010aeac, &(0x7f0000000200)=@arm64_fw={0x6030000000140000, &(0x7f0000000280)=0x10001}) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r14, 0x4068aea3, &(0x7f0000000600)={0xdf, 0x0, 0x80000}) ioctl$KVM_SET_USER_MEMORY_REGION(r14, 0x4020ae46, &(0x7f0000000680)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000bc2000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r15, &(0x7f00000006c0)={0x0, &(0x7f0000000240)=[@svc={0x122, 0x40, {0xc5000020, [0x6, 0x3, 0x81, 0x711ec841, 0x8000]}}], 0x40}, &(0x7f0000000740)=[@featur1={0x1, 0x43}], 0x1) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000780)={0x0, 0x0}, &(0x7f00000007c0)=[@featur2={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r16, 0xae80, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) 50.589681125s ago: executing program 5 (id=68): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000001c0)="fb0149dd833be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8faa767969d22627e700", 0x0, 0x48) r4 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r4, 0x4018aee3, &(0x7f0000000080)=@attr_pmu_init) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000000)=@arm64_sve={0x60800000001501b7, &(0x7f0000000180)=0x5}) ioctl$KVM_CREATE_VM(r5, 0x401c5820, 0x20000007) 3.711305329s ago: executing program 36 (id=69): r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) r1 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) r3 = openat$kvm(0x0, &(0x7f0000000480), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil) r6 = syz_kvm_add_vcpu$arm64(r5, &(0x7f00000005c0)={0x0, 0x0}, &(0x7f0000000500)=[@featur1={0x1, 0xb4}], 0x1) ioctl$KVM_SET_ONE_REG(r6, 0x4010aeac, &(0x7f0000000540)=@arm64_fw={0x6030000000140000, &(0x7f0000000580)=0x1}) r7 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f0000000040)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000000)={0x1, 0xfd91}}) r8 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@msr={0x14, 0x20, {0x603000000013dce0, 0x9}}, @msr={0x14, 0x20, {0x603000000013df61, 0x7}}], 0x40}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r8, 0x4018aee1, &(0x7f0000000340)=@attr_pmu_init) ioctl$KVM_SET_DEVICE_ATTR_vcpu(r7, 0x4018aee1, &(0x7f00000002c0)=@attr_irq_timer={0x0, 0x1, 0x0, &(0x7f0000000400)=0x1b}) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil) r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000100)=[@featur1={0x1, 0x4}], 0x1) ioctl$KVM_SET_ONE_REG(r12, 0x4010aeac, &(0x7f0000000200)=@arm64_fw={0x6030000000140000, &(0x7f0000000280)=0x10001}) r13 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING_ACQ_REL(r14, 0x4068aea3, &(0x7f0000000600)={0xdf, 0x0, 0x80000}) ioctl$KVM_SET_USER_MEMORY_REGION(r14, 0x4020ae46, &(0x7f0000000680)={0x5, 0x1, 0x1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r15 = syz_kvm_setup_syzos_vm$arm64(r14, &(0x7f0000bc2000/0x400000)=nil) syz_kvm_add_vcpu$arm64(r15, &(0x7f00000006c0)={0x0, &(0x7f0000000240)=[@svc={0x122, 0x40, {0xc5000020, [0x6, 0x3, 0x81, 0x711ec841, 0x8000]}}], 0x40}, &(0x7f0000000740)=[@featur1={0x1, 0x43}], 0x1) r16 = syz_kvm_add_vcpu$arm64(r15, &(0x7f0000000780)={0x0, 0x0}, &(0x7f00000007c0)=[@featur2={0x1, 0x2}], 0x1) ioctl$KVM_RUN(r16, 0xae80, 0x0) ioctl$KVM_RUN(r16, 0xae80, 0x0) 0s ago: executing program 37 (id=68): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x930, 0x280000b, 0x11, r2, 0x0) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000001c0)="fb0149dd833be3ac2cc4a29ea6abf4e7454e37c4b85400005a9610fbff67521ce16f8faa767969d22627e700", 0x0, 0x48) r4 = ioctl$KVM_GET_STATS_FD_vm(r1, 0xaece) ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r4, 0x4018aee3, &(0x7f0000000080)=@attr_pmu_init) mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0) r5 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0x1a17f2, 0x0) mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x3000003, 0x28031, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_ONE_REG(0xffffffffffffffff, 0x4010aeac, &(0x7f0000000000)=@arm64_sve={0x60800000001501b7, &(0x7f0000000180)=0x5}) ioctl$KVM_CREATE_VM(r5, 0x401c5820, 0x20000007) kernel console output (not intermixed with test programs): [ 365.553847][ T24] audit: type=1400 audit(364.700:74): avc: denied { read } for pid=3225 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 372.837862][ T24] audit: type=1400 audit(371.990:75): avc: denied { write } for pid=3282 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 376.503607][ T24] audit: type=1400 audit(375.630:76): avc: denied { write } for pid=3285 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 378.855005][ T3225] 8021q: adding VLAN 0 to HW filter on device bond0 [ 385.557439][ T24] audit: type=1400 audit(384.670:77): avc: denied { write } for pid=3290 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 389.883152][ T24] audit: type=1400 audit(389.030:78): avc: denied { write } for pid=3293 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 406.516731][ T24] audit: type=1400 audit(405.670:79): avc: denied { write } for pid=3301 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 410.134803][ T24] audit: type=1400 audit(409.280:80): avc: denied { write } for pid=3304 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 412.531111][ T3225] eql: remember to turn off Van-Jacobson compression on your slave devices [ 419.726559][ T24] audit: type=1400 audit(418.850:81): avc: denied { write } for pid=3309 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 423.305960][ T24] audit: type=1400 audit(422.460:82): avc: denied { write } for pid=3312 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 432.213016][ T24] audit: type=1400 audit(431.360:83): avc: denied { write } for pid=3316 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 435.804277][ T24] audit: type=1400 audit(434.930:84): avc: denied { write } for pid=3319 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 444.186595][ T24] audit: type=1400 audit(443.340:85): avc: denied { write } for pid=3323 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 447.716349][ T24] audit: type=1400 audit(446.840:86): avc: denied { write } for pid=3326 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 459.886534][ T24] audit: type=1400 audit(459.040:87): avc: denied { write } for pid=3331 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 464.263725][ T24] audit: type=1400 audit(463.400:88): avc: denied { write } for pid=3334 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 469.041460][ T24] audit: type=1400 audit(468.190:89): avc: denied { write } for pid=3336 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 472.663385][ T24] audit: type=1400 audit(471.740:90): avc: denied { write } for pid=3339 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 481.316505][ T24] audit: type=1400 audit(480.440:91): avc: denied { write } for pid=3343 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 484.811256][ T24] audit: type=1400 audit(483.960:92): avc: denied { write } for pid=3346 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 500.895165][ T24] audit: type=1400 audit(500.040:93): avc: denied { write } for pid=3354 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 504.573397][ T24] audit: type=1400 audit(503.700:94): avc: denied { write } for pid=3357 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 526.775806][ T24] audit: type=1400 audit(525.920:95): avc: denied { write } for pid=3366 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 530.223442][ T24] audit: type=1400 audit(529.370:96): avc: denied { write } for pid=3369 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 535.907667][ T24] audit: type=1400 audit(535.060:97): avc: denied { write } for pid=3372 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 539.581613][ T24] audit: type=1400 audit(538.710:98): avc: denied { write } for pid=3375 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 545.464771][ T24] audit: type=1400 audit(544.550:99): avc: denied { write } for pid=3378 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 548.893234][ T24] audit: type=1400 audit(548.040:100): avc: denied { write } for pid=3381 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '[localhost]:65373' (ED25519) to the list of known hosts. [ 565.014371][ T24] audit: type=1400 audit(564.130:101): avc: denied { name_bind } for pid=3385 comm="sshd-session" src=30000 scontext=system_u:system_r:sshd_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 566.805728][ T24] audit: type=1400 audit(565.940:102): avc: denied { execute } for pid=3386 comm="sh" name="syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 566.837451][ T24] audit: type=1400 audit(565.990:103): avc: denied { execute_no_trans } for pid=3386 comm="sh" path="/syz-executor" dev="vda" ino=1867 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:etc_runtime_t tclass=file permissive=1 [ 596.700016][ T24] audit: type=1400 audit(595.850:104): avc: denied { mounton } for pid=3386 comm="syz-executor" path="/syzcgroup/unified" dev="vda" ino=1869 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 596.737010][ T24] audit: type=1400 audit(595.880:105): avc: denied { mount } for pid=3386 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 596.814195][ T3386] cgroup: Unknown subsys name 'net' [ 596.865497][ T24] audit: type=1400 audit(596.010:106): avc: denied { unmount } for pid=3386 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 597.246602][ T3386] cgroup: Unknown subsys name 'cpuset' [ 597.357581][ T3386] cgroup: Unknown subsys name 'rlimit' [ 598.110057][ T24] audit: type=1400 audit(597.260:107): avc: denied { setattr } for pid=3386 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 598.133936][ T24] audit: type=1400 audit(597.280:108): avc: denied { mounton } for pid=3386 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 598.155899][ T24] audit: type=1400 audit(597.310:109): avc: denied { mount } for pid=3386 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 599.097129][ T3389] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 599.111565][ T24] audit: type=1400 audit(598.250:110): avc: denied { relabelto } for pid=3389 comm="mkswap" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 599.141154][ T24] audit: type=1400 audit(598.290:111): avc: denied { write } for pid=3389 comm="mkswap" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" Setting up swapspace version 1, size = 127995904 bytes [ 599.309790][ T24] audit: type=1400 audit(598.460:112): avc: denied { read } for pid=3386 comm="syz-executor" name="swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 599.330912][ T24] audit: type=1400 audit(598.480:113): avc: denied { open } for pid=3386 comm="syz-executor" path="/swap-file" dev="vda" ino=1872 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 599.385504][ T3386] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 651.704541][ T24] audit: type=1400 audit(650.850:114): avc: denied { execmem } for pid=3390 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 655.034683][ T24] audit: type=1400 audit(654.170:115): avc: denied { read } for pid=3392 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 655.035621][ T24] audit: type=1400 audit(654.180:116): avc: denied { open } for pid=3393 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 655.125423][ T24] audit: type=1400 audit(654.250:117): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/" dev="vda" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 655.330983][ T24] audit: type=1400 audit(654.480:118): avc: denied { module_request } for pid=3393 comm="syz-executor" kmod="netdev-nr1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 655.366939][ T24] audit: type=1400 audit(654.520:119): avc: denied { module_request } for pid=3392 comm="syz-executor" kmod="netdev-nr0" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 656.295230][ T24] audit: type=1400 audit(655.440:120): avc: denied { sys_module } for pid=3392 comm="syz-executor" capability=16 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 662.541602][ T24] audit: type=1400 audit(661.680:121): avc: denied { create } for pid=3393 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 663.084731][ T24] audit: type=1400 audit(662.230:122): avc: denied { write } for pid=3393 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 663.278429][ T3392] rdma_rxe: rxe_newlink: failed to add rxe_eth0 [ 663.289742][ T3393] rxe_eth0 speed is unknown, defaulting to 1000 [ 663.335020][ T24] audit: type=1400 audit(662.430:123): avc: denied { read } for pid=3392 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1 [ 663.389745][ T3393] rxe_eth0 speed is unknown, defaulting to 1000 [ 663.480455][ T3393] rxe_eth0 speed is unknown, defaulting to 1000 [ 671.436494][ T3393] infiniband rxe0: set active [ 671.439496][ T916] rxe_eth0 speed is unknown, defaulting to 1000 [ 671.441303][ T3393] infiniband rxe0: added rxe_eth0 [ 672.519678][ T3393] RDS/IB: rxe0: added [ 672.547766][ T3393] smc: adding ib device rxe0 with port count 1 [ 672.549117][ T3393] smc: ib device rxe0 port 1 has no pnetid [ 672.561505][ T916] rxe_eth0 speed is unknown, defaulting to 1000 [ 672.645195][ T3393] rxe_eth0 speed is unknown, defaulting to 1000 [ 679.490673][ T3393] rxe_eth0 speed is unknown, defaulting to 1000 [ 681.646256][ T916] rxe_eth0 speed is unknown, defaulting to 1000 [ 684.563810][ T24] audit: type=1400 audit(683.680:124): avc: denied { write } for pid=3435 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 685.877488][ T3392] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 686.261216][ T3392] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 687.581428][ T24] audit: type=1400 audit(686.730:125): avc: denied { write } for pid=3438 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 702.640463][ T3392] hsr_slave_0: entered promiscuous mode [ 702.734186][ T3392] hsr_slave_1: entered promiscuous mode [ 707.115263][ T3393] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 707.443737][ T3393] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 710.464525][ T24] audit: type=1400 audit(709.610:126): avc: denied { create } for pid=3392 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 710.485356][ T24] audit: type=1400 audit(709.620:127): avc: denied { write } for pid=3392 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 710.543989][ T24] audit: type=1400 audit(709.680:128): avc: denied { read } for pid=3392 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 710.648688][ T3392] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 710.855804][ T3392] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 710.918851][ T3392] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 711.046024][ T3392] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 711.071396][ T3392] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 711.205120][ T3392] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 711.230545][ T3392] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 711.354612][ T3392] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 719.971003][ T3393] hsr_slave_0: entered promiscuous mode [ 719.999713][ T3393] hsr_slave_1: entered promiscuous mode [ 720.044441][ T3393] debugfs: 'hsr0' already exists in 'hsr' [ 720.045821][ T3393] Cannot create hsr debugfs directory [ 723.146057][ T3392] 8021q: adding VLAN 0 to HW filter on device bond0 [ 726.869372][ T3393] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 727.025739][ T3393] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 727.075539][ T3393] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 727.197698][ T3393] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 727.237121][ T3393] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 727.351138][ T3393] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 727.445562][ T3393] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 727.550697][ T3393] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 740.641074][ T3393] 8021q: adding VLAN 0 to HW filter on device bond0 [ 774.289161][ T3392] veth0_vlan: entered promiscuous mode [ 774.737273][ T3392] veth1_vlan: entered promiscuous mode [ 776.426977][ T3392] veth0_macvtap: entered promiscuous mode [ 776.633365][ T3392] veth1_macvtap: entered promiscuous mode [ 778.684484][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.686208][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.686811][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 778.687428][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 780.681566][ T24] audit: type=1400 audit(779.830:129): avc: denied { mount } for pid=3392 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 780.819857][ T24] audit: type=1400 audit(779.960:130): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/syzkaller.8rPYz9/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 781.065483][ T24] audit: type=1400 audit(780.210:131): avc: denied { mount } for pid=3392 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 781.299702][ T24] audit: type=1400 audit(780.450:132): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/syzkaller.8rPYz9/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 781.421423][ T24] audit: type=1400 audit(780.570:133): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/syzkaller.8rPYz9/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=3721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 781.799959][ T24] audit: type=1400 audit(780.920:134): avc: denied { unmount } for pid=3392 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 781.966732][ T24] audit: type=1400 audit(781.110:135): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/dev/gadgetfs" dev="devtmpfs" ino=1548 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:device_t tclass=dir permissive=1 [ 782.021058][ T24] audit: type=1400 audit(781.170:136): avc: denied { mount } for pid=3392 comm="syz-executor" name="/" dev="gadgetfs" ino=3731 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 782.514387][ T24] audit: type=1400 audit(781.660:137): avc: denied { mount } for pid=3392 comm="syz-executor" name="/" dev="binder" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 782.749637][ T24] audit: type=1400 audit(781.770:138): avc: denied { mounton } for pid=3392 comm="syz-executor" path="/sys/fs/fuse/connections" dev="fusectl" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=dir permissive=1 [ 783.746892][ T3392] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 791.528588][ T24] kauditd_printk_skb: 4 callbacks suppressed [ 791.528923][ T24] audit: type=1400 audit(790.650:143): avc: denied { read } for pid=3558 comm="syz.0.1" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 791.578896][ T24] audit: type=1400 audit(790.730:144): avc: denied { open } for pid=3558 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 791.995727][ T3393] veth0_vlan: entered promiscuous mode [ 792.035303][ T24] audit: type=1400 audit(791.170:145): avc: denied { ioctl } for pid=3558 comm="syz.0.1" path="/dev/kvm" dev="devtmpfs" ino=84 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 792.595298][ T3393] veth1_vlan: entered promiscuous mode [ 795.278710][ T3393] veth0_macvtap: entered promiscuous mode [ 795.638826][ T3393] veth1_macvtap: entered promiscuous mode [ 798.114150][ T31] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.114931][ T31] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.115562][ T31] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 798.116155][ T31] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 805.463864][ T24] audit: type=1400 audit(804.600:146): avc: denied { execute } for pid=3565 comm="syz.0.3" path=2F312F10FBFF67525673312B0104 dev="tmpfs" ino=23 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 810.004864][ T24] audit: type=1400 audit(809.140:147): avc: denied { write } for pid=3569 comm="syz.1.2" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 834.879074][ T24] audit: type=1400 audit(834.030:148): avc: denied { execute } for pid=3581 comm="syz.1.6" path=2F616E6F6E5F6875676570616765202864656C6574656429 dev="hugetlbfs" ino=4177 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 852.655956][ T24] audit: type=1400 audit(851.790:149): avc: denied { append } for pid=3589 comm="syz.0.9" name="kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 894.020374][ T24] audit: type=1400 audit(893.110:150): avc: denied { setattr } for pid=3620 comm="syz.1.18" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 912.305987][ T24] audit: type=1400 audit(911.440:151): avc: denied { create } for pid=3634 comm="syz.1.22" anonclass=[kvm-gmem] scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:sysadm_t tclass=anon_inode permissive=1 [ 913.830067][ T3635] kvm [3635]: Failed to find VMA for hva 0x20d8d000 [ 918.988279][ T24] audit: type=1400 audit(918.130:152): avc: denied { mmap_zero } for pid=3642 comm="syz.0.25" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=memprotect permissive=1 [ 920.767151][ T24] audit: type=1400 audit(919.900:153): avc: denied { ioctl } for pid=3642 comm="syz.0.25" path="net:[4026532629]" dev="nsfs" ino=4026532629 ioctlcmd=0xaea3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 996.376430][ T3702] kvm [3702]: Failed to find VMA for hva 0x20c01000 [ 1033.440606][ T24] audit: type=1400 audit(1032.590:154): avc: denied { map } for pid=3726 comm="syz.0.48" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 1038.039565][ T3731] kvm [3731]: Failed to find VMA for hva 0x20c79000 [ 1139.817731][ T24] audit: type=1400 audit(1138.970:155): avc: denied { write } for pid=3791 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1143.256777][ T24] audit: type=1400 audit(1142.380:156): avc: denied { write } for pid=3794 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1170.199164][ T3797] rxe_eth0 speed is unknown, defaulting to 1000 [ 1180.483696][ T3805] rxe_eth0 speed is unknown, defaulting to 1000 [ 1217.896391][ T3797] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1218.190919][ T3797] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1227.151313][ T3805] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1227.367077][ T3805] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1242.684952][ T3797] hsr_slave_0: entered promiscuous mode [ 1242.749957][ T3797] hsr_slave_1: entered promiscuous mode [ 1242.845967][ T3797] debugfs: 'hsr0' already exists in 'hsr' [ 1242.846351][ T3797] Cannot create hsr debugfs directory [ 1250.725318][ T3861] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1253.625535][ T3861] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1256.881909][ T3861] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1257.547882][ T3805] hsr_slave_0: entered promiscuous mode [ 1257.626452][ T3805] hsr_slave_1: entered promiscuous mode [ 1257.684133][ T3805] debugfs: 'hsr0' already exists in 'hsr' [ 1257.684512][ T3805] Cannot create hsr debugfs directory [ 1259.807130][ T3861] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1276.210558][ T3861] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1276.379115][ T3861] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1276.480874][ T3861] bond0 (unregistering): Released all slaves [ 1279.504174][ T3797] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1279.931118][ T3797] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1283.415625][ T3797] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1283.830935][ T3797] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1283.990005][ T3797] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1284.291003][ T3797] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1286.119380][ T3797] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1286.524330][ T3797] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1294.754024][ T3861] hsr_slave_0: left promiscuous mode [ 1294.834773][ T3861] hsr_slave_1: left promiscuous mode [ 1295.453660][ T3861] veth1_macvtap: left promiscuous mode [ 1295.454901][ T3861] veth0_macvtap: left promiscuous mode [ 1295.469500][ T3861] veth1_vlan: left promiscuous mode [ 1295.471273][ T3861] veth0_vlan: left promiscuous mode [ 1295.809665][ T24] audit: type=1400 audit(1294.950:157): avc: denied { write } for pid=3878 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1302.465248][ T24] audit: type=1400 audit(1301.610:158): avc: denied { write } for pid=3884 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1323.477959][ T3225] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1326.319880][ T3805] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1326.896117][ T3805] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1327.121081][ T3805] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1327.490823][ T3805] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1327.651211][ T3805] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1328.118316][ T3805] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1328.294355][ T3805] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1328.587814][ T3805] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1341.181193][ T24] audit: type=1400 audit(1340.330:159): avc: denied { write } for pid=3902 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1342.378512][ T3797] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1349.408442][ T24] audit: type=1400 audit(1348.560:160): avc: denied { write } for pid=3909 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1354.588668][ T3805] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1355.228915][ T3225] 8021q: adding VLAN 0 to HW filter on device eth2 [ 1373.468358][ T24] audit: type=1400 audit(1372.610:161): avc: denied { write } for pid=3923 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1384.009805][ T24] audit: type=1400 audit(1383.160:162): avc: denied { write } for pid=3932 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1390.569653][ T3225] 8021q: adding VLAN 0 to HW filter on device eth3 [ 1407.634436][ T24] audit: type=1400 audit(1406.710:163): avc: denied { write } for pid=3947 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1415.371117][ T24] audit: type=1400 audit(1414.520:164): avc: denied { write } for pid=3957 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1420.739982][ T3225] 8021q: adding VLAN 0 to HW filter on device eth4 [ 1452.814362][ T3797] veth0_vlan: entered promiscuous mode [ 1453.918200][ T3797] veth1_vlan: entered promiscuous mode [ 1457.587496][ T3797] veth0_macvtap: entered promiscuous mode [ 1458.175791][ T3797] veth1_macvtap: entered promiscuous mode [ 1461.404732][ T31] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1461.406023][ T31] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1461.406630][ T31] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1461.407218][ T31] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1467.743094][ T3805] veth0_vlan: entered promiscuous mode [ 1469.125930][ T3805] veth1_vlan: entered promiscuous mode [ 1470.018068][ T24] audit: type=1400 audit(1469.150:165): avc: denied { write } for pid=3993 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1472.434032][ T3805] veth0_macvtap: entered promiscuous mode [ 1473.141148][ T3805] veth1_macvtap: entered promiscuous mode [ 1476.764280][ T31] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1476.773890][ T3924] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1476.774604][ T3924] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1476.775208][ T3924] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1480.824046][ T24] audit: type=1400 audit(1479.950:166): avc: denied { write } for pid=3998 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1498.996452][ T24] audit: type=1400 audit(1498.140:167): avc: denied { write } for pid=4007 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1508.554896][ T24] audit: type=1400 audit(1507.700:168): avc: denied { write } for pid=4017 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1519.716209][ T24] audit: type=1400 audit(1518.850:169): avc: denied { write } for pid=4021 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1524.163791][ T24] audit: type=1400 audit(1523.310:170): avc: denied { write } for pid=4024 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1535.855092][ T24] audit: type=1400 audit(1535.000:171): avc: denied { write } for pid=4028 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1542.143298][ T24] audit: type=1400 audit(1541.250:172): avc: denied { write } for pid=4032 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1565.561424][ T24] audit: type=1400 audit(1564.710:173): avc: denied { write } for pid=4044 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1574.788577][ T24] audit: type=1400 audit(1573.910:174): avc: denied { write } for pid=4054 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 1576.281698][ T4034] rxe_eth0 speed is unknown, defaulting to 1000 [ 1587.027796][ T4038] rxe_eth0 speed is unknown, defaulting to 1000 [ 1634.706765][ T4034] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1635.049765][ T4034] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1645.438787][ T4038] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1645.758830][ T4038] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1661.970708][ T4034] hsr_slave_0: entered promiscuous mode [ 1662.050956][ T4034] hsr_slave_1: entered promiscuous mode [ 1662.117257][ T4034] debugfs: 'hsr0' already exists in 'hsr' [ 1662.117630][ T4034] Cannot create hsr debugfs directory [ 1675.979763][ T4038] hsr_slave_0: entered promiscuous mode [ 1676.079831][ T4038] hsr_slave_1: entered promiscuous mode [ 1676.216305][ T4038] debugfs: 'hsr0' already exists in 'hsr' [ 1676.216684][ T4038] Cannot create hsr debugfs directory [ 1687.049874][ T4034] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1687.268111][ T4034] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1687.665643][ T4034] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1687.848470][ T4034] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1688.544539][ T4034] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1688.779767][ T4034] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1689.168474][ T4034] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1689.367306][ T4034] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1700.139992][ T4038] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1700.721061][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1700.800896][ T4038] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1701.419990][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1701.617187][ T4038] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1702.037310][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1702.111265][ T4038] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1702.619790][ T4038] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1721.677135][ T4034] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1731.871140][ T4038] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1855.091690][ T4034] veth0_vlan: entered promiscuous mode [ 1856.666267][ T4034] veth1_vlan: entered promiscuous mode [ 1860.586211][ T4034] veth0_macvtap: entered promiscuous mode [ 1861.596726][ T4034] veth1_macvtap: entered promiscuous mode [ 1865.754541][ T48] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1865.788114][ T4144] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1865.788743][ T4144] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1865.789255][ T4144] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1870.665010][ T4038] veth0_vlan: entered promiscuous mode [ 1872.908210][ T4038] veth1_vlan: entered promiscuous mode [ 1878.075836][ T4038] veth0_macvtap: entered promiscuous mode [ 1878.929208][ T4038] veth1_macvtap: entered promiscuous mode [ 1883.425006][ T42] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1883.425772][ T42] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1883.426372][ T42] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1883.426940][ T42] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1984.401571][ T4215] rxe_eth0 speed is unknown, defaulting to 1000 [ 2000.926946][ T4217] rxe_eth0 speed is unknown, defaulting to 1000 [ 2008.251894][ T24] audit: type=1400 audit(2007.400:175): avc: denied { write } for pid=4233 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2016.623735][ T24] audit: type=1400 audit(2015.740:176): avc: denied { write } for pid=4236 comm="rm" name="hook-state" dev="tmpfs" ino=41 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2068.747045][ T4215] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2069.025630][ T4215] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2082.545110][ T4217] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2082.938813][ T4217] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2108.576704][ T4215] hsr_slave_0: entered promiscuous mode [ 2108.700225][ T4215] hsr_slave_1: entered promiscuous mode [ 2108.810950][ T4215] debugfs: 'hsr0' already exists in 'hsr' [ 2108.811346][ T4215] Cannot create hsr debugfs directory [ 2125.829784][ T4217] hsr_slave_0: entered promiscuous mode [ 2125.930989][ T4217] hsr_slave_1: entered promiscuous mode [ 2125.989903][ T4217] debugfs: 'hsr0' already exists in 'hsr' [ 2125.990273][ T4217] Cannot create hsr debugfs directory [ 2131.885964][ T26] INFO: task syz.2.66:4000 blocked for more than 430 seconds. [ 2131.886775][ T26] Not tainted syzkaller #0 [ 2131.887256][ T26] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2131.887586][ T26] task:syz.2.66 state:D stack:0 pid:4000 tgid:4000 ppid:3797 task_flags:0x400040 flags:0x00000011 [ 2131.890271][ T26] Call trace: [ 2131.890596][ T26] __switch_to+0x5e4/0xb74 (T) [ 2131.891918][ T26] __schedule+0x1e0c/0x38cc [ 2132.051130][ T26] schedule+0x1b4/0x274 [ 2132.051624][ T26] schedule_timeout+0x68/0x1e4 [ 2132.068542][ T26] wait_for_completion+0x1b8/0x414 [ 2132.069047][ T26] __synchronize_srcu+0x1c8/0x208 [ 2132.069328][ T26] synchronize_srcu+0x668/0x8dc [ 2132.069579][ T26] mmu_notifier_unregister+0x33c/0x444 [ 2132.069956][ T26] kvm_put_kvm+0x69c/0xbbc [ 2132.070295][ T26] kvm_vm_release+0x58/0x78 [ 2132.070571][ T26] __fput+0x4ac/0x978 [ 2132.070883][ T26] ____fput+0x20/0x30 [ 2132.071196][ T26] task_work_run+0x1b8/0x250 [ 2132.071525][ T26] exit_to_user_mode_loop+0x110/0x188 [ 2132.071844][ T26] el0_svc+0x18c/0x240 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 2132.144067][ T26] el0t_64_sync_handler+0x68/0xdc [ 2132.144565][ T26] el0t_64_sync+0x198/0x19c [ 2132.210988][ T26] INFO: task syz.3.65:4006 blocked for more than 430 seconds. [ 2132.211382][ T26] Not tainted syzkaller #0 [ 2132.211572][ T26] Blocked by coredump. [ 2132.211676][ T26] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2132.211787][ T26] task:syz.3.65 state:D stack:0 pid:4006 tgid:4006 ppid:3805 task_flags:0x40044c flags:0x00000011 [ 2132.241899][ T26] Call trace: [ 2132.264225][ T26] __switch_to+0x5e4/0xb74 (T) [ 2132.264657][ T26] __schedule+0x1e0c/0x38cc [ 2132.264957][ T26] schedule+0x1b4/0x274 [ 2132.265238][ T26] schedule_timeout+0x68/0x1e4 [ 2132.265566][ T26] wait_for_completion+0x1b8/0x414 [ 2132.265844][ T26] __synchronize_srcu+0x1c8/0x208 [ 2132.266145][ T26] synchronize_srcu+0x668/0x8dc [ 2132.266399][ T26] __mmu_notifier_release+0x688/0x87c [ 2132.266738][ T26] exit_mmap+0xcc/0xb64 [ 2132.267008][ T26] __mmput+0x10c/0x51c [ 2132.267256][ T26] mmput+0x70/0xa8 [ 2132.267518][ T26] exit_mm+0x1e8/0x2fc [ 2132.267836][ T26] do_exit+0x828/0x23d8 [ 2132.268200][ T26] do_group_exit+0x1d4/0x2ac [ 2132.268519][ T26] get_signal+0x13f8/0x1504 [ 2132.268759][ T26] arch_do_signal_or_restart+0x23c/0x4b50 [ 2132.269114][ T26] exit_to_user_mode_loop+0x88/0x188 [ 2132.269426][ T26] el0_svc+0x18c/0x240 [ 2132.269720][ T26] el0t_64_sync_handler+0x68/0xdc [ 2132.270051][ T26] el0t_64_sync+0x198/0x19c [ 2132.270795][ T26] [ 2132.270795][ T26] Showing all locks held in the system: [ 2132.271133][ T26] locks held by kworker/u4:0/12: 2, on CPU#0: [ 2132.271397][ T26] #0: c9f000000dc34140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xadc/0x16b4 [ 2132.467698][ T26] #1: ffff80008d867ce8 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0xafc/0x16b4 [ 2132.468714][ T26] locks held by khungtaskd/26: 1, last CPU#0: [ 2132.468941][ T26] #0: ffff800088afe918 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 [ 2132.469695][ T26] locks held by kworker/u4:2/31: 3, last CPU#0: [ 2132.469891][ T26] #0: c9f000000dc34140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xadc/0x16b4 [ 2132.470613][ T26] #1: ffff80008dbb7ce8 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xafc/0x16b4 [ 2132.471400][ T26] #2: f2f000001fd85258 (&devlink->lock_key){+.+.}-{4:4}, at: devl_trylock+0x24/0x34 [ 2132.586296][ T26] locks held by getty/3253: 2, on CPU#0: [ 2132.586603][ T26] #0: c1f00000134760a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c [ 2132.587528][ T26] #1: 07ff80008d85b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x314/0x11f8 [ 2132.588387][ T26] locks held by syz-executor/3386: 2, last CPU#0: [ 2132.588575][ T26] #0: 4af00000165a4cf8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0xf4/0xb64 [ 2132.589289][ T26] #1: ffff800088afe918 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x50/0x22c [ 2132.590082][ T26] locks held by kworker/u4:8/3551: 2, last CPU#0: [ 2132.590270][ T26] #0: d7f000000dc33d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xadc/0x16b4 [ 2132.591030][ T26] #1: ffff8000a3d47ce8 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xafc/0x16b4 [ 2132.591802][ T26] locks held by syz.0.61/3779: 2, last CPU#0: [ 2132.703692][ T26] #0: ffff800088b4c3f0 (srcu){.+.+}-{0:0}, at: __mmu_notifier_release+0x4e8/0x87c [ 2132.704883][ T26] #1: f2f0000020aa3518 (&kvm->srcu){.+.+}-{0:0}, at: kvm_mmu_notifier_release+0x50/0xc4 [ 2132.705709][ T26] locks held by kworker/u4:7/3863: 3, last CPU#0: [ 2132.705916][ T26] #0: c9f000000dc34140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xadc/0x16b4 [ 2132.706637][ T26] #1: ffff80008f147ce8 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xafc/0x16b4 [ 2132.707415][ T26] #2: 85f00000206dea58 (&devlink->lock_key#4){+.+.}-{4:4}, at: devl_trylock+0x24/0x34 [ 2132.708385][ T26] locks held by kworker/u4:9/3890: 3, last CPU#0: [ 2132.708576][ T26] #0: c9f000000dc34140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xadc/0x16b4 [ 2132.709321][ T26] #1: ffff80008f257ce8 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xafc/0x16b4 [ 2132.710077][ T26] #2: 35f0000020523a58 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_trylock+0x24/0x34 [ 2132.710996][ T26] locks held by syz-executor/4215: 8, last CPU#0: [ 2132.711195][ T26] #0: 2ef00000136d4460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x24c/0xb7c [ 2132.884338][ T26] #1: caf000003178b280 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x258/0x5f8 [ 2132.885323][ T26] #2: c6f0000013023b08 (kn->active#35){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2b8/0x5f8 [ 2132.886194][ T26] #3: ffff800088cb7410 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0xd8/0x5b4 [ 2132.887011][ T26] #4: a4f0000027015928 (&dev->mutex){....}-{4:4}, at: __device_attach+0x4c/0x3f4 [ 2132.887803][ T26] #5: 70f000001fd86258 (&devlink->lock_key#7){+.+.}-{4:4}, at: devl_lock+0x24/0x34 [ 2132.888663][ T26] #6: 90f000002b141720 (&sb->s_type->i_mutex_key#3/1){+.+.}-{4:4}, at: start_dirop+0x60/0xb4 [ 2132.889717][ T26] #7: fff0000074c19ea0 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x364/0x38cc [ 2132.890506][ T26] locks held by udevd/4281: 2, last CPU#0: [ 2132.890692][ T26] #0: b4f000001415c488 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x150/0x41c [ 2132.891511][ T26] #1: ffff800088afe918 (rcu_read_lock){....}-{1:3}, at: __schedule+0x364/0x38cc [ 2133.024272][ T26] locks held by modprobe/4282: 2, last CPU#0: [ 2133.024491][ T26] #0: 55f00000205d2d78 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0xf4/0xb64 [ 2133.025235][ T26] #1: ffff800088afe918 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x50/0x22c [ 2133.116157][ T26] [ 2133.116381][ T26] ============================================= [ 2133.116381][ T26] [ 2133.117197][ T26] Kernel panic - not syncing: hung_task: blocked tasks [ 2133.122039][ T26] CPU: 0 UID: 0 PID: 26 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT [ 2133.123166][ T26] Hardware name: linux,dummy-virt (DT) [ 2133.124155][ T26] Call trace: [ 2133.124934][ T26] show_stack+0x2c/0x3c (C) [ 2133.126045][ T26] __dump_stack+0x30/0x40 [ 2133.127024][ T26] dump_stack_lvl+0x30/0x12c [ 2133.127969][ T26] dump_stack+0x1c/0x28 [ 2133.128892][ T26] vpanic+0x4cc/0x844 [ 2133.129781][ T26] vpanic+0x0/0x844 [ 2133.130642][ T26] hung_task_panic+0x0/0x2c [ 2133.131599][ T26] kthread+0x4cc/0x514 [ 2133.132543][ T26] ret_from_fork+0x10/0x20 [ 2133.134452][ T26] Kernel Offset: disabled [ 2133.135156][ T26] CPU features: 0x0,00000000,00d1802f,df188f42,0afff61f [ 2133.136354][ T26] Memory Limit: none [ 2133.142111][ T26] Rebooting in 86400 seconds..