Extracting prog: 2m8.851349605s Minimizing prog: 37.87µs Simplifying prog options: 5m48.855143033s Extracting C: 1m21.858389302s Simplifying C: 7m37.394692294s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in do_futex single: successfully extracted reproducer found reproducer with 1 syscalls minimizing guilty program extracting C reproducer testing compiled C program (duration=45.398251005s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in sys_mount a never seen crash title: Internal error in sys_mount, ignore simplifying guilty program options testing program (duration=45.398251005s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in do_futex extracting C reproducer testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in sys_mount a never seen crash title: Internal error in sys_mount, ignore testing program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in do_futex extracting C reproducer testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex simplifying C reproducer testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex testing compiled C program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex program crashed: Internal error in do_futex testing program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in sys_mount validation run: crashed=true testing program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in do_futex validation run: crashed=true testing program (duration=45.398251005s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): futex detailed listing: executing program 0: futex(0x0, 0x85, 0x0, 0x0, 0x0, 0x11000000) program crashed: Internal error in do_futex validation run: crashed=true reproducing took 21m54.072579569s repro crashed as (corrupted=false): Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4186 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 82000405 (Nzcv daif -PAN -UAO +TCO -DIT -SSBS BTYPE=jc) pc : arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] pc : futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] pc : futex_wake_op kernel/futex/core.c:1779 [inline] pc : do_futex+0x804/0x257c kernel/futex/core.c:3993 lr : __uaccess_enable_tco arch/arm64/include/asm/uaccess.h:188 [inline] lr : uaccess_enable_privileged arch/arm64/include/asm/uaccess.h:221 [inline] lr : arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] lr : futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] lr : futex_wake_op kernel/futex/core.c:1779 [inline] lr : do_futex+0x7d0/0x257c kernel/futex/core.c:3993 sp : ffff80001fce78a0 x29: ffff80001fce7c20 x28: 00000000fffffff2 x27: 0000000011000000 x26: ffff0000cd5e51c0 x25: 0000000000000001 x24: 0000000000000001 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000000000 x19: 1fffe00019abcce1 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000083bf97c x15: 0000000000000004 x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000000 x11: 00000000fffffff5 x10: 00000000fffffff2 x9 : ffff8000083bf948 x8 : 0000000000000080 x7 : ffff8000083bf6f4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d608c x2 : 0000000000000001 x1 : ffff80001435cb90 x0 : 0000000000000001 Call trace: arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] futex_wake_op kernel/futex/core.c:1779 [inline] do_futex+0x804/0x257c kernel/futex/core.c:3993 __do_sys_futex kernel/futex/core.c:4059 [inline] __se_sys_futex kernel/futex/core.c:4040 [inline] __arm64_sys_futex+0x388/0x400 kernel/futex/core.c:4040 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: 3400009c 4b1c0108 35ffff68 2a0b03fc (d5033bbf) ---[ end trace 0af46781fdb8c899 ]--- ---------------- Code disassembly (best guess): 0: 3400009c cbz w28, 0x10 4: 4b1c0108 sub w8, w8, w28 8: 35ffff68 cbnz w8, 0xfffffffffffffff4 c: 2a0b03fc mov w28, w11 * 10: d5033bbf dmb ish <-- trapping instruction final repro crashed as (corrupted=false): Internal error: Oops - BTI: 0000000036000001 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4186 Comm: syz.0.17 Not tainted 5.15.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/30/2025 pstate: 82000405 (Nzcv daif -PAN -UAO +TCO -DIT -SSBS BTYPE=jc) pc : arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] pc : futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] pc : futex_wake_op kernel/futex/core.c:1779 [inline] pc : do_futex+0x804/0x257c kernel/futex/core.c:3993 lr : __uaccess_enable_tco arch/arm64/include/asm/uaccess.h:188 [inline] lr : uaccess_enable_privileged arch/arm64/include/asm/uaccess.h:221 [inline] lr : arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] lr : futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] lr : futex_wake_op kernel/futex/core.c:1779 [inline] lr : do_futex+0x7d0/0x257c kernel/futex/core.c:3993 sp : ffff80001fce78a0 x29: ffff80001fce7c20 x28: 00000000fffffff2 x27: 0000000011000000 x26: ffff0000cd5e51c0 x25: 0000000000000001 x24: 0000000000000001 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: 0000000000000000 x19: 1fffe00019abcce1 x18: 0000000000000001 x17: 0000000000000000 x16: ffff8000083bf97c x15: 0000000000000004 x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000000000 x11: 00000000fffffff5 x10: 00000000fffffff2 x9 : ffff8000083bf948 x8 : 0000000000000080 x7 : ffff8000083bf6f4 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000082d608c x2 : 0000000000000001 x1 : ffff80001435cb90 x0 : 0000000000000001 Call trace: arch_futex_atomic_op_inuser arch/arm64/include/asm/futex.h:60 [inline] futex_atomic_op_inuser kernel/futex/core.c:1729 [inline] futex_wake_op kernel/futex/core.c:1779 [inline] do_futex+0x804/0x257c kernel/futex/core.c:3993 __do_sys_futex kernel/futex/core.c:4059 [inline] __se_sys_futex kernel/futex/core.c:4040 [inline] __arm64_sys_futex+0x388/0x400 kernel/futex/core.c:4040 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: 3400009c 4b1c0108 35ffff68 2a0b03fc (d5033bbf) ---[ end trace 0af46781fdb8c899 ]--- ---------------- Code disassembly (best guess): 0: 3400009c cbz w28, 0x10 4: 4b1c0108 sub w8, w8, w28 8: 35ffff68 cbnz w8, 0xfffffffffffffff4 c: 2a0b03fc mov w28, w11 * 10: d5033bbf dmb ish <-- trapping instruction