last executing test programs: 91.927915ms ago: executing program 2 (id=9): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 91.830666ms ago: executing program 0 (id=10): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/mm/ksm/run', 0x1, 0x0) 91.611516ms ago: executing program 2 (id=13): syz_init_net_socket$llc(0x1a, 0x1, 0x0) 91.520866ms ago: executing program 4 (id=14): getsockname(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 62.195457ms ago: executing program 1 (id=15): connect(0xffffffffffffffff, &(0x7f0000000000), 0x0) 62.086727ms ago: executing program 0 (id=16): sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 62.022207ms ago: executing program 3 (id=17): fsetxattr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0) 61.987017ms ago: executing program 2 (id=18): syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) 61.945257ms ago: executing program 4 (id=19): map_shadow_stack(0x0, 0x0, 0x0) 61.815037ms ago: executing program 3 (id=20): faccessat2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 61.723847ms ago: executing program 1 (id=21): sched_setaffinity(0x0, 0x0, &(0x7f0000000000)) 61.662617ms ago: executing program 0 (id=22): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 61.435367ms ago: executing program 3 (id=23): syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 32.394278ms ago: executing program 4 (id=24): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm', 0x2, 0x0) 32.269159ms ago: executing program 1 (id=25): socket$isdn(0x22, 0x3, 0x0) 32.237259ms ago: executing program 3 (id=26): dup(0xffffffffffffffff) 32.156708ms ago: executing program 0 (id=27): set_tid_address(&(0x7f0000000000)) 32.089029ms ago: executing program 2 (id=28): ptrace(0x0, 0x0) 32.034469ms ago: executing program 2 (id=29): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2', 0x800, 0x0) 31.995998ms ago: executing program 4 (id=30): quotactl_fd$Q_GETFMT(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000000)) 31.933418ms ago: executing program 1 (id=31): prctl$0(0x0, 0x0, 0x0, 0x0, 0x0) 31.902749ms ago: executing program 3 (id=32): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user', 0x2, 0x0) 985.43µs ago: executing program 0 (id=33): accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) 789.75µs ago: executing program 4 (id=34): recvfrom(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 686.03µs ago: executing program 3 (id=35): bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0) 564.94µs ago: executing program 1 (id=36): io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) 290.61µs ago: executing program 1 (id=37): io_pgetevents(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) 150.36µs ago: executing program 4 (id=38): syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 68.77µs ago: executing program 0 (id=39): signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 0s ago: executing program 2 (id=40): fchdir(0xffffffffffffffff) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.255' (ED25519) to the list of known hosts. [ 27.135856][ T4033] cgroup: Unknown subsys name 'net' [ 27.460017][ T4033] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 27.772271][ T4033] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 28.668956][ T4087] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 28.670145][ T4087] Modules linked in: [ 28.670734][ T4087] CPU: 0 PID: 4087 Comm: syz.1.37 Not tainted syzkaller #0 [ 28.671893][ T4087] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 [ 28.673497][ T4087] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 28.674704][ T4087] pc : lookup_ioctx+0x108/0x7d0 [ 28.675453][ T4087] lr : lookup_ioctx+0xe4/0x7d0 [ 28.676202][ T4087] sp : ffff80001f167ac0 [ 28.676840][ T4087] x29: ffff80001f167ac0 x28: dfff800000000000 x27: dfff800000000000 [ 28.678059][ T4087] x26: ffff80001f167b20 x25: ffff700003e2cf64 x24: ffff0000d9bd9140 [ 28.679239][ T4087] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 28.680459][ T4087] x20: ffff0000c7cbd1c0 x19: 0000000000000000 x18: 0000000000000000 [ 28.681655][ T4087] x17: 0000000000000000 x16: ffff800008a1a2c8 x15: 0000000000000000 [ 28.682885][ T4087] x14: 0000000000000000 x13: 1ffff0000283206b x12: 0000000000ff0100 [ 28.684104][ T4087] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000ffffffffffff [ 28.685328][ T4087] x8 : 0000000000000000 x7 : ffff80000875107c x6 : 0000000000000000 [ 28.686673][ T4087] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 28.687931][ T4087] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 28.689165][ T4087] Call trace: [ 28.689694][ T4087] lookup_ioctx+0x108/0x7d0 [ 28.690394][ T4087] do_io_getevents+0x120/0x394 [ 28.691095][ T4087] __arm64_sys_io_pgetevents+0x2ec/0x4f8 [ 28.691928][ T4087] invoke_syscall+0x98/0x2b8 [ 28.692638][ T4087] el0_svc_common+0x138/0x258 [ 28.693371][ T4087] do_el0_svc+0x58/0x14c [ 28.694090][ T4087] el0_svc+0x78/0x1e0 [ 28.694729][ T4087] el0t_64_sync_handler+0xcc/0xe4 [ 28.695533][ T4087] el0t_64_sync+0x1a0/0x1a4 [ 28.696275][ T4087] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 28.697369][ T4087] ---[ end trace 4ebeb0d79cc049ff ]--- SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 28.883763][ T4087] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 28.884841][ T4087] SMP: stopping secondary CPUs [ 28.885493][ T4087] Kernel Offset: disabled [ 28.886126][ T4087] CPU features: 0x8,000003c1,7d33ffd9 [ 28.886879][ T4087] Memory Limit: none [ 29.065827][ T4087] Rebooting in 86400 seconds..