last executing test programs: 83.007087ms ago: executing program 1 (id=109): pidfd_open(0x0, 0x0) 82.973217ms ago: executing program 3 (id=110): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys', 0x0, 0x0) 82.937847ms ago: executing program 4 (id=111): lsm_get_self_attr(0x0, &(0x7f0000000000), &(0x7f0000000000), 0x0) 82.690667ms ago: executing program 3 (id=113): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/pktcdvd/control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control', 0x800, 0x0) 82.549427ms ago: executing program 1 (id=115): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 82.517677ms ago: executing program 2 (id=116): socket$nl_generic(0x10, 0x3, 0x10) 57.972588ms ago: executing program 4 (id=117): accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) 57.862908ms ago: executing program 3 (id=118): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/cmdline', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/cmdline', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/cmdline', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/cmdline', 0x800, 0x0) 57.787878ms ago: executing program 0 (id=119): timer_settime(0x0, 0x0, &(0x7f0000000000), 0x0) 57.680658ms ago: executing program 2 (id=120): getresgid(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) 57.478348ms ago: executing program 4 (id=121): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rnullb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rnullb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rnullb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rnullb0', 0x800, 0x0) 57.361818ms ago: executing program 2 (id=122): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/relabel-self', 0x2, 0x0) 57.218418ms ago: executing program 3 (id=123): syz_open_dev$sndhw(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sndhw(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sndhw(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sndhw(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sndhw(&(0x7f0000000140), 0xa, 0x0) syz_open_dev$sndhw(&(0x7f0000000180), 0xa, 0x1) syz_open_dev$sndhw(&(0x7f00000001c0), 0xa, 0x2) syz_open_dev$sndhw(&(0x7f0000000200), 0xa, 0x800) syz_open_dev$sndhw(&(0x7f0000000240), 0x14, 0x0) syz_open_dev$sndhw(&(0x7f0000000280), 0x14, 0x1) syz_open_dev$sndhw(&(0x7f00000002c0), 0x14, 0x2) syz_open_dev$sndhw(&(0x7f0000000300), 0x14, 0x800) syz_open_dev$sndhw(&(0x7f0000000340), 0x1e, 0x0) syz_open_dev$sndhw(&(0x7f0000000380), 0x1e, 0x1) syz_open_dev$sndhw(&(0x7f00000003c0), 0x1e, 0x2) syz_open_dev$sndhw(&(0x7f0000000400), 0x1e, 0x800) syz_open_dev$sndhw(&(0x7f0000000440), 0x28, 0x0) syz_open_dev$sndhw(&(0x7f0000000480), 0x28, 0x1) syz_open_dev$sndhw(&(0x7f00000004c0), 0x28, 0x2) syz_open_dev$sndhw(&(0x7f0000000500), 0x28, 0x800) 56.844178ms ago: executing program 0 (id=124): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/class/mac80211_hwsim/', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/class/mac80211_hwsim/', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/class/mac80211_hwsim/', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/class/mac80211_hwsim/', 0x800, 0x0) 29.261049ms ago: executing program 1 (id=125): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwbinder', 0x800, 0x0) 29.147409ms ago: executing program 4 (id=126): nanosleep(&(0x7f0000000000), 0x0) 29.056409ms ago: executing program 2 (id=127): kcmp(0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff) 28.930919ms ago: executing program 0 (id=128): set_mempolicy_home_node(0x0, 0x0, 0x0, 0x0) 28.782979ms ago: executing program 1 (id=129): lremovexattr(&(0x7f0000000000), &(0x7f0000000000)) 28.742469ms ago: executing program 0 (id=130): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 28.451069ms ago: executing program 2 (id=131): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control', 0x800, 0x0) 28.368559ms ago: executing program 3 (id=132): sched_getattr(0x0, &(0x7f0000000000), 0x0, 0x0) 744.33µs ago: executing program 4 (id=133): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/kernel/yama/ptrace_scope', 0x2, 0x0) 524.51µs ago: executing program 1 (id=134): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/tlk_device', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/tlk_device', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/tlk_device', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/tlk_device', 0x800, 0x0) 434.32µs ago: executing program 0 (id=135): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cdrom1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cdrom1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cdrom1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cdrom1', 0x800, 0x0) 335.74µs ago: executing program 3 (id=136): socket$phonet(0x23, 0x2, 0x1) 193.61µs ago: executing program 2 (id=137): fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) 113.83µs ago: executing program 4 (id=138): msgget(0xffffffffffffffff, 0x0) 78.7µs ago: executing program 0 (id=139): shmctl$IPC_INFO(0x0, 0x3, &(0x7f0000000000)) 0s ago: executing program 1 (id=140): init_module(&(0x7f0000000000), 0x0, &(0x7f0000000000)) 0s ago: executing program 0 (id=144): io_destroy(0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.181' (ED25519) to the list of known hosts. [ 29.424007][ T4034] cgroup: Unknown subsys name 'net' [ 29.679084][ T4034] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 29.958105][ T4034] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 31.141287][ T4195] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 31.142557][ T4195] Modules linked in: [ 31.143214][ T4195] CPU: 1 PID: 4195 Comm: syz.0.144 Not tainted syzkaller #0 [ 31.144458][ T4195] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 31.146210][ T4195] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 31.147516][ T4195] pc : lookup_ioctx+0x108/0x7c8 [ 31.148309][ T4195] lr : lookup_ioctx+0xe4/0x7c8 [ 31.149113][ T4195] sp : ffff80001fa87c40 [ 31.149782][ T4195] x29: ffff80001fa87c40 x28: ffff0000c22f0000 x27: 0000000000000000 [ 31.151124][ T4195] x26: 1fffe0001845e000 x25: 1ffff00003f50fd6 x24: ffff0000d2482e00 [ 31.152394][ T4195] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 31.153705][ T4195] x20: ffff0000c22f0000 x19: 0000000000000000 x18: 0000000000000000 [ 31.155061][ T4195] x17: 0000000000000000 x16: ffff800008a23b90 x15: 0000000000000000 [ 31.156453][ T4195] x14: 0000000000000003 x13: 1ffff0000285402b x12: 0000000000ff0100 [ 31.157795][ T4195] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000ffffffffffff [ 31.159141][ T4195] x8 : 0000000000000000 x7 : ffff800008758fbc x6 : 0000000000000000 [ 31.160470][ T4195] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 31.161779][ T4195] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 31.163144][ T4195] Call trace: [ 31.163792][ T4195] lookup_ioctx+0x108/0x7c8 [ 31.164596][ T4195] __arm64_sys_io_destroy+0x9c/0x1d8 [ 31.165523][ T4195] invoke_syscall+0x98/0x2b0 [ 31.166316][ T4195] el0_svc_common+0x138/0x258 [ 31.167092][ T4195] do_el0_svc+0x58/0x13c [ 31.167834][ T4195] el0_svc+0x78/0x1d0 [ 31.168506][ T4195] el0t_64_sync_handler+0xcc/0xe4 [ 31.169406][ T4195] el0t_64_sync+0x1a0/0x1a4 [ 31.170199][ T4195] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 31.171326][ T4195] ---[ end trace 78eee382d1f431dd ]--- [ 31.359358][ T4195] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 31.360566][ T4195] SMP: stopping secondary CPUs [ 31.361446][ T4195] Kernel Offset: disabled [ 31.362131][ T4195] CPU features: 0x8,000003c1,7d33ffd9 [ 31.363039][ T4195] Memory Limit: none [ 31.546257][ T4195] Rebooting in 86400 seconds..