last executing test programs: 190.839026ms ago: executing program 4 (id=204): socket$caif_seqpacket(0x25, 0x5, 0x0) 190.739326ms ago: executing program 0 (id=205): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/relabel', 0x2, 0x0) 156.177987ms ago: executing program 0 (id=214): close(0xffffffffffffffff) 113.396277ms ago: executing program 0 (id=219): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp1', 0x800, 0x0) 113.303217ms ago: executing program 4 (id=220): readahead(0xffffffffffffffff, 0x0, 0x0) 113.241108ms ago: executing program 3 (id=221): socket$packet(0x11, 0x2, 0x300) 113.015867ms ago: executing program 4 (id=224): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/access', 0x2, 0x0) 112.151417ms ago: executing program 4 (id=227): syz_open_dev$admmidi(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$admmidi(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$admmidi(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$admmidi(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$admmidi(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$admmidi(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$admmidi(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$admmidi(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$admmidi(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$admmidi(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$admmidi(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$admmidi(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$admmidi(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$admmidi(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$admmidi(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$admmidi(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$admmidi(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$admmidi(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$admmidi(&(0x7f0000000500), 0x4, 0x800) 67.436858ms ago: executing program 1 (id=228): sched_setparam(0x0, &(0x7f0000000000)) 67.289368ms ago: executing program 2 (id=229): syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 67.169468ms ago: executing program 3 (id=230): getgid() 67.121678ms ago: executing program 1 (id=231): getrlimit(0x0, &(0x7f0000000000)) 67.020508ms ago: executing program 3 (id=232): fchdir(0xffffffffffffffff) 66.990698ms ago: executing program 2 (id=233): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/access', 0x2, 0x0) 66.927948ms ago: executing program 0 (id=234): syz_open_dev$media(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$media(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$media(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$media(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$media(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$media(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$media(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$media(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$media(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$media(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$media(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$media(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$media(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$media(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$media(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$media(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$media(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$media(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$media(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$media(&(0x7f0000000500), 0x4, 0x800) 66.868438ms ago: executing program 3 (id=235): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/v4l/by-path/platform-soc@0:qcom_cam-req-mgr-video-index0', 0x2, 0x0) 40.158628ms ago: executing program 1 (id=236): syz_init_net_socket$x25(0x9, 0x5, 0x0) 39.926179ms ago: executing program 2 (id=237): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom', 0x800, 0x0) 39.752639ms ago: executing program 3 (id=238): syz_open_dev$rtc(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$rtc(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$rtc(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$rtc(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$rtc(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$rtc(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$rtc(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$rtc(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$rtc(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$rtc(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$rtc(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$rtc(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$rtc(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$rtc(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$rtc(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$rtc(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$rtc(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$rtc(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$rtc(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$rtc(&(0x7f0000000500), 0x4, 0x800) 39.576538ms ago: executing program 1 (id=239): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles', 0x800, 0x0) 39.350479ms ago: executing program 0 (id=240): io_setup(0x0, &(0x7f0000000000)) 39.248239ms ago: executing program 2 (id=241): preadv2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) 39.114888ms ago: executing program 3 (id=242): socket$phonet_pipe(0x23, 0x5, 0x2) 38.268469ms ago: executing program 2 (id=243): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/kernel/yama/ptrace_scope', 0x2, 0x0) 762.83µs ago: executing program 1 (id=244): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/i915', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/i915', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/i915', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/i915', 0x800, 0x0) 608.87µs ago: executing program 2 (id=245): capget(&(0x7f0000000000), &(0x7f0000000000)) 507.19µs ago: executing program 4 (id=246): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) 285.59µs ago: executing program 0 (id=248): syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) 148.83µs ago: executing program 1 (id=249): personality(0x0) 0s ago: executing program 4 (id=250): readv(0xffffffffffffffff, &(0x7f0000000000), 0x0) 0s ago: executing program 1 (id=253): io_cancel(0x0, &(0x7f0000000000), &(0x7f0000000000)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.97' (ED25519) to the list of known hosts. [ 27.147558][ T4031] cgroup: Unknown subsys name 'net' [ 27.396000][ T4031] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 27.677984][ T4031] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 29.384154][ T4302] Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP [ 29.385385][ T4302] Modules linked in: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 29.385946][ T4302] CPU: 1 PID: 4302 Comm: syz.1.253 Not tainted syzkaller #0 [ 29.387024][ T4302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 [ 29.388547][ T4302] pstate: 42400405 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=jc) [ 29.389723][ T4302] pc : lookup_ioctx+0x108/0x7d0 [ 29.390450][ T4302] lr : lookup_ioctx+0xe4/0x7d0 [ 29.391165][ T4302] sp : ffff80001f9a7cf0 [ 29.391840][ T4302] x29: ffff80001f9a7cf0 x28: ffff0000d8868000 x27: 0000000000000000 [ 29.393169][ T4302] x26: 1fffe0001b10d000 x25: 0000000000400040 x24: ffff0000c7edae00 [ 29.394437][ T4302] x23: dfff800000000000 x22: 00000000fffffff2 x21: 0000000000000000 [ 29.395645][ T4302] x20: ffff0000d8868000 x19: 0000000000000000 x18: 0000000000000000 [ 29.396954][ T4302] x17: 0000000000000000 x16: ffff800008a1a0d8 x15: 0000000000000000 [ 29.398209][ T4302] x14: 0000000000000000 x13: 1ffff0000283006b x12: 0000000000ff0100 [ 29.399517][ T4302] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000ffffffffffff [ 29.400839][ T4302] x8 : 0000000000000000 x7 : ffff800008751314 x6 : 0000000000000000 [ 29.402162][ T4302] x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001 [ 29.403426][ T4302] x2 : 0000000000000008 x1 : 0000000000000001 x0 : 0000000000000000 [ 29.404628][ T4302] Call trace: [ 29.405172][ T4302] lookup_ioctx+0x108/0x7d0 [ 29.405909][ T4302] __arm64_sys_io_cancel+0x160/0x338 [ 29.406699][ T4302] invoke_syscall+0x98/0x2b8 [ 29.407437][ T4302] el0_svc_common+0x138/0x258 [ 29.408102][ T4302] do_el0_svc+0x58/0x14c [ 29.408694][ T4302] el0_svc+0x78/0x1e0 [ 29.409298][ T4302] el0t_64_sync_handler+0xcc/0xe4 [ 29.410065][ T4302] el0t_64_sync+0x1a0/0x1a4 [ 29.410760][ T4302] Code: d503229f 2a1f03f6 2a1f03e0 b8400953 (2a1603e1) [ 29.411769][ T4302] ---[ end trace 930e35234a5698bb ]--- [ 29.584980][ T4302] Kernel panic - not syncing: Oops - BTI: Fatal exception [ 29.586132][ T4302] SMP: stopping secondary CPUs [ 29.586865][ T4302] Kernel Offset: disabled [ 29.587515][ T4302] CPU features: 0x8,000003c1,7d33ffd9 [ 29.588332][ T4302] Memory Limit: none [ 29.751955][ T4302] Rebooting in 86400 seconds..