last executing test programs: 77.754368ms ago: executing program 1 (id=148): unlinkat(0xffffffffffffffff, &(0x7f0000000000), 0x0) 77.612138ms ago: executing program 2 (id=149): msgsnd(0x0, &(0x7f0000000000), 0x0, 0x0) 77.491938ms ago: executing program 3 (id=150): open(&(0x7f0000000000), 0x0, 0x0) 77.355488ms ago: executing program 4 (id=151): msgrcv(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) 77.112628ms ago: executing program 0 (id=152): set_robust_list(&(0x7f0000000000), 0x0) 55.974579ms ago: executing program 1 (id=153): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nullb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nullb0', 0x800, 0x0) 55.737589ms ago: executing program 2 (id=154): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nmem0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nmem0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nmem0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nmem0', 0x800, 0x0) 55.665109ms ago: executing program 3 (id=155): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/iommu', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/iommu', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/iommu', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/iommu', 0x800, 0x0) 55.396869ms ago: executing program 4 (id=156): mlock(0x0, 0x0) 55.123369ms ago: executing program 0 (id=157): gettid() 54.984109ms ago: executing program 1 (id=158): renameat2(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0) 54.649679ms ago: executing program 2 (id=159): seccomp$SECCOMP_GET_ACTION_AVAIL(0x2, 0x0, &(0x7f0000000000)) 27.535919ms ago: executing program 1 (id=160): syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) 27.143019ms ago: executing program 3 (id=161): socket$netlink(0x10, 0x3, 0x0) 26.961659ms ago: executing program 4 (id=162): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 26.922039ms ago: executing program 0 (id=163): lseek(0xffffffffffffffff, 0x0, 0x0) 26.864739ms ago: executing program 2 (id=164): ftruncate(0xffffffffffffffff, 0x0) 26.628629ms ago: executing program 3 (id=165): sched_getattr(0x0, &(0x7f0000000000), 0x0, 0x0) 26.389419ms ago: executing program 4 (id=166): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/renderD128', 0x2, 0x0) 26.258929ms ago: executing program 1 (id=167): munmap(0x0, 0x0) 26.197719ms ago: executing program 2 (id=168): socket$inet6_udplite(0xa, 0x2, 0x88) 1.81144ms ago: executing program 0 (id=169): shmget(0xffffffffffffffff, 0x0, 0x0, 0x0) 1.33188ms ago: executing program 1 (id=170): prlimit64(0x0, 0x0, 0x0, 0x0) 1.12581ms ago: executing program 2 (id=171): vmsplice(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 966.62µs ago: executing program 3 (id=172): sched_rr_get_interval(0x0, &(0x7f0000000000)) 766.55µs ago: executing program 4 (id=173): umount2(&(0x7f0000000000), 0x0) 621.66µs ago: executing program 0 (id=174): signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 524.17µs ago: executing program 0 (id=175): timer_settime(0x0, 0x0, &(0x7f0000000000), 0x0) 345.9µs ago: executing program 3 (id=176): io_cancel(0x0, &(0x7f0000000000), &(0x7f0000000000)) 0s ago: executing program 4 (id=177): pipe2(&(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.46' (ED25519) to the list of known hosts. [ 29.848328][ T4036] cgroup: Unknown subsys name 'net' [ 30.139967][ T4036] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 30.454338][ T4036] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 31.248522][ T4063] mmap: syz.0.10 (4063) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 31.285570][ T4072] uffd: Set unprivileged_userfaultfd sysctl knob to 1 if kernel faults must be handled without obtaining CAP_SYS_PTRACE capability [ 31.842484][ T4229] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 31.843861][ T4229] Modules linked in: [ 31.844495][ T4229] CPU: 0 PID: 4229 Comm: syz.3.176 Not tainted syzkaller #0 SYZFAIL: failed to send rpc [ 31.845903][ T4229] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 fd=3 want=160 sent=0 n=-1 (errno 32: Broken pipe) [ 31.847694][ T4229] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 31.849012][ T4229] pc : lookup_ioctx+0x10c/0x7c0 [ 31.849835][ T4229] lr : lookup_ioctx+0xe8/0x7c0 [ 31.850642][ T4229] sp : ffff80001fa77cf0 [ 31.851333][ T4229] x29: ffff80001fa77cf0 x28: ffff0000ccc4b680 x27: 0000000000000000 [ 31.852618][ T4229] x26: 1fffe000199896d0 x25: 0000000000400040 x24: ffff0000d2d7e780 [ 31.853971][ T4229] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 31.855300][ T4229] x20: ffff0000ccc4b680 x19: 0000000000000000 x18: 0000000000000000 [ 31.856535][ T4229] x17: 0000000000000000 x16: ffff800008a30084 x15: 0000000000000000 [ 31.857857][ T4229] x14: 0000000000000003 x13: 1ffff0000287002b x12: 0000000097863b1e [ 31.859156][ T4229] x11: ff80800008a30060 x10: 0000000000000000 x9 : 0000ffffffffffff [ 31.860495][ T4229] x8 : 0000000000000000 x7 : ffff800008762410 x6 : 0000000000000000 [ 31.861795][ T4229] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 31.863051][ T4229] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 31.864408][ T4229] Call trace: [ 31.864890][ T4229] lookup_ioctx+0x10c/0x7c0 [ 31.865681][ T4229] __arm64_sys_io_cancel+0x160/0x33c [ 31.866502][ T4229] invoke_syscall+0x98/0x2b0 [ 31.867257][ T4229] el0_svc_common+0x13c/0x258 [ 31.868004][ T4229] do_el0_svc+0x5c/0x140 [ 31.868661][ T4229] el0_svc+0x78/0x1d0 [ 31.869343][ T4229] el0t_64_sync_handler+0xcc/0xe4 [ 31.870182][ T4229] el0t_64_sync+0x1a0/0x1a4 [ 31.870912][ T4229] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 31.872021][ T4229] ---[ end trace feb04a77135f192d ]--- [ 32.055089][ T4229] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 32.056299][ T4229] SMP: stopping secondary CPUs [ 32.057078][ T4229] Kernel Offset: disabled [ 32.057859][ T4229] CPU features: 0x8,000003c1,7d33ffd9 [ 32.058765][ T4229] Memory Limit: none [ 32.238053][ T4229] Rebooting in 86400 seconds..