last executing test programs: 122.414796ms ago: executing program 2 (id=23): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)) 87.123207ms ago: executing program 2 (id=27): io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) 87.039787ms ago: executing program 3 (id=28): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qrtr-tun', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qrtr-tun', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qrtr-tun', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qrtr-tun', 0x800, 0x0) 86.870827ms ago: executing program 0 (id=30): fcntl$F_GET_FILE_RW_HINT(0xffffffffffffffff, 0x40d, &(0x7f0000000000)) 86.779247ms ago: executing program 2 (id=31): read(0xffffffffffffffff, &(0x7f0000000000), 0x0) 86.552277ms ago: executing program 3 (id=33): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci', 0x800, 0x0) 57.420778ms ago: executing program 0 (id=34): sendto(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 57.341988ms ago: executing program 2 (id=35): inotify_init1(0x0) 57.289768ms ago: executing program 4 (id=36): mremap(0x0, 0x0, 0x0, 0x0, 0x0) 57.231808ms ago: executing program 0 (id=37): socket$inet_udp(0x2, 0x2, 0x0) 57.196918ms ago: executing program 2 (id=38): socket$inet6_tcp(0xa, 0x1, 0x0) 57.159098ms ago: executing program 1 (id=39): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 57.105448ms ago: executing program 3 (id=40): execveat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0) 57.068448ms ago: executing program 4 (id=41): fstat(0xffffffffffffffff, &(0x7f0000000000)) 29.876989ms ago: executing program 0 (id=42): shmget(0xffffffffffffffff, 0x0, 0x0, 0x0) 29.790349ms ago: executing program 1 (id=43): recvmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0) 29.718009ms ago: executing program 2 (id=44): socket$key(0xf, 0x3, 0x2) 29.646359ms ago: executing program 4 (id=45): msgctl$IPC_INFO(0x0, 0x3, &(0x7f0000000000)) 29.581339ms ago: executing program 3 (id=46): getpeername(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 29.517239ms ago: executing program 0 (id=47): setxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0) 29.459489ms ago: executing program 1 (id=48): ptrace(0x0, 0x0) 29.408499ms ago: executing program 4 (id=49): socket$nl_generic(0x10, 0x3, 0x10) 629.13µs ago: executing program 4 (id=50): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/v4l/by-path/platform-soc@0:qcom_cam-req-mgr-video-index0', 0x2, 0x0) 567.17µs ago: executing program 0 (id=51): open(&(0x7f0000000000), 0x0, 0x0) 507.76µs ago: executing program 1 (id=52): fsetxattr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0) 453.26µs ago: executing program 3 (id=53): socket$pppl2tp(0x18, 0x1, 0x1) 386.06µs ago: executing program 1 (id=54): delete_module(&(0x7f0000000000), 0x0) 221.26µs ago: executing program 3 (id=55): getuid() 53.04µs ago: executing program 4 (id=56): tgkill(0x0, 0x0, 0x0) 0s ago: executing program 1 (id=57): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x14) 0s ago: executing program 3 (id=60): io_destroy(0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.227' (ED25519) to the list of known hosts. [ 28.904462][ T4035] cgroup: Unknown subsys name 'net' [ 29.191787][ T4035] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.478436][ T4035] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 30.296108][ T4078] mmap: syz.4.29 (4078) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst. [ 30.421418][ T4111] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 30.422708][ T4111] Modules linked in: [ 30.423366][ T4111] CPU: 0 PID: 4111 Comm: syz.3.60 Not tainted syzkaller #0 [ 30.424540][ T4111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 30.426234][ T4111] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 30.427500][ T4111] pc : lookup_ioctx+0x108/0x7c8 [ 30.428360][ T4111] lr : lookup_ioctx+0xe4/0x7c8 [ 30.429187][ T4111] sp : ffff80001f2a7c40 [ 30.429865][ T4111] x29: ffff80001f2a7c40 x28: ffff0000cb7751c0 x27: 0000000000000000 [ 30.431315][ T4111] x26: 1fffe000196eea38 x25: 1ffff00003e54fd6 x24: ffff0000d2e3a280 [ 30.432646][ T4111] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 30.433993][ T4111] x20: ffff0000cb7751c0 x19: 0000000000000000 x18: 0000000000000000 [ 30.435360][ T4111] x17: 0000000000000000 x16: ffff800008a23b90 x15: 0000000000000000 [ 30.436681][ T4111] x14: 0000000000000003 x13: 1ffff0000285402b x12: 0000000000ff0100 [ 30.438013][ T4111] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000ffffffffffff [ 30.439319][ T4111] x8 : 0000000000000000 x7 : ffff800008758fbc x6 : 0000000000000000 [ 30.440730][ T4111] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 30.442059][ T4111] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 30.443494][ T4111] Call trace: [ 30.444057][ T4111] lookup_ioctx+0x108/0x7c8 [ 30.444869][ T4111] __arm64_sys_io_destroy+0x9c/0x1d8 [ 30.445717][ T4111] invoke_syscall+0x98/0x2b0 [ 30.446517][ T4111] el0_svc_common+0x138/0x258 [ 30.447270][ T4111] do_el0_svc+0x58/0x13c [ 30.447929][ T4111] el0_svc+0x78/0x1d0 [ 30.448599][ T4111] el0t_64_sync_handler+0xcc/0xe4 [ 30.449427][ T4111] el0t_64_sync+0x1a0/0x1a4 [ 30.450179][ T4111] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 30.451360][ T4111] ---[ end trace 4ccba5a44c34d4f3 ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 30.640451][ T4111] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 30.641450][ T4111] SMP: stopping secondary CPUs [ 30.642165][ T4111] Kernel Offset: disabled [ 30.642797][ T4111] CPU features: 0x8,000003c1,7d33ffd9 [ 30.643530][ T4111] Memory Limit: none [ 30.835463][ T4111] Rebooting in 86400 seconds..