Extracting prog: 54m51.850135386s
Minimizing prog: 5h23m25.754000367s
Simplifying prog options: 0s
Extracting C: 7m9.788642209s
Simplifying C: 41m19.310504571s


extracting reproducer from 12 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 45s
testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d0, 0x2d)

program did not crash
single: failed to extract reproducer
bisect: bisecting 12 programs with base timeout 45s
testing program (duration=48s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 29, 13, 26, 21, 40, 30, 30, 30, 16, 17, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
openat$kvm(0x0, 0x0, 0x0, 0x0) (async)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) (async)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) (async)
syz_kvm_vgic_v3_setup(r3, 0x1, 0x0)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) (async)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) (async)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0x30}) (async)
ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x7, 0x3}})
executing program 0:
r0 = openat$kvm(0x0, &(0x7f00000002c0), 0x4581c4, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000bc2000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000280)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x8001, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0xa, 0x2, 0x4}}], 0x68}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r1, 0x1, 0x100)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, <r4=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x2, 0xe5a35d514fdba332, &(0x7f0000000340)=0x747})
ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000300)=@attr_other={0x0, 0x80005, 0x6, &(0x7f0000000240)=0x8})
r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r6 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x1000003, 0x4000010, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_uexit$arm64(r6, 0xfffffffffffffffe)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_uexit$arm64(r6, 0xffffffffffffffff)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000c52000/0x4000)=nil, 0x0, 0x1000002, 0x2010, r3, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r8 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x1)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
r11 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000000000/0x400000)=nil)
r12 = openat$kvm(0x0, &(0x7f0000000040), 0x8040, 0x0)
r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil)
r14 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffc72}, 0x0, 0x46)
ioctl$KVM_GET_ONE_REG(r14, 0x4010aeab, &(0x7f0000000180)=@arm64_fp_extra={0x60200000001000d5, &(0x7f0000000380)=0x2a})
ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x101, 0x100, &(0x7f00000003c0)=0x100000000})
mmap$KVM_VCPU(&(0x7f0000c6a000/0x4000)=nil, r5, 0x3000000, 0x810, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, 0x0})
ioctl$KVM_CAP_PTP_KVM(r3, 0x4068aea3, &(0x7f0000000000))
r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_GUEST_DEBUG_arm64(r5, 0x4208ae9b, &(0x7f0000000240)={0x20003, 0x0, {[0x97ab, 0x10001, 0x3, 0xc08d, 0x8, 0xffffffff00000001, 0x3b880, 0x400, 0x5, 0x2, 0x6, 0x5, 0x2, 0x8, 0x6, 0x7fff], [0x45e1, 0x8000, 0x5d2, 0xfff, 0xbb9, 0x0, 0x8, 0xe, 0x51bb, 0x8, 0x4d681830, 0x9, 0x3, 0x10000, 0x7, 0xfffffffffffffff6], [0x80000001, 0xfffffffffffffffe, 0xa3, 0x0, 0x8, 0x81, 0x6, 0xfda8, 0x401, 0x5fd6, 0x3, 0x0, 0x40, 0x4, 0xffffffff, 0x9], [0x3, 0x6, 0xe99, 0xe, 0x9, 0x7, 0x8, 0x0, 0xb, 0x2, 0x10, 0x4, 0x9, 0x9, 0xc, 0x6]}})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31)
r4 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000ab8000/0x400000)=nil)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000040)={0x66c, 0x10001})
r7 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x29)
syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000340)=[@its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x3, 0x10, 0x8, 0x8, 0x2}}, @svc={0x122, 0x40, {0x100, [0x9, 0x7030, 0x3, 0x5, 0x4]}}, @code={0xa, 0x6c, {"008008d50044207e0000809a007008d5006c200e007c001b20ec99d20040b8f2810180d2e20180d2230180d2240180d2020000d4a0a19dd20080b0f2810180d2620080d2630080d2640080d2020000d40820601e000008d5"}}], 0xd4}, 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1)
r10 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r9, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r9, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x202, 0x2, 0x1, 0x1000, &(0x7f0000ffc000/0x1000)=nil})
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
r11 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r8, r11, &(0x7f0000aec000/0x400000)=nil, &(0x7f00000001c0)=[{0x0, &(0x7f0000000440)=[@code={0xa, 0x54, {"0000403a000008d5000008d580d69fd200c0b0f2610080d2020080d2430180d2040180d2020000d400a8a15e00709f0c007008d500004093008008d5007008d5"}}, @mrs={0xbe, 0x18, {0x5eb7}}, @uexit={0x0, 0x18, 0xa}, @hvc={0x32, 0x40, {0x8600ff01, [0x7, 0x700, 0xdf, 0x40, 0x9fc]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x40, 0x3}}, @hvc={0x32, 0x40, {0x80000000, [0x2c5d, 0x1, 0x3, 0xc, 0x4]}}, @its_setup={0x82, 0x28, {0x4, 0x0, 0x3d5}}, @smc={0x1e, 0x40, {0xc5000020, [0x5, 0x7e, 0xfffffffffffffff9, 0xffffffffffffffff, 0x1]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x1, 0x5, 0x1, 0xf6, 0x4}}], 0x1c4}], 0x1, 0x0, &(0x7f0000000180)=[@featur2={0x1, 0x35}], 0x1)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fb707cd24b7eebb20700000000000000000000000100", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0)
r4 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0)
close(r4)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x3d)
r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil)
mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0)
r8 = mmap$KVM_VCPU(&(0x7f0000edf000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)
ioctl$KVM_CAP_HALT_POLL(r6, 0x4068aea3, &(0x7f0000000100)={0xb6, 0x0, 0x81})
r9 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x18, {"7f2003d5"}}], 0x18}, 0x0, 0x0)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r11, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x0, 0x1}})
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x583442, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@msr={0x14, 0x20, {0x603000000013c65d, 0xf}}], 0x20}, 0x0, 0x0)
r4 = ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece)
ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000180)={0x7, 0x6})
ioctl$KVM_GET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000140)=@attr_other={0x0, 0x5, 0x100000001, &(0x7f0000000000)=0x69})
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) (async)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000)
openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) (async)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r8, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) (async)
mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r8, 0x100000d, 0x32, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
r9 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) (async)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000)
r10 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r10, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0)=[{0x0, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1, @ANYBLOB="a9e5d3a2b088f8da54a977a39e01f58440fa51f19b696fa7ef071c1298f19b", @ANYRES32=r5, @ANYRES8=r6, @ANYRES64=r9, @ANYRES32=r8], 0xfffffe0b}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13) (async)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13)
syz_kvm_vgic_v3_setup(r6, 0x1, 0x100)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x15)
executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25)
ioctl$KVM_CAP_HALT_POLL(r0, 0x4068aea3, &(0x7f0000000240)={0xb6, 0x0, 0x800000000000001})
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r2, 0x3, 0xa0)
mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0)
r5 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f0000000000)=@x86={0x79, 0x2, 0xed, 0x0, 0x8, 0x3c, 0x6, 0x1, 0x2, 0x8, 0xfc, 0x40, 0x0, 0x0, 0x0, 0x1, 0x6, 0x6, 0x35, '\x00', 0x7, 0xde3e})
r10 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x27)
r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x2000000000001}}], 0x28}, 0x0, 0x0)
r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r14, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x16, 0x4, 0x1}})
r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r14, r15, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000240)=[@hvc={0x32, 0x40, {0x8600ff01, [0x7, 0x9, 0x8, 0xfffffffffffffff8, 0x100]}}], 0x40}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r15, 0xae80, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x8, <r16=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r16, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000})
ioctl$KVM_GET_REG_LIST(r12, 0xc008aeb0, &(0x7f0000000140)={0x3, [0x7, 0xe80, 0x2]})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
executing program 0:
r0 = mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0)
r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x28)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r5, 0x4004ae8b, &(0x7f00000000c0))
syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000000)="2bf7df8a2e93341528bc2d9738821d0e8d9c4220af6aca36268066e05da47c6f4da2527d0a0fd5b3e5b29d5b28a868c1917e0e57fbee2a6993cef0a218865e6fb212a647992b286d", 0x0, 0x48)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000b80)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000002, [0x99b, 0x100000001, 0x5, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000000000000000000002"])
r12 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, &(0x7f00000013c0)=[@code={0xa, 0x84, {"c0f490d20080b8f2e10080d2220180d2430180d2e40080d2020000d400c0271e007008d5007008d5000080d2007008d50018000ea07385d20040b0f2c10180d2a20180d2e30180d2440080d2020000d400f29ed200c0b8f2210080d2a20180d2830180d2440180d2020000d40000803c"}}, @irq_setup={0x46, 0x18, {0x4, 0xe}}, @eret={0xe6, 0x18, 0x3}, @eret={0xe6, 0x18, 0x7}, @hvc={0x32, 0x40, {0xffff, [0x3, 0x5, 0x7, 0x1b, 0x5]}}, @smc={0x1e, 0x40, {0x40000000, [0x9, 0x2, 0x8000, 0x6, 0x80000003]}}, @hvc={0x32, 0x40, {0x84000003, [0xa, 0x2, 0x8, 0x200, 0x2]}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x26f}}, @hvc={0x32, 0x40, {0x84000002, [0x9, 0x1, 0x9, 0x0, 0x8]}}, @hvc={0x32, 0x40, {0x6000000, [0x1, 0xfffffffffffffff9, 0x4, 0xa, 0x7]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffd0, 0x5, 0x2}}, @its_setup={0x82, 0x28, {0x2, 0x2}}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0x2000000, [0xf15, 0x401, 0x0, 0x4, 0x1ff]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x10, 0xfffffff7, 0xff, 0x2}}, @irq_setup={0x46, 0x18, {0x2, 0x1bd}}, @code={0xa, 0xb4, {"804f97d20020b8f2610080d2e20080d2030180d2c40180d2020000d4007008d5007008d500d8217e000400bc008284d200c0b8f2210080d2220180d2e30180d2640180d2020000d4c0bd93d200e0b8f2c10180d2e20180d2c30080d2a40180d2020000d4607b85d20040b0f2010180d2a20080d2230080d2240180d2020000d40080001bc09b9cd20000b8f2e10080d2820080d2430080d2c40080d2020000d4"}}, @hvc={0x32, 0x40, {0xc4000011, [0x3, 0x6, 0xf800000000000000, 0xfffffffffffffffd, 0x8001]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x2, 0x280, 0x0, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x4, 0x21a}}, @eret={0xe6, 0x18}, @svc={0x122, 0x40, {0x400, [0xffffffffffffffff, 0x6, 0x4, 0x51, 0x1000]}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x33f}}, @smc={0x1e, 0x40, {0x10c0000eb, [0x4, 0x8, 0x5, 0x3, 0xff]}}, @its_setup={0x82, 0x28, {0x1, 0x4, 0x1cc}}, @irq_setup={0x46, 0x18, {0x2, 0x78}}, @irq_setup={0x46, 0x18, {0x0, 0xcd}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x1, 0x0, 0xb, 0x7fffffff, 0x2, 0x1}}, @hvc={0x32, 0x40, {0x84000052, [0xdcdf, 0x195a, 0x8, 0x8, 0x7]}}, @smc={0x1e, 0x40, {0xc4000005, [0xbb, 0x2, 0x9, 0x2, 0x10]}}, @msr={0x14, 0x20, {0x0, 0x3}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x3, 0x3, 0xa, 0xa, 0x1}}], 0x670}, &(0x7f0000000100)=[@featur1={0x1, 0x44}], 0x1)
r13 = mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, 0x930, 0x700000d, 0x80031, r12, 0x0)
ioctl$KVM_CREATE_GUEST_MEMFD(r11, 0xc040aed4, &(0x7f0000000140)={0x1, 0xe24})
r14 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r15, 0xae60)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
r16 = openat$kvm(0x0, &(0x7f0000000040), 0x800, 0x0)
r17 = ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0)
r18 = syz_kvm_setup_syzos_vm$arm64(r17, &(0x7f0000c00000/0x400000)=nil)
r19 = syz_kvm_add_vcpu$arm64(r18, &(0x7f00000002c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r19, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004a, &(0x7f0000000100)=0xffffffffffffffff})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, &(0x7f0000000000)={0x1, 0x40})
ioctl$KVM_SET_GUEST_DEBUG_arm64(0xffffffffffffffff, 0x4208ae9b, &(0x7f0000000040)={0x0, 0x0, {[0x9, 0x1ff, 0x7, 0xf, 0x4, 0x2986, 0x7fffffffffffffff, 0x400, 0xf, 0xb, 0x7fffffffffffffff, 0xb, 0x3, 0x3, 0x5, 0x1], [0x1, 0xffff, 0x8c, 0x3, 0x9, 0x0, 0x101, 0x1, 0x9ee, 0x4, 0x2e5c, 0x7f, 0xfc6, 0x0, 0x6, 0x8], [0x58, 0x3, 0x100000001, 0x8, 0xa, 0x2, 0x0, 0x7, 0x2, 0x7, 0x4, 0x1ff, 0x5, 0x72, 0x3, 0x4], [0xecb, 0xffffffff, 0x4, 0x4, 0x9, 0x5, 0x0, 0x2, 0x4, 0x6439d3b1, 0xc, 0x100000001, 0x1, 0x14, 0x6, 0x4]}})
r0 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000a40)={0x0, &(0x7f0000000280)=[@msr={0x14, 0x20, {0x6030000000138027, 0x10001}}, @smc={0x1e, 0x40, {0x31000000, [0x401, 0x6, 0x19e, 0x8f8, 0x6]}}, @irq_setup={0x46, 0x18, {0x4, 0x28b}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x4, 0xd, 0x5e9e1da6, 0x8, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x146}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x4, 0x5, 0x8, 0x7, 0x3}}, @its_setup={0x82, 0x28, {0x3, 0x1, 0xc1}}, @code={0xa, 0x6c, {"007008d5c09b8dd20040b0f2210180d2e20080d2430080d2840180d2020000d45f3003d5000820bc000008d5008008d5007008d500c8217e800796d20020b8f2810180d2220180d2430080d2440180d2020000d40060df0d"}}, @mrs={0xbe, 0x18, {0x603000000013dea0}}, @eret={0xe6, 0x18, 0x4}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x2a0}}, @code={0xa, 0xcc, {"c0559ad20040b8f2c10180d2c20180d2630180d2e40180d2020000d4202194d200e0b8f2e10080d2020180d2a30080d2e40080d2020000d4a0fe9ed20080b0f2210080d2420080d2030180d2e40080d2020000d4000028d5000028d50080400c405d89d20080b0f2210080d2e20180d2830180d2e40080d2020000d40074007f00fa91d200c0b0f2c10080d2420180d2a30180d2e40180d2020000d4e0db96d20060b0f2810180d2c20180d2830080d2440080d2020000d4"}}, @code={0xa, 0x6c, {"0098a10e007008d500a4002f007008d5007008d5005c86d20020b8f2a10080d2c20080d2030080d2a40080d2020000d4000820fc007008d5201f8ed20080b0f2c10180d2220080d2e30080d2640180d2020000d4007008d5"}}, @svc={0x122, 0x40, {0x84000008, [0x9b1, 0x81, 0x9, 0x5, 0x4]}}, @uexit={0x0, 0x18, 0x5}, @mrs={0xbe, 0x18, {0x6030000000138036}}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x2b4}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x35c}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x4, 0x7, 0x1, 0xff, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xd00, 0xdd, 0x6}}, @msr={0x14, 0x20, {0x603000000013f687, 0xfffffffffffffffd}}, @code={0xa, 0xb4, {"0040800c40e581d200e0b8f2e10080d2c20080d2830180d2840080d2020000d4000028d50000249e00f586d20000b8f2e10080d2620180d2230180d2a40080d2020000d400ac83d20080b8f2410080d2e20180d2830180d2840080d2020000d4007008d580a988d200e0b0f2210180d2a20180d2230180d2440180d2020000d4205a9ad200a0b0f2010080d2420080d2a30180d2640080d2020000d400009f0c"}}, @its_setup={0x82, 0x28, {0x0, 0x4, 0x1cc}}, @code={0xa, 0xcc, {"60da89d20000b0f2e10080d2420180d2830180d2440180d2020000d4007008d5000028d5000040a8805797d20020b0f2c10080d2820180d2030080d2840180d2020000d4003193d20040b8f2010080d2420080d2c30080d2a40180d2020000d460538fd200e0b0f2a10080d2e20080d2430080d2c40080d2020000d4004d8dd20060b8f2c10080d2620180d2630180d2c40180d2020000d4809390d200c0b0f2c10080d2620080d2c30080d2e40080d2020000d4000008d5"}}, @irq_setup={0x46, 0x18, {0x4, 0x32b}}, @irq_setup={0x46, 0x18, {0x4, 0x3d1}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x800, [0x9, 0x0, 0x1, 0xa, 0x6]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe0, 0x9, 0x1}}, @svc={0x122, 0x40, {0x80007fff, [0x200, 0x81, 0x4, 0x7]}}, @code={0xa, 0x9c, {"a03293d200a0b0f2c10080d2020180d2030080d2840080d2020000d4000008d5805285d20020b0f2810080d2e20080d2230180d2240080d2020000d4e05398d20040b8f2810180d2a20180d2230080d2840080d2020000d4007008d5007008d5a05693d200a0b8f2a10080d2820080d2030080d2a40180d2020000d40048c01a1f00002b00b0000f"}}], 0x788}, &(0x7f0000000a80)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, r1, 0x0, 0x110, r0, 0x0)
ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000ac0)={0x401, 0x2})
ioctl$KVM_ARM_VCPU_INIT(r0, 0x4020aeae, &(0x7f0000000b00)={0x4, 0x8})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x2000, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x7)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_ARM_VCPU_INIT(r0, 0x4020aeae, &(0x7f0000000b80))
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r0, 0x4018aee1, &(0x7f0000000c00)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000bc0)=0x1f})
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r0, 0x4018aee3, &(0x7f0000000c80)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000c40)={0xff80, 0x2}})
ioctl$KVM_CAP_ARM_MTE(r3, 0x4068aea3, &(0x7f0000000cc0))
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000010c0)={0x0, &(0x7f0000000d40)=[@eret={0xe6, 0x18, 0x2}, @smc={0x1e, 0x40, {0x84000000, [0x6, 0xd32d, 0x2, 0x3, 0x5]}}, @irq_setup={0x46, 0x18, {0x3, 0x347}}, @smc={0x1e, 0x40, {0x2, [0x2, 0xce6, 0x6, 0x3, 0x1]}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x3, 0xb, 0x81, 0xff, 0x2}}, @hvc={0x32, 0x40, {0x84000006, [0x86, 0x5, 0x7fffffff, 0x6, 0x9]}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x0, 0x6, 0x0, 0x9, 0x1}}, @mrs={0xbe, 0x18, {0x603000000013e2b0}}, @svc={0x122, 0x40, {0x84000004, [0x8, 0x0, 0x4, 0xd, 0x3ff800000000]}}, @eret={0xe6, 0x18, 0x5}, @svc={0x122, 0x40, {0x84000011, [0x0, 0x3, 0x60, 0x80000001, 0x40c80eb9]}}, @eret={0xe6, 0x18, 0x4}, @eret={0xe6, 0x18, 0x4}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x4d}}, @code={0xa, 0xcc, {"005683d20000b8f2c10080d2a20180d2830180d2440180d2020000d400d096d200e0b8f2610080d2c20180d2430180d2e40180d2020000d4800e91d20020b8f2610080d2620180d2830080d2240180d2020000d40074005f607c8ed200e0b0f2810180d2620180d2030180d2a40080d2020000d4007008d5408a83d20080b8f2e10180d2420180d2830180d2840180d2020000d400000048000028d5801688d20060b0f2410180d2e20180d2030180d2440080d2020000d4"}}, @msr={0x14, 0x20, {0x301800000009ef4a, 0x100000000}}, @uexit={0x0, 0x18, 0x5}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x200, 0x7}}], 0x37c}, &(0x7f0000001100)=[@featur1={0x1, 0xc1}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000001180)=@attr_other={0x0, 0x7, 0x72, &(0x7f0000001140)=0xfad})
ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f00000011c0)={0x0, 0x1})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1)
mmap$KVM_VCPU(&(0x7f0000fee000/0x4000)=nil, r1, 0x1000002, 0x110, r6, 0x0)
r7 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000001440)={0x0, &(0x7f0000001200)=[@memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x14, 0x5, 0x4}}, @svc={0x122, 0x40, {0xc4000001, [0xfff, 0x1, 0x317, 0x7, 0x2]}}, @svc={0x122, 0x40, {0x40, [0x1, 0x8, 0x9b, 0x8, 0x9]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0xabec, 0xe47, 0x75, 0x40]}}, @irq_setup={0x46, 0x18, {0x3, 0x269}}, @svc={0x122, 0x40, {0xc4000003, [0x8, 0x8000000000000001, 0x853f, 0x41fe, 0x8]}}, @its_setup={0x82, 0x28, {0x3, 0x3, 0x231}}, @smc={0x1e, 0x40, {0x84000004, [0x9, 0x3, 0xd, 0x100, 0x7]}}, @memwrite={0x6e, 0x30, @generic={0xeeef0000, 0x7b8, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x0, 0xb, 0xbaa, 0x79e, 0x2}}], 0x208}, &(0x7f0000001480)=[@featur2={0x1, 0x2}], 0x1)
ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f00000014c0)={0x5, 0x44})
ioctl$KVM_HAS_DEVICE_ATTR_vm(r3, 0x4018aee3, &(0x7f0000001540)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001500)={0x7, 0x3}})
r8 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000001b00)={0x0, &(0x7f0000001580)=[@svc={0x122, 0x40, {0x84000011, [0x4, 0x81, 0x9, 0x7fffffffffffffff]}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0xd3}}, @uexit={0x0, 0x18, 0x292cf29f}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x400, 0x6}}, @irq_setup={0x46, 0x18, {0x1, 0x2bb}}, @its_setup={0x82, 0x28, {0x3, 0x2, 0x130}}, @smc={0x1e, 0x40, {0x84000000, [0x8001, 0x8000000000000001, 0x8000, 0x6, 0xc8]}}, @smc={0x1e, 0x40, {0x84000053, [0x545, 0x0, 0x9, 0x1, 0x61b1]}}, @code={0xa, 0x84, {"007008d5007008d5603697d20000b8f2a10180d2620080d2430180d2040180d2020000d4000028d5007008d5008383d200a0b0f2410080d2220080d2030080d2840080d2020000d4000000100094000f00f8b02e208292d200c0b8f2610080d2e20180d2c30180d2040180d2020000d4"}}, @hvc={0x32, 0x40, {0x84000007, [0x86, 0x7ff, 0x2, 0x5f9b, 0x7]}}, @svc={0x122, 0x40, {0x80008000, [0xf7, 0x4, 0x7, 0x886, 0x64f24cf2]}}, @msr={0x14, 0x20, {0xc06000000027dd57, 0xd98c}}, @hvc={0x32, 0x40, {0xc400000d, [0xfffffffffffffff7, 0x80000000, 0x6, 0x1000, 0x100000001]}}, @code={0xa, 0x84, {"0000802d008008d5007008d5407a88d200c0b0f2810080d2420180d2430180d2240080d2020000d40000004b000008d5e0638bd200c0b8f2010080d2e20180d2c30080d2a40180d2020000d400b4207e60db8fd20040b0f2a10080d2a20080d2e30080d2440080d2020000d40044205e"}}, @uexit={0x0, 0x18, 0x6}, @svc={0x122, 0x40, {0x84000010, [0x1, 0x100000000, 0x7f, 0x39ba, 0x100000000]}}, @svc={0x122, 0x40, {0x4000, [0x6, 0x7, 0x30, 0x7a3]}}, @mrs={0xbe, 0x18, {0x603000000013e510}}, @its_setup={0x82, 0x28, {0x4, 0x1, 0xc7}}, @smc={0x1e, 0x40, {0x6000000, [0x10001, 0x5, 0x8, 0x3, 0x100000001]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x180, 0xd79, 0x1}}, @msr={0x14, 0x20, {0x603000000013e687, 0x9}}, @svc={0x122, 0x40, {0x800, [0x335, 0xb, 0x8, 0xc45, 0xffffffff]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x2, 0x7, 0x3, 0x3ff, 0x3}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x3, 0xc, 0xc07, 0x9, 0x4}}], 0x550}, &(0x7f0000001b40)=[@featur2={0x1, 0x86}], 0x1)
ioctl$KVM_ARM_VCPU_INIT(r8, 0x4020aeae, &(0x7f0000001b80)={0x7, 0xb0})
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000001bc0)=@x86={0x7, 0x9, 0xc3, 0x0, 0x8, 0x4f, 0x1, 0x0, 0x40, 0x1, 0x1, 0xa0, 0x0, 0xfffffffa, 0x6, 0xd, 0x1, 0x3, 0x1, '\x00', 0x2, 0xfffffffffffffffa})
ioctl$KVM_HAS_DEVICE_ATTR_vm(r3, 0x4018aee3, &(0x7f0000001c40)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001c00)={0x1, 0xf, 0x1}})
ioctl$KVM_GET_DEVICE_ATTR_vm(r3, 0x4018aee2, &(0x7f0000001cc0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001c80)={0x8000, 0x0, 0x2}})
ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece)
executing program 0:
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000efe000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000)
munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000075a000/0xb000)=nil, 0xb000)
munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000482000/0x2000)=nil, 0x2000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0)
executing program 1:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d0, 0x2d)
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_RESET_DIRTY_RINGS(r2, 0xaec7) (async)
r3 = eventfd2(0xfffffffa, 0x80001)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r3})
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async)
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616})
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000180)={0x5000})
r4 = openat$kvm(0x0, &(0x7f00000007c0), 0x28a400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000000000/0x400000)=nil) (async)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x21)
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2)
r9 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x2, 0x100000000})
ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f00000002c0)={0x1fd, 0x1, 0xf000, 0x1000, &(0x7f000032c000/0x1000)=nil, 0x8000000000000000, r9}) (async)
r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r8, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) (async)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r8, 0x0) (async)
r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0x801c581f, 0x0)
r13 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0)
ioctl$KVM_CLEAR_DIRTY_LOG(r12, 0xc018aec0, &(0x7f0000000780)={0x1, 0x340, 0x280, &(0x7f0000000380)=[0x40, 0x3, 0x5cde, 0x5, 0xfffffffffffffff9, 0xffff, 0x0, 0x1, 0x924, 0x10001, 0x1, 0x5, 0x5, 0x1, 0x8000000000000000, 0x4, 0x1, 0xf1, 0xffffffffffffffff, 0x0, 0x8, 0x9, 0x673d, 0x6, 0x7, 0x2f8, 0x4, 0x7f, 0x7, 0x1, 0xd, 0x0, 0x1, 0x6, 0x1, 0x8, 0x10000, 0xff, 0x62e5, 0x1, 0x81, 0x38300000, 0x9, 0x8001, 0x6, 0xfe71, 0x8, 0x100000001, 0xf9a, 0x7, 0x7, 0x3, 0x2, 0x7799, 0x0, 0x6, 0x7, 0xffc, 0x7, 0x52b, 0x5, 0x40, 0x5, 0x3, 0x9, 0x0, 0x7, 0x10, 0x7f, 0x1, 0x56a0af96, 0xffffffffffffffff, 0x6, 0x7, 0xfffffffffffffffa, 0x9, 0x0, 0x6, 0x6, 0x8, 0x1, 0x4, 0x7, 0x9, 0x8001, 0xfffffffffffeffff, 0x80000001, 0x31, 0x2, 0x7, 0x8, 0xdd, 0x0, 0x1, 0x1, 0x0, 0x7, 0x8, 0x9, 0x8, 0x3f0b, 0xfffffffffffffff8, 0x100, 0x4, 0xffffffff80000000, 0x7, 0x5875, 0x1, 0x51a, 0x0, 0x1000, 0x81, 0x4, 0x8001, 0x2, 0x2, 0x5, 0x9, 0x94f, 0x6cff4b22, 0x745c, 0x326, 0xe04, 0x2, 0x0, 0xe7d4, 0x400, 0xfffffffffffffffd]}) (async)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) (async)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) (async)
syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0)
r14 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r15, &(0x7f0000c00000/0x400000)=nil)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 5m0s
testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d0, 0x2d)

program did not crash
single: failed to extract reproducer
bisect: bisecting 12 programs with base timeout 5m0s
testing program (duration=5m3s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 29, 13, 26, 21, 40, 30, 30, 30, 16, 17, 30]
detailed listing:
executing program 0:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r2 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
openat$kvm(0x0, 0x0, 0x0, 0x0) (async)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000100)={0x0, 0x0}, &(0x7f00000001c0)=[@featur2={0x1, 0x24}], 0x1) (async)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000180)={0x0, 0x0}, &(0x7f0000000300)=[@featur1={0x1, 0x8}], 0x1) (async)
syz_kvm_vgic_v3_setup(r3, 0x1, 0x0)
ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, 0x0) (async)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000000000)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000040)=0xe7}) (async)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f00000000c0)=@attr_pmu_irq={0x0, 0x0, 0x0, &(0x7f0000000080)=0x30}) (async)
ioctl$KVM_SET_DEVICE_ATTR_vm(r1, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x7, 0x3}})
executing program 0:
r0 = openat$kvm(0x0, &(0x7f00000002c0), 0x4581c4, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000bc2000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000280)={0x0, &(0x7f0000000100)=[@irq_setup={0x46, 0x18, {0x8001, 0x20}}, @its_setup={0x82, 0x28, {0x1, 0x1, 0x1}}, @its_send_cmd={0xaa, 0x28, {0x3, 0x0, 0x0, 0xa, 0x2, 0x4}}], 0x68}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r1, 0x1, 0x100)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000180)={0x8, <r4=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f00000001c0)=@attr_arm64={0x0, 0x2, 0xe5a35d514fdba332, &(0x7f0000000340)=0x747})
ioctl$KVM_SET_DEVICE_ATTR(r4, 0x4018aee1, &(0x7f0000000300)=@attr_other={0x0, 0x80005, 0x6, &(0x7f0000000240)=0x8})
r5 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r6 = mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, r5, 0x1000003, 0x4000010, 0xffffffffffffffff, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_uexit$arm64(r6, 0xfffffffffffffffe)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
syz_kvm_assert_syzos_uexit$arm64(r6, 0xffffffffffffffff)
r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000c52000/0x4000)=nil, 0x0, 0x1000002, 0x2010, r3, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0)
r8 = openat$kvm(0x0, &(0x7f0000000200), 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x1)
r10 = ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0)
r11 = syz_kvm_setup_syzos_vm$arm64(r9, &(0x7f0000000000/0x400000)=nil)
r12 = openat$kvm(0x0, &(0x7f0000000040), 0x8040, 0x0)
r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r13, &(0x7f0000c00000/0x400000)=nil)
r14 = syz_kvm_add_vcpu$arm64(r11, &(0x7f0000000080)={0x0, 0x0, 0xfffffffffffffc72}, 0x0, 0x46)
ioctl$KVM_GET_ONE_REG(r14, 0x4010aeab, &(0x7f0000000180)=@arm64_fp_extra={0x60200000001000d5, &(0x7f0000000380)=0x2a})
ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f00000000c0)=@attr_other={0x0, 0x101, 0x100, &(0x7f00000003c0)=0x100000000})
mmap$KVM_VCPU(&(0x7f0000c6a000/0x4000)=nil, r5, 0x3000000, 0x810, 0xffffffffffffffff, 0x0)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
ioctl$KVM_GET_VCPU_MMAP_SIZE(r0, 0xae04)
r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r2 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r3, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, 0x0})
ioctl$KVM_CAP_PTP_KVM(r3, 0x4068aea3, &(0x7f0000000000))
r4 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_GUEST_DEBUG_arm64(r5, 0x4208ae9b, &(0x7f0000000240)={0x20003, 0x0, {[0x97ab, 0x10001, 0x3, 0xc08d, 0x8, 0xffffffff00000001, 0x3b880, 0x400, 0x5, 0x2, 0x6, 0x5, 0x2, 0x8, 0x6, 0x7fff], [0x45e1, 0x8000, 0x5d2, 0xfff, 0xbb9, 0x0, 0x8, 0xe, 0x51bb, 0x8, 0x4d681830, 0x9, 0x3, 0x10000, 0x7, 0xfffffffffffffff6], [0x80000001, 0xfffffffffffffffe, 0xa3, 0x0, 0x8, 0x81, 0x6, 0xfda8, 0x401, 0x5fd6, 0x3, 0x0, 0x40, 0x4, 0xffffffff, 0x9], [0x3, 0x6, 0xe99, 0xe, 0x9, 0x7, 0x8, 0x0, 0xb, 0x2, 0x10, 0x4, 0x9, 0x9, 0xc, 0x6]}})
ioctl$KVM_RUN(r5, 0xae80, 0x0)
executing program 0:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x31)
r4 = openat$kvm(0x0, &(0x7f0000000080), 0x2000, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
r6 = syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000ab8000/0x400000)=nil)
ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2)
syz_kvm_add_vcpu$arm64(r6, &(0x7f00000000c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000040)={0x66c, 0x10001})
r7 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x29)
syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000080)={0x0, &(0x7f0000000340)=[@its_send_cmd={0xaa, 0x28, {0x5, 0x0, 0x3, 0x10, 0x8, 0x8, 0x2}}, @svc={0x122, 0x40, {0x100, [0x9, 0x7030, 0x3, 0x5, 0x4]}}, @code={0xa, 0x6c, {"008008d50044207e0000809a007008d5006c200e007c001b20ec99d20040b8f2810180d2e20180d2230180d2240180d2020000d4a0a19dd20080b0f2810180d2620080d2630080d2640080d2020000d40820601e000008d5"}}], 0xd4}, 0x0, 0x0)
r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x1)
r10 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r9, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fbff67521cd66f8f1f447d3570707cd24b7eebb20700000000000000000000000100", 0x0, 0xffffffffffffffa7)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r9, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000100)={0x202, 0x2, 0x1, 0x1000, &(0x7f0000ffc000/0x1000)=nil})
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
r11 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r8, r11, &(0x7f0000aec000/0x400000)=nil, &(0x7f00000001c0)=[{0x0, &(0x7f0000000440)=[@code={0xa, 0x54, {"0000403a000008d5000008d580d69fd200c0b0f2610080d2020080d2430180d2040180d2020000d400a8a15e00709f0c007008d500004093008008d5007008d5"}}, @mrs={0xbe, 0x18, {0x5eb7}}, @uexit={0x0, 0x18, 0xa}, @hvc={0x32, 0x40, {0x8600ff01, [0x7, 0x700, 0xdf, 0x40, 0x9fc]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x40, 0x3}}, @hvc={0x32, 0x40, {0x80000000, [0x2c5d, 0x1, 0x3, 0xc, 0x4]}}, @its_setup={0x82, 0x28, {0x4, 0x0, 0x3d5}}, @smc={0x1e, 0x40, {0xc5000020, [0x5, 0x7e, 0xfffffffffffffff9, 0xffffffffffffffff, 0x1]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x1, 0x5, 0x1, 0xf6, 0x4}}], 0x1c4}], 0x1, 0x0, &(0x7f0000000180)=[@featur2={0x1, 0x35}], 0x1)
executing program 1:
r0 = openat$kvm(0x0, &(0x7f00000000c0), 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1)
r3 = mmap$KVM_VCPU(&(0x7f000000e000/0x4000)=nil, 0x930, 0x3, 0x11, r2, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f00000002c0)="fb0149dd033be3ac2cc4a29ea6ab8031d1dfd92f00000000010000005a9610fb707cd24b7eebb20700000000000000000000000100", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1000001, 0x11, r2, 0x0)
r4 = openat$kvm(0xffffff9c, &(0x7f0000000040), 0xa00f2, 0x0)
close(r4)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x3d)
r7 = syz_kvm_setup_syzos_vm$arm64(r6, &(0x7f0000c00000/0x400000)=nil)
mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0)
r8 = mmap$KVM_VCPU(&(0x7f0000edf000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r8, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)
ioctl$KVM_CAP_HALT_POLL(r6, 0x4068aea3, &(0x7f0000000100)={0xb6, 0x0, 0x81})
r9 = syz_kvm_add_vcpu$arm64(r7, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@code={0xa, 0x18, {"7f2003d5"}}], 0x18}, 0x0, 0x0)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r11, 0x4018aee1, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x9, 0x0, 0x1}})
executing program 1:
r0 = openat$kvm(0x0, &(0x7f0000000080), 0x583442, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@msr={0x14, 0x20, {0x603000000013c65d, 0xf}}], 0x20}, 0x0, 0x0)
r4 = ioctl$KVM_GET_STATS_FD_cpu(r3, 0xaece)
ioctl$KVM_ASSIGN_SET_MSIX_NR(r4, 0x4008ae73, &(0x7f0000000180)={0x7, 0x6})
ioctl$KVM_GET_DEVICE_ATTR_vm(0xffffffffffffffff, 0x4018aee2, &(0x7f0000000140)=@attr_other={0x0, 0x5, 0x100000001, &(0x7f0000000000)=0x69})
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
r5 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000) (async)
munmap(&(0x7f00006b3000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000) (async)
munmap(&(0x7f0000e8b000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000) (async)
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
munmap(&(0x7f0000e51000/0x4000)=nil, 0x4000)
openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) (async)
r7 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r8 = ioctl$KVM_GET_VCPU_MMAP_SIZE(r7, 0xae04)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0) (async)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x1000002, 0xaf832, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r8, 0x100000d, 0x32, 0xffffffffffffffff, 0x0) (async)
mmap$KVM_VCPU(&(0x7f00006b4000/0x3000)=nil, r8, 0x100000d, 0x32, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x2000007, 0x30d2a4fbfbea96b8, 0xffffffffffffffff, 0x0)
r9 = mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000ffb000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x3000)=nil, 0x930, 0x2, 0x8032, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000) (async)
munmap(&(0x7f000000f000/0x2000)=nil, 0x2000)
r10 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(0xffffffffffffffff, r10, &(0x7f0000c00000/0x400000)=nil, &(0x7f00000001c0)=[{0x0, &(0x7f0000000240)=ANY=[@ANYRESOCT=r1, @ANYBLOB="a9e5d3a2b088f8da54a977a39e01f58440fa51f19b696fa7ef071c1298f19b", @ANYRES32=r5, @ANYRES8=r6, @ANYRES64=r9, @ANYRES32=r8], 0xfffffe0b}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13) (async)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x13)
syz_kvm_vgic_v3_setup(r6, 0x1, 0x100)
ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x15)
executing program 1:
r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x25)
ioctl$KVM_CAP_HALT_POLL(r0, 0x4068aea3, &(0x7f0000000240)={0xb6, 0x0, 0x800000000000001})
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
r3 = syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r4 = syz_kvm_add_vcpu$arm64(r3, &(0x7f0000000080)={0x0, &(0x7f00000000c0)=[@its_setup={0x7, 0x28, {0x2, 0x2, 0x1}}], 0x28}, 0x0, 0x0)
syz_kvm_vgic_v3_setup(r2, 0x3, 0xa0)
mmap$KVM_VCPU(&(0x7f0000010000/0x1000)=nil, 0x930, 0x100000f, 0x9032, 0xffffffffffffffff, 0x0)
r5 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x400000f, 0x80031, 0xffffffffffffffff, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r5, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
mmap$KVM_VCPU(&(0x7f0000000000/0x14000)=nil, 0x930, 0x8, 0x5c1fd1b6565d2f2, 0xffffffffffffffff, 0x0)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000080)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4040aea0, &(0x7f0000000000)=@x86={0x79, 0x2, 0xed, 0x0, 0x8, 0x3c, 0x6, 0x1, 0x2, 0x8, 0xfc, 0x40, 0x0, 0x0, 0x0, 0x1, 0x6, 0x6, 0x35, '\x00', 0x7, 0xde3e})
r10 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x27)
r11 = syz_kvm_setup_syzos_vm$arm64(r10, &(0x7f0000c00000/0x400000)=nil)
r12 = syz_kvm_add_vcpu$arm64(r11, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0xffffffffffffffff, 0x1, 0x2000000000001}}], 0x28}, 0x0, 0x0)
r13 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r14 = ioctl$KVM_CREATE_VM(r13, 0xae01, 0x0)
ioctl$KVM_SET_DEVICE_ATTR_vm(r14, 0x4018aee1, &(0x7f00000000c0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000000)={0x16, 0x4, 0x1}})
r15 = ioctl$KVM_CREATE_VCPU(r14, 0xae41, 0x0)
syz_kvm_setup_cpu$arm64(r14, r15, &(0x7f0000bfe000/0x400000)=nil, &(0x7f0000000080)=[{0x0, &(0x7f0000000240)=[@hvc={0x32, 0x40, {0x8600ff01, [0x7, 0x9, 0x8, 0xfffffffffffffff8, 0x100]}}], 0x40}], 0x1, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r15, 0xae80, 0x0)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x8, <r16=>0xffffffffffffffff})
ioctl$KVM_SET_DEVICE_ATTR(r16, 0x4018aee1, &(0x7f0000000000)=@attr_arm64={0x0, 0x0, 0x4, &(0x7f0000000180)=0x8080000})
ioctl$KVM_GET_REG_LIST(r12, 0xc008aeb0, &(0x7f0000000140)={0x3, [0x7, 0xe80, 0x2]})
ioctl$KVM_RUN(r4, 0xae80, 0x0)
munmap(&(0x7f0000470000/0x400000)=nil, 0xe06500)
executing program 0:
r0 = mmap$KVM_VCPU(&(0x7f0000ec1000/0x1000)=nil, 0x930, 0xf, 0x9032, 0xffffffffffffffff, 0x0)
r1 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bfd000/0x400000)=nil)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil)
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x28)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000000540)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_SET_SIGNAL_MASK(r5, 0x4004ae8b, &(0x7f00000000c0))
syz_memcpy_off$KVM_EXIT_HYPERCALL(r0, 0x20, &(0x7f0000000000)="2bf7df8a2e93341528bc2d9738821d0e8d9c4220af6aca36268066e05da47c6f4da2527d0a0fd5b3e5b29d5b28a868c1917e0e57fbee2a6993cef0a218865e6fb212a647992b286d", 0x0, 0x48)
r6 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
r8 = syz_kvm_setup_syzos_vm$arm64(r7, &(0x7f0000c00000/0x400000)=nil)
r9 = syz_kvm_add_vcpu$arm64(r8, &(0x7f0000000b80)={0x0, &(0x7f0000000040)=[@smc={0x1e, 0x40, {0x84000002, [0x99b, 0x100000001, 0x5, 0x101, 0x10]}}], 0x40}, &(0x7f0000000280)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r9, 0xae80, 0x0)
r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0)
ioctl$KVM_SET_GSI_ROUTING(r11, 0x4008ae6a, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000000000000000000002"])
r12 = syz_kvm_add_vcpu$arm64(r1, &(0x7f00000000c0)={0x0, &(0x7f00000013c0)=[@code={0xa, 0x84, {"c0f490d20080b8f2e10080d2220180d2430180d2e40080d2020000d400c0271e007008d5007008d5000080d2007008d50018000ea07385d20040b0f2c10180d2a20180d2e30180d2440080d2020000d400f29ed200c0b8f2210080d2a20180d2830180d2440180d2020000d40000803c"}}, @irq_setup={0x46, 0x18, {0x4, 0xe}}, @eret={0xe6, 0x18, 0x3}, @eret={0xe6, 0x18, 0x7}, @hvc={0x32, 0x40, {0xffff, [0x3, 0x5, 0x7, 0x1b, 0x5]}}, @smc={0x1e, 0x40, {0x40000000, [0x9, 0x2, 0x8000, 0x6, 0x80000003]}}, @hvc={0x32, 0x40, {0x84000003, [0xa, 0x2, 0x8, 0x200, 0x2]}}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x26f}}, @hvc={0x32, 0x40, {0x84000002, [0x9, 0x1, 0x9, 0x0, 0x8]}}, @hvc={0x32, 0x40, {0x6000000, [0x1, 0xfffffffffffffff9, 0x4, 0xa, 0x7]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffd0, 0x5, 0x2}}, @its_setup={0x82, 0x28, {0x2, 0x2}}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0x2000000, [0xf15, 0x401, 0x0, 0x4, 0x1ff]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x10, 0xfffffff7, 0xff, 0x2}}, @irq_setup={0x46, 0x18, {0x2, 0x1bd}}, @code={0xa, 0xb4, {"804f97d20020b8f2610080d2e20080d2030180d2c40180d2020000d4007008d5007008d500d8217e000400bc008284d200c0b8f2210080d2220180d2e30180d2640180d2020000d4c0bd93d200e0b8f2c10180d2e20180d2c30080d2a40180d2020000d4607b85d20040b0f2010180d2a20080d2230080d2240180d2020000d40080001bc09b9cd20000b8f2e10080d2820080d2430080d2c40080d2020000d4"}}, @hvc={0x32, 0x40, {0xc4000011, [0x3, 0x6, 0xf800000000000000, 0xfffffffffffffffd, 0x8001]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x0, 0x2, 0x280, 0x0, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x4, 0x21a}}, @eret={0xe6, 0x18}, @svc={0x122, 0x40, {0x400, [0xffffffffffffffff, 0x6, 0x4, 0x51, 0x1000]}}, @its_setup={0x82, 0x28, {0x1, 0x0, 0x33f}}, @smc={0x1e, 0x40, {0x10c0000eb, [0x4, 0x8, 0x5, 0x3, 0xff]}}, @its_setup={0x82, 0x28, {0x1, 0x4, 0x1cc}}, @irq_setup={0x46, 0x18, {0x2, 0x78}}, @irq_setup={0x46, 0x18, {0x0, 0xcd}}, @its_send_cmd={0xaa, 0x28, {0x0, 0x1, 0x0, 0xb, 0x7fffffff, 0x2, 0x1}}, @hvc={0x32, 0x40, {0x84000052, [0xdcdf, 0x195a, 0x8, 0x8, 0x7]}}, @smc={0x1e, 0x40, {0xc4000005, [0xbb, 0x2, 0x9, 0x2, 0x10]}}, @msr={0x14, 0x20, {0x0, 0x3}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x3, 0x3, 0xa, 0xa, 0x1}}], 0x670}, &(0x7f0000000100)=[@featur1={0x1, 0x44}], 0x1)
r13 = mmap$KVM_VCPU(&(0x7f0000fff000/0x1000)=nil, 0x930, 0x700000d, 0x80031, r12, 0x0)
ioctl$KVM_CREATE_GUEST_MEMFD(r11, 0xc040aed4, &(0x7f0000000140)={0x1, 0xe24})
r14 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r15, 0xae60)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000680)="38ce8347fc1e86008cfc72bb352c8659dcc9225b48cb5cb00c73b0b33018748e73f7f1f493e89c859e17625ad1b19ca88da9c227db3473a7fd4ce992bfc316bd22ccc646cd69c728", 0x0, 0x48)
r16 = openat$kvm(0x0, &(0x7f0000000040), 0x800, 0x0)
r17 = ioctl$KVM_CREATE_VM(r16, 0xae01, 0x0)
r18 = syz_kvm_setup_syzos_vm$arm64(r17, &(0x7f0000c00000/0x400000)=nil)
r19 = syz_kvm_add_vcpu$arm64(r18, &(0x7f00000002c0)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_GET_ONE_REG(r19, 0x4010aeab, &(0x7f0000000000)=@arm64_core={0x603000000010004a, &(0x7f0000000100)=0xffffffffffffffff})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0)
executing program 1:
ioctl$KVM_ARM_VCPU_INIT(0xffffffffffffffff, 0x4020aeae, &(0x7f0000000000)={0x1, 0x40})
ioctl$KVM_SET_GUEST_DEBUG_arm64(0xffffffffffffffff, 0x4208ae9b, &(0x7f0000000040)={0x0, 0x0, {[0x9, 0x1ff, 0x7, 0xf, 0x4, 0x2986, 0x7fffffffffffffff, 0x400, 0xf, 0xb, 0x7fffffffffffffff, 0xb, 0x3, 0x3, 0x5, 0x1], [0x1, 0xffff, 0x8c, 0x3, 0x9, 0x0, 0x101, 0x1, 0x9ee, 0x4, 0x2e5c, 0x7f, 0xfc6, 0x0, 0x6, 0x8], [0x58, 0x3, 0x100000001, 0x8, 0xa, 0x2, 0x0, 0x7, 0x2, 0x7, 0x4, 0x1ff, 0x5, 0x72, 0x3, 0x4], [0xecb, 0xffffffff, 0x4, 0x4, 0x9, 0x5, 0x0, 0x2, 0x4, 0x6439d3b1, 0xc, 0x100000001, 0x1, 0x14, 0x6, 0x4]}})
r0 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000a40)={0x0, &(0x7f0000000280)=[@msr={0x14, 0x20, {0x6030000000138027, 0x10001}}, @smc={0x1e, 0x40, {0x31000000, [0x401, 0x6, 0x19e, 0x8f8, 0x6]}}, @irq_setup={0x46, 0x18, {0x4, 0x28b}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x4, 0xd, 0x5e9e1da6, 0x8, 0x1}}, @its_setup={0x82, 0x28, {0x0, 0x1, 0x146}}, @its_send_cmd={0xaa, 0x28, {0x8, 0x0, 0x4, 0x5, 0x8, 0x7, 0x3}}, @its_setup={0x82, 0x28, {0x3, 0x1, 0xc1}}, @code={0xa, 0x6c, {"007008d5c09b8dd20040b0f2210180d2e20080d2430080d2840180d2020000d45f3003d5000820bc000008d5008008d5007008d500c8217e800796d20020b8f2810180d2220180d2430080d2440180d2020000d40060df0d"}}, @mrs={0xbe, 0x18, {0x603000000013dea0}}, @eret={0xe6, 0x18, 0x4}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x2a0}}, @code={0xa, 0xcc, {"c0559ad20040b8f2c10180d2c20180d2630180d2e40180d2020000d4202194d200e0b8f2e10080d2020180d2a30080d2e40080d2020000d4a0fe9ed20080b0f2210080d2420080d2030180d2e40080d2020000d4000028d5000028d50080400c405d89d20080b0f2210080d2e20180d2830180d2e40080d2020000d40074007f00fa91d200c0b0f2c10080d2420180d2a30180d2e40180d2020000d4e0db96d20060b0f2810180d2c20180d2830080d2440080d2020000d4"}}, @code={0xa, 0x6c, {"0098a10e007008d500a4002f007008d5007008d5005c86d20020b8f2a10080d2c20080d2030080d2a40080d2020000d4000820fc007008d5201f8ed20080b0f2c10180d2220080d2e30080d2640180d2020000d4007008d5"}}, @svc={0x122, 0x40, {0x84000008, [0x9b1, 0x81, 0x9, 0x5, 0x4]}}, @uexit={0x0, 0x18, 0x5}, @mrs={0xbe, 0x18, {0x6030000000138036}}, @its_setup={0x82, 0x28, {0x3, 0x0, 0x2b4}}, @its_setup={0x82, 0x28, {0x2, 0x1, 0x35c}}, @its_send_cmd={0xaa, 0x28, {0xf, 0x0, 0x4, 0x7, 0x1, 0xff, 0x1}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xd00, 0xdd, 0x6}}, @msr={0x14, 0x20, {0x603000000013f687, 0xfffffffffffffffd}}, @code={0xa, 0xb4, {"0040800c40e581d200e0b8f2e10080d2c20080d2830180d2840080d2020000d4000028d50000249e00f586d20000b8f2e10080d2620180d2230180d2a40080d2020000d400ac83d20080b8f2410080d2e20180d2830180d2840080d2020000d4007008d580a988d200e0b0f2210180d2a20180d2230180d2440180d2020000d4205a9ad200a0b0f2010080d2420080d2a30180d2640080d2020000d400009f0c"}}, @its_setup={0x82, 0x28, {0x0, 0x4, 0x1cc}}, @code={0xa, 0xcc, {"60da89d20000b0f2e10080d2420180d2830180d2440180d2020000d4007008d5000028d5000040a8805797d20020b0f2c10080d2820180d2030080d2840180d2020000d4003193d20040b8f2010080d2420080d2c30080d2a40180d2020000d460538fd200e0b0f2a10080d2e20080d2430080d2c40080d2020000d4004d8dd20060b8f2c10080d2620180d2630180d2c40180d2020000d4809390d200c0b0f2c10080d2620080d2c30080d2e40080d2020000d4000008d5"}}, @irq_setup={0x46, 0x18, {0x4, 0x32b}}, @irq_setup={0x46, 0x18, {0x4, 0x3d1}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x800, [0x9, 0x0, 0x1, 0xa, 0x6]}}, @memwrite={0x6e, 0x30, @vgic_gits={0x8080000, 0xffe0, 0x9, 0x1}}, @svc={0x122, 0x40, {0x80007fff, [0x200, 0x81, 0x4, 0x7]}}, @code={0xa, 0x9c, {"a03293d200a0b0f2c10080d2020180d2030080d2840080d2020000d4000008d5805285d20020b0f2810080d2e20080d2230180d2240080d2020000d4e05398d20040b8f2810180d2a20180d2230080d2840080d2020000d4007008d5007008d5a05693d200a0b8f2a10080d2820080d2030080d2a40180d2020000d40048c01a1f00002b00b0000f"}}], 0x788}, &(0x7f0000000a80)=[@featur1={0x1, 0x4}], 0x1)
ioctl$KVM_RUN(r0, 0xae80, 0x0)
r1 = ioctl$KVM_GET_VCPU_MMAP_SIZE(0xffffffffffffffff, 0xae04)
mmap$KVM_VCPU(&(0x7f0000ffd000/0x2000)=nil, r1, 0x0, 0x110, r0, 0x0)
ioctl$KVM_ARM_SET_DEVICE_ADDR(0xffffffffffffffff, 0x4010aeab, &(0x7f0000000ac0)={0x401, 0x2})
ioctl$KVM_ARM_VCPU_INIT(r0, 0x4020aeae, &(0x7f0000000b00)={0x4, 0x8})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000b40), 0x2000, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x7)
r4 = syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_ARM_VCPU_INIT(r0, 0x4020aeae, &(0x7f0000000b80))
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r0, 0x4018aee1, &(0x7f0000000c00)=@attr_irq_timer={0x0, 0x1, 0x1, &(0x7f0000000bc0)=0x1f})
ioctl$KVM_HAS_DEVICE_ATTR_vcpu(r0, 0x4018aee3, &(0x7f0000000c80)=@attr_pmu_filter={0x0, 0x0, 0x2, &(0x7f0000000c40)={0xff80, 0x2}})
ioctl$KVM_CAP_ARM_MTE(r3, 0x4068aea3, &(0x7f0000000cc0))
r5 = syz_kvm_add_vcpu$arm64(r4, &(0x7f00000010c0)={0x0, &(0x7f0000000d40)=[@eret={0xe6, 0x18, 0x2}, @smc={0x1e, 0x40, {0x84000000, [0x6, 0xd32d, 0x2, 0x3, 0x5]}}, @irq_setup={0x46, 0x18, {0x3, 0x347}}, @smc={0x1e, 0x40, {0x2, [0x2, 0xce6, 0x6, 0x3, 0x1]}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x1, 0x3, 0xb, 0x81, 0xff, 0x2}}, @hvc={0x32, 0x40, {0x84000006, [0x86, 0x5, 0x7fffffff, 0x6, 0x9]}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x0, 0x6, 0x0, 0x9, 0x1}}, @mrs={0xbe, 0x18, {0x603000000013e2b0}}, @svc={0x122, 0x40, {0x84000004, [0x8, 0x0, 0x4, 0xd, 0x3ff800000000]}}, @eret={0xe6, 0x18, 0x5}, @svc={0x122, 0x40, {0x84000011, [0x0, 0x3, 0x60, 0x80000001, 0x40c80eb9]}}, @eret={0xe6, 0x18, 0x4}, @eret={0xe6, 0x18, 0x4}, @its_setup={0x82, 0x28, {0x3, 0x4, 0x4d}}, @code={0xa, 0xcc, {"005683d20000b8f2c10080d2a20180d2830180d2440180d2020000d400d096d200e0b8f2610080d2c20180d2430180d2e40180d2020000d4800e91d20020b8f2610080d2620180d2830080d2240180d2020000d40074005f607c8ed200e0b0f2810180d2620180d2030180d2a40080d2020000d4007008d5408a83d20080b8f2e10180d2420180d2830180d2840180d2020000d400000048000028d5801688d20060b0f2410180d2e20180d2030180d2440080d2020000d4"}}, @msr={0x14, 0x20, {0x301800000009ef4a, 0x100000000}}, @uexit={0x0, 0x18, 0x5}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80c0000, 0x200, 0x7}}], 0x37c}, &(0x7f0000001100)=[@featur1={0x1, 0xc1}], 0x1)
ioctl$KVM_SET_DEVICE_ATTR_vcpu(r5, 0x4018aee1, &(0x7f0000001180)=@attr_other={0x0, 0x7, 0x72, &(0x7f0000001140)=0xfad})
ioctl$KVM_ARM_VCPU_INIT(r5, 0x4020aeae, &(0x7f00000011c0)={0x0, 0x1})
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)
r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x1)
mmap$KVM_VCPU(&(0x7f0000fee000/0x4000)=nil, r1, 0x1000002, 0x110, r6, 0x0)
r7 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000001440)={0x0, &(0x7f0000001200)=[@memwrite={0x6e, 0x30, @vgic_gicr={0x8100000, 0x14, 0x5, 0x4}}, @svc={0x122, 0x40, {0xc4000001, [0xfff, 0x1, 0x317, 0x7, 0x2]}}, @svc={0x122, 0x40, {0x40, [0x1, 0x8, 0x9b, 0x8, 0x9]}}, @svc={0x122, 0x40, {0x31000000, [0x2, 0xabec, 0xe47, 0x75, 0x40]}}, @irq_setup={0x46, 0x18, {0x3, 0x269}}, @svc={0x122, 0x40, {0xc4000003, [0x8, 0x8000000000000001, 0x853f, 0x41fe, 0x8]}}, @its_setup={0x82, 0x28, {0x3, 0x3, 0x231}}, @smc={0x1e, 0x40, {0x84000004, [0x9, 0x3, 0xd, 0x100, 0x7]}}, @memwrite={0x6e, 0x30, @generic={0xeeef0000, 0x7b8, 0x4, 0x1}}, @its_send_cmd={0xaa, 0x28, {0xc, 0x0, 0x0, 0xb, 0xbaa, 0x79e, 0x2}}], 0x208}, &(0x7f0000001480)=[@featur2={0x1, 0x2}], 0x1)
ioctl$KVM_ARM_VCPU_INIT(r7, 0x4020aeae, &(0x7f00000014c0)={0x5, 0x44})
ioctl$KVM_HAS_DEVICE_ATTR_vm(r3, 0x4018aee3, &(0x7f0000001540)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001500)={0x7, 0x3}})
r8 = syz_kvm_add_vcpu$arm64(r4, &(0x7f0000001b00)={0x0, &(0x7f0000001580)=[@svc={0x122, 0x40, {0x84000011, [0x4, 0x81, 0x9, 0x7fffffffffffffff]}}, @its_setup={0x82, 0x28, {0x2, 0x2, 0xd3}}, @uexit={0x0, 0x18, 0x292cf29f}, @memwrite={0x6e, 0x30, @vgic_gicr={0x80e0000, 0x400, 0x6}}, @irq_setup={0x46, 0x18, {0x1, 0x2bb}}, @its_setup={0x82, 0x28, {0x3, 0x2, 0x130}}, @smc={0x1e, 0x40, {0x84000000, [0x8001, 0x8000000000000001, 0x8000, 0x6, 0xc8]}}, @smc={0x1e, 0x40, {0x84000053, [0x545, 0x0, 0x9, 0x1, 0x61b1]}}, @code={0xa, 0x84, {"007008d5007008d5603697d20000b8f2a10180d2620080d2430180d2040180d2020000d4000028d5007008d5008383d200a0b0f2410080d2220080d2030080d2840080d2020000d4000000100094000f00f8b02e208292d200c0b8f2610080d2e20180d2c30180d2040180d2020000d4"}}, @hvc={0x32, 0x40, {0x84000007, [0x86, 0x7ff, 0x2, 0x5f9b, 0x7]}}, @svc={0x122, 0x40, {0x80008000, [0xf7, 0x4, 0x7, 0x886, 0x64f24cf2]}}, @msr={0x14, 0x20, {0xc06000000027dd57, 0xd98c}}, @hvc={0x32, 0x40, {0xc400000d, [0xfffffffffffffff7, 0x80000000, 0x6, 0x1000, 0x100000001]}}, @code={0xa, 0x84, {"0000802d008008d5007008d5407a88d200c0b0f2810080d2420180d2430180d2240080d2020000d40000004b000008d5e0638bd200c0b8f2010080d2e20180d2c30080d2a40180d2020000d400b4207e60db8fd20040b0f2a10080d2a20080d2e30080d2440080d2020000d40044205e"}}, @uexit={0x0, 0x18, 0x6}, @svc={0x122, 0x40, {0x84000010, [0x1, 0x100000000, 0x7f, 0x39ba, 0x100000000]}}, @svc={0x122, 0x40, {0x4000, [0x6, 0x7, 0x30, 0x7a3]}}, @mrs={0xbe, 0x18, {0x603000000013e510}}, @its_setup={0x82, 0x28, {0x4, 0x1, 0xc7}}, @smc={0x1e, 0x40, {0x6000000, [0x10001, 0x5, 0x8, 0x3, 0x100000001]}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0x180, 0xd79, 0x1}}, @msr={0x14, 0x20, {0x603000000013e687, 0x9}}, @svc={0x122, 0x40, {0x800, [0x335, 0xb, 0x8, 0xc45, 0xffffffff]}}, @its_send_cmd={0xaa, 0x28, {0x4, 0x1, 0x2, 0x7, 0x3, 0x3ff, 0x3}}, @its_send_cmd={0xaa, 0x28, {0x1, 0x1, 0x3, 0xc, 0xc07, 0x9, 0x4}}], 0x550}, &(0x7f0000001b40)=[@featur2={0x1, 0x86}], 0x1)
ioctl$KVM_ARM_VCPU_INIT(r8, 0x4020aeae, &(0x7f0000001b80)={0x7, 0xb0})
ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f0000001bc0)=@x86={0x7, 0x9, 0xc3, 0x0, 0x8, 0x4f, 0x1, 0x0, 0x40, 0x1, 0x1, 0xa0, 0x0, 0xfffffffa, 0x6, 0xd, 0x1, 0x3, 0x1, '\x00', 0x2, 0xfffffffffffffffa})
ioctl$KVM_HAS_DEVICE_ATTR_vm(r3, 0x4018aee3, &(0x7f0000001c40)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001c00)={0x1, 0xf, 0x1}})
ioctl$KVM_GET_DEVICE_ATTR_vm(r3, 0x4018aee2, &(0x7f0000001cc0)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000001c80)={0x8000, 0x0, 0x2}})
ioctl$KVM_GET_STATS_FD_cpu(r6, 0xaece)
executing program 0:
munmap(&(0x7f0000ec1000/0x3000)=nil, 0x3000)
mmap$KVM_VCPU(&(0x7f0000eb3000/0x1000)=nil, 0x930, 0x0, 0x20031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f0000efe000/0x4000)=nil, 0x4000)
munmap(&(0x7f0000f2a000/0x2000)=nil, 0x2000)
munmap(&(0x7f00004a0000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000002000/0x4000)=nil, 0x4000)
munmap(&(0x7f000075a000/0xb000)=nil, 0xb000)
munmap(&(0x7f0000ece000/0x2000)=nil, 0x2000)
munmap(&(0x7f0000482000/0x2000)=nil, 0x2000)
mmap$KVM_VCPU(&(0x7f0000007000/0x1000)=nil, 0x930, 0x1000002, 0x28031, 0xffffffffffffffff, 0x0)
munmap(&(0x7f00004ff000/0x1000)=nil, 0x1000)
mmap$KVM_VCPU(&(0x7f0000ffc000/0x2000)=nil, 0x930, 0x0, 0x24132, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000f1a000/0x4000)=nil, 0x930, 0x0, 0x9032, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000fed000/0x3000)=nil, 0x930, 0x0, 0x4030031, 0xffffffffffffffff, 0x0)
mmap$KVM_VCPU(&(0x7f0000c00000/0x400000)=nil, 0x930, 0x0, 0x4f832, 0xffffffffffffffff, 0x1000000)
mmap$KVM_VCPU(&(0x7f0000000000/0x1000)=nil, 0x930, 0x0, 0x40032, 0xffffffffffffffff, 0x0)
executing program 1:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d0, 0x2d)
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) (async)
r1 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_RESET_DIRTY_RINGS(r2, 0xaec7) (async)
r3 = eventfd2(0xfffffffa, 0x80001)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f0000000140)={0x80, 0x4, 0x0, r3})
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil) (async)
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000000)={0x1, 0x37d03030d7a92616})
ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000180)={0x5000})
r4 = openat$kvm(0x0, &(0x7f00000007c0), 0x28a400, 0x0)
r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r5, &(0x7f0000000000/0x400000)=nil) (async)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x21)
r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2)
r9 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f0000000080)={0x2, 0x100000000})
ioctl$KVM_SET_USER_MEMORY_REGION2(r5, 0x40a0ae49, &(0x7f00000002c0)={0x1fd, 0x1, 0xf000, 0x1000, &(0x7f000032c000/0x1000)=nil, 0x8000000000000000, r9}) (async)
r10 = mmap$KVM_VCPU(&(0x7f0000004000/0x2000)=nil, 0x930, 0x2800002, 0x11, r8, 0x0)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r10, 0x20, &(0x7f00000001c0)="fb4149dd033be3ac2cc4a22332a77b23b08986814d7bb14c94a6ab8031d1dfd92f00000000010000005a9610fbff67521ce16f8f1f449a7a835673312b54ebb2aa7fc869d22627e7", 0x0, 0x48) (async)
mmap$KVM_VCPU(&(0x7f0000000000/0xa000)=nil, 0x930, 0x1, 0x11, r8, 0x0) (async)
r11 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0)
r12 = ioctl$KVM_CREATE_VM(r11, 0x801c581f, 0x0)
r13 = mmap$KVM_VCPU(&(0x7f0000000000/0x2000)=nil, 0x930, 0xe, 0x16831, 0xffffffffffffffff, 0x0)
ioctl$KVM_CLEAR_DIRTY_LOG(r12, 0xc018aec0, &(0x7f0000000780)={0x1, 0x340, 0x280, &(0x7f0000000380)=[0x40, 0x3, 0x5cde, 0x5, 0xfffffffffffffff9, 0xffff, 0x0, 0x1, 0x924, 0x10001, 0x1, 0x5, 0x5, 0x1, 0x8000000000000000, 0x4, 0x1, 0xf1, 0xffffffffffffffff, 0x0, 0x8, 0x9, 0x673d, 0x6, 0x7, 0x2f8, 0x4, 0x7f, 0x7, 0x1, 0xd, 0x0, 0x1, 0x6, 0x1, 0x8, 0x10000, 0xff, 0x62e5, 0x1, 0x81, 0x38300000, 0x9, 0x8001, 0x6, 0xfe71, 0x8, 0x100000001, 0xf9a, 0x7, 0x7, 0x3, 0x2, 0x7799, 0x0, 0x6, 0x7, 0xffc, 0x7, 0x52b, 0x5, 0x40, 0x5, 0x3, 0x9, 0x0, 0x7, 0x10, 0x7f, 0x1, 0x56a0af96, 0xffffffffffffffff, 0x6, 0x7, 0xfffffffffffffffa, 0x9, 0x0, 0x6, 0x6, 0x8, 0x1, 0x4, 0x7, 0x9, 0x8001, 0xfffffffffffeffff, 0x80000001, 0x31, 0x2, 0x7, 0x8, 0xdd, 0x0, 0x1, 0x1, 0x0, 0x7, 0x8, 0x9, 0x8, 0x3f0b, 0xfffffffffffffff8, 0x100, 0x4, 0xffffffff80000000, 0x7, 0x5875, 0x1, 0x51a, 0x0, 0x1000, 0x81, 0x4, 0x8001, 0x2, 0x2, 0x5, 0x9, 0x94f, 0x6cff4b22, 0x745c, 0x326, 0xe04, 0x2, 0x0, 0xe7d4, 0x400, 0xfffffffffffffffd]}) (async)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000240)="37e68986ad644f5dc57bbc1ff382863b67f3eee57a32ec911d95f88f3dd8ea716e4a29cefbd440b2ecf83f57baf33b0c97182970a47ef45c954e42f2055384921830f6e273d2eb30", 0x0, 0x2a2019ac5ed2a1ef) (async)
syz_memcpy_off$KVM_EXIT_HYPERCALL(r13, 0x20, &(0x7f0000000100)="746abf250f7959c813e4adfb369b808022e69fe80cfadce4a1259e77bab54ac9749537b3d016bb7f745a6e22d2f9ff443f19467748a3fe02c239457600", 0x0, 0xfffffffffffffec5) (async)
syz_kvm_add_vcpu$arm64(r0, &(0x7f00000000c0)={0x0, &(0x7f0000000100)=[@its_setup={0x82, 0x28, {0x3, 0x1, 0x1}}], 0x28}, 0x0, 0x0)
r14 = openat$kvm(0x0, &(0x7f0000000080), 0x0, 0x0)
r15 = ioctl$KVM_CREATE_VM(r14, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$arm64(r15, &(0x7f0000c00000/0x400000)=nil)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 16m0s
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, <r8=>0xffffffffffffffff, 0x1})
ioctl$KVM_CREATE_VM(r8, 0x400454d0, 0x2d)

program crashed: kernel BUG in kvm_s2_put_page
single: successfully extracted reproducer
found reproducer with 17 syscalls
minimizing guilty program
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_DEVICE
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)
ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff, 0x1})

program crashed: kernel BUG in kvm_s2_put_page
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm-ioctl$KVM_CREATE_VM
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)
ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0)

program crashed: kernel BUG in kvm_s2_put_page
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN-openat$kvm
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0)

program crashed: kernel BUG in kvm_s2_put_page
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program crashed: kernel BUG in kvm_s2_put_page
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-syz_kvm_add_vcpu$arm64
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-munmap-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
munmap(&(0x7f0000d70000/0x3000)=nil, 0x3000)
ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program crashed: kernel BUG in kvm_s2_put_page
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x8080000, 0x2000, &(0x7f0000c5d000/0x2000)=nil})
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_SET_USER_MEMORY_REGION-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000040)={0x1, 0x2, 0xeeef0000, 0x2000, &(0x7f0000fa3000/0x2000)=nil})
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-openat$kvm-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-ioctl$KVM_CREATE_DEVICE-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000040)={0x2})
r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r3, &(0x7f0000c00000/0x400000)=nil)
r4 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r4, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r2 = syz_kvm_setup_syzos_vm$arm64(r1, &(0x7f0000c00000/0x400000)=nil)
r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r4, &(0x7f0000c00000/0x400000)=nil)
r5 = syz_kvm_add_vcpu$arm64(r2, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r5, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-ioctl$KVM_CREATE_VM-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x2c)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(0x0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-openat$kvm-syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
openat$kvm(0x0, &(0x7f0000000140), 0x4c0401, 0x0)
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$KVM_IRQFD-syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={0xffffffffffffffff, 0xc8})
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, &(0x7f00000001c0)=[@eret={0xe6, 0x18}, @eret={0xe6, 0x18, 0x7}, @svc={0x122, 0x40, {0xffff, [0x8, 0x8, 0x1, 0xffffffffffffc86b, 0x400]}}, @code={0xa, 0xb4, {"40b888d20020b0f2a10180d2a20080d2030180d2a40180d2020000d4007008d5000028d5603a9ad20060b0f2c10080d2820080d2430180d2240180d2020000d4c04186d20000b0f2410180d2820080d2430080d2040080d2020000d4000028d5805b90d20060b8f2610080d2620180d2a30080d2440080d2020000d400c0005f007008d580019ad20080b0f2c10180d2620080d2830080d2240180d2020000d4"}}, @uexit={0x0, 0x18}, @irq_setup={0x46, 0x18, {0x3, 0x247}}, @uexit={0x0, 0x18, 0x9}, @hvc={0x32, 0x40, {0x400, [0x46, 0x80010000, 0x1800, 0x4, 0x800]}}, @uexit={0x0, 0x18, 0xe}, @its_send_cmd={0xaa, 0x28, {0xa, 0x0, 0x2, 0xb, 0x1000, 0x80000000}}, @svc={0x122, 0x40, {0x86000001, [0x0, 0x1, 0x2a, 0x3, 0x6]}}, @uexit={0x0, 0x18, 0x101}, @irq_setup={0x46, 0x18, {0x2, 0x102}}, @hvc={0x32, 0x40, {0x84000002, [0xa, 0x4ae1, 0x7e, 0x800, 0x6]}}, @mrs={0xbe, 0x18, {0x603000000013e110}}, @memwrite={0x6e, 0x30, @vgic_gicd={0x8000000, 0xffd0, 0x8, 0xe}}, @mrs={0xbe, 0x18, {0x603000000013e664}}, @irq_setup={0x46, 0x18, {0x0, 0x2ca}}], 0x314}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, 0x0, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program did not crash
testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
extracting C reproducer
testing compiled C program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
simplifying C reproducer
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing compiled C program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
validation run: crashed=true
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
validation run: crashed=true
testing program (duration=16m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_kvm_setup_syzos_vm$arm64-openat$kvm-ioctl$KVM_CREATE_VM-syz_kvm_setup_syzos_vm$arm64-syz_kvm_add_vcpu$arm64-ioctl$KVM_RUN
detailed listing:
executing program 0:
r0 = syz_kvm_setup_syzos_vm$arm64(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x31)
syz_kvm_setup_syzos_vm$arm64(r2, &(0x7f0000c00000/0x400000)=nil)
r3 = syz_kvm_add_vcpu$arm64(r0, &(0x7f0000000180)={0x0, 0x0}, 0x0, 0x0)
ioctl$KVM_RUN(r3, 0xae80, 0x0)

program crashed: KASAN: invalid-access Read in __kvm_pgtable_walk
validation run: crashed=true
reproducing took 7h46m7.482635044s
repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-access in __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
BUG: KASAN: invalid-access in __kvm_pgtable_walk+0x8e4/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
Read of size 8 at addr 8af0000012dea000 by task syz.2.17/3618
Pointer tag: [8a], memory tag: [fe]

CPU: 0 UID: 0 PID: 3618 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xac/0x288 mm/kasan/report.c:378
 print_report+0x84/0xa0 mm/kasan/report.c:482
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 kasan_tag_mismatch+0x28/0x3c mm/kasan/sw_tags.c:175
 __hwasan_tag_mismatch+0x30/0x60 arch/arm64/lib/kasan_sw_tags.S:55
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
 __kvm_pgtable_walk+0x8e4/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 _kvm_pgtable_walk arch/arm64/kvm/hyp/pgtable.c:260 [inline]
 kvm_pgtable_walk+0x294/0x468 arch/arm64/kvm/hyp/pgtable.c:283
 kvm_pgtable_stage2_destroy_range+0x60/0xb4 arch/arm64/kvm/hyp/pgtable.c:1563
 stage2_destroy_range arch/arm64/kvm/mmu.c:924 [inline]
 kvm_stage2_destroy arch/arm64/kvm/mmu.c:935 [inline]
 kvm_free_stage2_pgd+0x198/0x28c arch/arm64/kvm/mmu.c:1112
 kvm_uninit_stage2_mmu+0x20/0x38 arch/arm64/kvm/mmu.c:1023
 kvm_arch_flush_shadow_all+0x1a8/0x1e0 arch/arm64/kvm/nested.c:1113
 kvm_flush_shadow_all virt/kvm/kvm_main.c:343 [inline]
 kvm_mmu_notifier_release+0x48/0xa8 virt/kvm/kvm_main.c:884
 mmu_notifier_unregister+0x128/0x42c mm/mmu_notifier.c:815
 kvm_destroy_vm virt/kvm/kvm_main.c:1295 [inline]
 kvm_put_kvm+0x6a0/0xfa8 virt/kvm/kvm_main.c:1353
 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1376
 __fput+0x4ac/0x980 fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1bc/0x254 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x1bc/0x270 arch/arm64/kernel/entry-common.c:155
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:173 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:182 [inline]
 el0_svc+0xb8/0x164 arch/arm64/kernel/entry-common.c:880
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xd0f0000012debb80 pfn:0x52dea
flags: 0x1ffdd4000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x75)
raw: 01ffdd4000000000 ffffc1ffc0888748 ffffc1ffc0887688 0000000000000000
raw: d0f0000012debb80 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff0000012de9e00: a5 a5 a5 a5 a5 a5 a5 a5 fe fe fe fe fe fe fe fe
 fff0000012de9f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>fff0000012dea000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                   ^
 fff0000012dea100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 fff0000012dea200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================
Unable to handle kernel paging request at virtual address ffff672652b20300
KASAN: probably wild-memory-access in range [0xfffe72652b203000-0xfffe72652b20300f]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000004769a000
[ffff672652b20300] pgd=100000004c636003, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 3618 Comm: syz.2.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: linux,dummy-virt (DT)
pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
pc : __kvm_pgtable_walk+0x268/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
lr : kvm_dereference_pteref arch/arm64/include/asm/kvm_pgtable.h:389 [inline]
lr : __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:160 [inline]
lr : __kvm_pgtable_walk+0x214/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
sp : ffff80008e6d76d0
x29: ffff80008e6d7770 x28: 0000000000000005 x27: fffe72652b203000
x26: fffe72652b203000 x25: 0000000000000000 x24: 0000000000000002
x23: 00000000000000ff x22: efff800000000000 x21: ffff80008e6d79d8
x20: 00000000000000ff x19: 00000000000000ff x18: 0000000000001b80
x17: 000000000538c42c x16: 000000006caef601 x15: fff0000072d85404
x14: 00000000000000ff x13: ffff80008e6d79e0 x12: ffff80008e6d79e8
x11: ffff80008e6d79e8 x10: 0000000000ff0100 x9 : ffff80008e6d7728
x8 : 0fffe72652b20300 x7 : ffff800080bc7858 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 00000000000000ff x3 : 0000000000000002
x2 : fffe72652b203000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:161 [inline] (P)
 __kvm_pgtable_walk+0x268/0xa68 arch/arm64/kvm/hyp/pgtable.c:237 (P)
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:207 [inline]
 __kvm_pgtable_walk+0x600/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:207 [inline]
 __kvm_pgtable_walk+0x600/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 _kvm_pgtable_walk arch/arm64/kvm/hyp/pgtable.c:260 [inline]
 kvm_pgtable_walk+0x294/0x468 arch/arm64/kvm/hyp/pgtable.c:283
 kvm_pgtable_stage2_destroy_range+0x60/0xb4 arch/arm64/kvm/hyp/pgtable.c:1563
 stage2_destroy_range arch/arm64/kvm/mmu.c:924 [inline]
 kvm_stage2_destroy arch/arm64/kvm/mmu.c:935 [inline]
 kvm_free_stage2_pgd+0x198/0x28c arch/arm64/kvm/mmu.c:1112
 kvm_uninit_stage2_mmu+0x20/0x38 arch/arm64/kvm/mmu.c:1023
 kvm_arch_flush_shadow_all+0x1a8/0x1e0 arch/arm64/kvm/nested.c:1113
 kvm_flush_shadow_all virt/kvm/kvm_main.c:343 [inline]
 kvm_mmu_notifier_release+0x48/0xa8 virt/kvm/kvm_main.c:884
 mmu_notifier_unregister+0x128/0x42c mm/mmu_notifier.c:815
 kvm_destroy_vm virt/kvm/kvm_main.c:1295 [inline]
 kvm_put_kvm+0x6a0/0xfa8 virt/kvm/kvm_main.c:1353
 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1376
 __fput+0x4ac/0x980 fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1bc/0x254 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x1bc/0x270 arch/arm64/kernel/entry-common.c:155
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:173 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:182 [inline]
 el0_svc+0xb8/0x164 arch/arm64/kernel/entry-common.c:880
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: f94023ec f9400fed a9017d3f f800813f (38686ac8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f94023ec 	ldr	x12, [sp, #64]
   4:	f9400fed 	ldr	x13, [sp, #24]
   8:	a9017d3f 	stp	xzr, xzr, [x9, #16]
   c:	f800813f 	stur	xzr, [x9, #8]
* 10:	38686ac8 	ldrb	w8, [x22, x8] <-- trapping instruction

final repro crashed as (corrupted=false):
==================================================================
BUG: KASAN: invalid-access in __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
BUG: KASAN: invalid-access in __kvm_pgtable_walk+0x8e4/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
Read of size 8 at addr 8af0000012dea000 by task syz.2.17/3618
Pointer tag: [8a], memory tag: [fe]

CPU: 0 UID: 0 PID: 3618 Comm: syz.2.17 Not tainted syzkaller #0 PREEMPT 
Hardware name: linux,dummy-virt (DT)
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xac/0x288 mm/kasan/report.c:378
 print_report+0x84/0xa0 mm/kasan/report.c:482
 kasan_report+0xb0/0x110 mm/kasan/report.c:595
 kasan_tag_mismatch+0x28/0x3c mm/kasan/sw_tags.c:175
 __hwasan_tag_mismatch+0x30/0x60 arch/arm64/lib/kasan_sw_tags.S:55
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
 __kvm_pgtable_walk+0x8e4/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 _kvm_pgtable_walk arch/arm64/kvm/hyp/pgtable.c:260 [inline]
 kvm_pgtable_walk+0x294/0x468 arch/arm64/kvm/hyp/pgtable.c:283
 kvm_pgtable_stage2_destroy_range+0x60/0xb4 arch/arm64/kvm/hyp/pgtable.c:1563
 stage2_destroy_range arch/arm64/kvm/mmu.c:924 [inline]
 kvm_stage2_destroy arch/arm64/kvm/mmu.c:935 [inline]
 kvm_free_stage2_pgd+0x198/0x28c arch/arm64/kvm/mmu.c:1112
 kvm_uninit_stage2_mmu+0x20/0x38 arch/arm64/kvm/mmu.c:1023
 kvm_arch_flush_shadow_all+0x1a8/0x1e0 arch/arm64/kvm/nested.c:1113
 kvm_flush_shadow_all virt/kvm/kvm_main.c:343 [inline]
 kvm_mmu_notifier_release+0x48/0xa8 virt/kvm/kvm_main.c:884
 mmu_notifier_unregister+0x128/0x42c mm/mmu_notifier.c:815
 kvm_destroy_vm virt/kvm/kvm_main.c:1295 [inline]
 kvm_put_kvm+0x6a0/0xfa8 virt/kvm/kvm_main.c:1353
 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1376
 __fput+0x4ac/0x980 fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1bc/0x254 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x1bc/0x270 arch/arm64/kernel/entry-common.c:155
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:173 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:182 [inline]
 el0_svc+0xb8/0x164 arch/arm64/kernel/entry-common.c:880
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xd0f0000012debb80 pfn:0x52dea
flags: 0x1ffdd4000000000(node=0|zone=0|lastcpupid=0x7ff|kasantag=0x75)
raw: 01ffdd4000000000 ffffc1ffc0888748 ffffc1ffc0887688 0000000000000000
raw: d0f0000012debb80 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 fff0000012de9e00: a5 a5 a5 a5 a5 a5 a5 a5 fe fe fe fe fe fe fe fe
 fff0000012de9f00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
>fff0000012dea000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
                   ^
 fff0000012dea100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
 fff0000012dea200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe
==================================================================
Unable to handle kernel paging request at virtual address ffff672652b20300
KASAN: probably wild-memory-access in range [0xfffe72652b203000-0xfffe72652b20300f]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
swapper pgtable: 4k pages, 52-bit VAs, pgdp=000000004769a000
[ffff672652b20300] pgd=100000004c636003, p4d=0000000000000000
Internal error: Oops: 0000000096000004 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 3618 Comm: syz.2.17 Tainted: G    B               syzkaller #0 PREEMPT 
Tainted: [B]=BAD_PAGE
Hardware name: linux,dummy-virt (DT)
pstate: 81402009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
pc : __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:163 [inline]
pc : __kvm_pgtable_walk+0x268/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
lr : kvm_dereference_pteref arch/arm64/include/asm/kvm_pgtable.h:389 [inline]
lr : __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:160 [inline]
lr : __kvm_pgtable_walk+0x214/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
sp : ffff80008e6d76d0
x29: ffff80008e6d7770 x28: 0000000000000005 x27: fffe72652b203000
x26: fffe72652b203000 x25: 0000000000000000 x24: 0000000000000002
x23: 00000000000000ff x22: efff800000000000 x21: ffff80008e6d79d8
x20: 00000000000000ff x19: 00000000000000ff x18: 0000000000001b80
x17: 000000000538c42c x16: 000000006caef601 x15: fff0000072d85404
x14: 00000000000000ff x13: ffff80008e6d79e0 x12: ffff80008e6d79e8
x11: ffff80008e6d79e8 x10: 0000000000ff0100 x9 : ffff80008e6d7728
x8 : 0fffe72652b20300 x7 : ffff800080bc7858 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 00000000000000ff x3 : 0000000000000002
x2 : fffe72652b203000 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:161 [inline] (P)
 __kvm_pgtable_walk+0x268/0xa68 arch/arm64/kvm/hyp/pgtable.c:237 (P)
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:207 [inline]
 __kvm_pgtable_walk+0x600/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 __kvm_pgtable_visit arch/arm64/kvm/hyp/pgtable.c:207 [inline]
 __kvm_pgtable_walk+0x600/0xa68 arch/arm64/kvm/hyp/pgtable.c:237
 _kvm_pgtable_walk arch/arm64/kvm/hyp/pgtable.c:260 [inline]
 kvm_pgtable_walk+0x294/0x468 arch/arm64/kvm/hyp/pgtable.c:283
 kvm_pgtable_stage2_destroy_range+0x60/0xb4 arch/arm64/kvm/hyp/pgtable.c:1563
 stage2_destroy_range arch/arm64/kvm/mmu.c:924 [inline]
 kvm_stage2_destroy arch/arm64/kvm/mmu.c:935 [inline]
 kvm_free_stage2_pgd+0x198/0x28c arch/arm64/kvm/mmu.c:1112
 kvm_uninit_stage2_mmu+0x20/0x38 arch/arm64/kvm/mmu.c:1023
 kvm_arch_flush_shadow_all+0x1a8/0x1e0 arch/arm64/kvm/nested.c:1113
 kvm_flush_shadow_all virt/kvm/kvm_main.c:343 [inline]
 kvm_mmu_notifier_release+0x48/0xa8 virt/kvm/kvm_main.c:884
 mmu_notifier_unregister+0x128/0x42c mm/mmu_notifier.c:815
 kvm_destroy_vm virt/kvm/kvm_main.c:1295 [inline]
 kvm_put_kvm+0x6a0/0xfa8 virt/kvm/kvm_main.c:1353
 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1376
 __fput+0x4ac/0x980 fs/file_table.c:468
 ____fput+0x20/0x58 fs/file_table.c:496
 task_work_run+0x1bc/0x254 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 do_notify_resume+0x1bc/0x270 arch/arm64/kernel/entry-common.c:155
 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:173 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:182 [inline]
 el0_svc+0xb8/0x164 arch/arm64/kernel/entry-common.c:880
 el0t_64_sync_handler+0x84/0x12c arch/arm64/kernel/entry-common.c:898
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:596
Code: f94023ec f9400fed a9017d3f f800813f (38686ac8) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	f94023ec 	ldr	x12, [sp, #64]
   4:	f9400fed 	ldr	x13, [sp, #24]
   8:	a9017d3f 	stp	xzr, xzr, [x9, #16]
   c:	f800813f 	stur	xzr, [x9, #8]
* 10:	38686ac8 	ldrb	w8, [x22, x8] <-- trapping instruction