last executing test programs: 89.628645ms ago: executing program 0 (id=16): keyctl$KEYCTL_CAPABILITIES(0x1f, &(0x7f0000000000), 0x0) 89.555395ms ago: executing program 3 (id=17): read(0xffffffffffffffff, &(0x7f0000000000), 0x0) 89.518055ms ago: executing program 4 (id=18): quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)) 89.350145ms ago: executing program 2 (id=20): socket$vsock_stream(0x28, 0x1, 0x0) 89.249855ms ago: executing program 3 (id=21): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)) 89.198575ms ago: executing program 4 (id=22): getsockname(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 61.311086ms ago: executing program 0 (id=23): syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) 61.164536ms ago: executing program 1 (id=24): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/raw-gadget', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/raw-gadget', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/raw-gadget', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/raw-gadget', 0x800, 0x0) 61.044746ms ago: executing program 1 (id=25): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsu', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsu', 0x800, 0x0) 60.922426ms ago: executing program 2 (id=26): close(0xffffffffffffffff) 60.838376ms ago: executing program 3 (id=27): accept4(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) 60.797166ms ago: executing program 4 (id=28): epoll_pwait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0) 60.759636ms ago: executing program 0 (id=29): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control', 0x800, 0x0) 60.688826ms ago: executing program 1 (id=30): getcwd(&(0x7f0000000000), 0x0) 33.086118ms ago: executing program 4 (id=31): process_madvise(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 32.979058ms ago: executing program 2 (id=32): memfd_create(&(0x7f0000000000), 0x0) 32.867228ms ago: executing program 3 (id=33): socket$nl_audit(0x10, 0x3, 0x9) 32.775018ms ago: executing program 0 (id=34): fsync(0xffffffffffffffff) 32.684418ms ago: executing program 1 (id=35): getpeername(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 32.614618ms ago: executing program 4 (id=36): socket$nl_netfilter(0x10, 0x3, 0xc) 32.593068ms ago: executing program 2 (id=37): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 32.547858ms ago: executing program 3 (id=38): waitid(0x0, 0x0, 0x0, 0x0, 0x0) 749.649µs ago: executing program 0 (id=39): seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)) 551.289µs ago: executing program 1 (id=40): getgid() 471.329µs ago: executing program 2 (id=41): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/asound/card0/oss_mixer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/asound/card0/oss_mixer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/asound/card0/oss_mixer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/asound/card0/oss_mixer', 0x800, 0x0) 376.96µs ago: executing program 3 (id=42): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/trusty-ipc-dev0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/trusty-ipc-dev0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/trusty-ipc-dev0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/trusty-ipc-dev0', 0x800, 0x0) 260.86µs ago: executing program 4 (id=43): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttynull', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttynull', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttynull', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttynull', 0x800, 0x0) 172.269µs ago: executing program 0 (id=44): acct(0x0) 74.66µs ago: executing program 1 (id=45): pwritev(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 0s ago: executing program 2 (id=46): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/access', 0x2, 0x0) 0s ago: executing program 2 (id=48): io_getevents(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.167' (ED25519) to the list of known hosts. [ 27.582051][ T4031] cgroup: Unknown subsys name 'net' [ 27.846671][ T4031] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 28.123541][ T4031] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 29.008287][ T4097] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 29.009648][ T4097] Modules linked in: [ 29.010272][ T4097] CPU: 0 PID: 4097 Comm: syz.2.48 Not tainted syzkaller #0 [ 29.011453][ T4097] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 29.012818][ T4097] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 29.013843][ T4097] pc : lookup_ioctx+0x108/0x7c8 [ 29.014496][ T4097] lr : lookup_ioctx+0xe4/0x7c8 [ 29.015130][ T4097] sp : ffff80001f397b20 [ 29.015659][ T4097] x29: ffff80001f397b20 x28: ffff0000c82ab680 x27: dfff800000000000 [ 29.016681][ T4097] x26: ffff80001f397b80 x25: ffff700003e72f70 x24: ffff0000c8be3f40 [ 29.017703][ T4097] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 29.018758][ T4097] x20: ffff0000c82ab680 x19: 0000000000000000 x18: 0000000000000000 [ 29.020028][ T4097] x17: 0000000000000000 x16: ffff800008a23a84 x15: 0000000000000000 [ 29.021235][ T4097] x14: 0000000000000002 x13: 1ffff0000285402b x12: 0000000000ff0100 [ 29.022531][ T4097] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000ffffffffffff [ 29.023865][ T4097] x8 : 0000000000000000 x7 : ffff800008758eb0 x6 : 0000000000000000 [ 29.025186][ T4097] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 29.026470][ T4097] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 29.027811][ T4097] Call trace: [ 29.028380][ T4097] lookup_ioctx+0x108/0x7c8 [ 29.029123][ T4097] do_io_getevents+0x12c/0x3c8 [ 29.029933][ T4097] __arm64_sys_io_getevents+0x164/0x248 [ 29.030881][ T4097] invoke_syscall+0x98/0x2b0 [ 29.031624][ T4097] el0_svc_common+0x138/0x258 [ 29.032429][ T4097] do_el0_svc+0x58/0x13c [ 29.033003][ T4097] el0_svc+0x78/0x1d0 [ 29.033658][ T4097] el0t_64_sync_handler+0xcc/0xe4 [ 29.034444][ T4097] el0t_64_sync+0x1a0/0x1a4 [ 29.035103][ T4097] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 29.036073][ T4097] ---[ end trace 7d94b1347d86cb04 ]--- [ 29.090545][ T4098] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 29.214689][ T4097] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 29.215926][ T4097] SMP: stopping secondary CPUs [ 29.216703][ T4097] Kernel Offset: disabled [ 29.217413][ T4097] CPU features: 0x8,000003c1,7d33ffd9 [ 29.218306][ T4097] Memory Limit: none [ 29.391155][ T4097] Rebooting in 86400 seconds..