last executing test programs: 867.606667ms ago: executing program 0 (id=128): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/uinput', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput', 0x800, 0x0) 867.212707ms ago: executing program 0 (id=132): creat(&(0x7f0000000000), 0x0) 857.375167ms ago: executing program 0 (id=134): syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) 856.913337ms ago: executing program 0 (id=138): linkat(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0) 844.785828ms ago: executing program 0 (id=140): syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$MSR(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$MSR(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$MSR(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$MSR(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$MSR(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$MSR(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$MSR(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$MSR(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$MSR(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$MSR(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$MSR(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$MSR(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$MSR(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$MSR(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$MSR(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$MSR(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$MSR(&(0x7f0000000500), 0x4, 0x800) 844.289528ms ago: executing program 0 (id=145): pause() 221.640869ms ago: executing program 1 (id=435): symlinkat(&(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000)) 204.55061ms ago: executing program 1 (id=444): ftruncate(0xffffffffffffffff, 0x0) 191.333321ms ago: executing program 1 (id=448): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl', 0x800, 0x0) 191.16253ms ago: executing program 1 (id=450): syz_open_dev$ircomm(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$ircomm(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$ircomm(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$ircomm(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$ircomm(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$ircomm(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$ircomm(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$ircomm(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$ircomm(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$ircomm(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$ircomm(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$ircomm(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$ircomm(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$ircomm(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$ircomm(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$ircomm(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$ircomm(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$ircomm(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$ircomm(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$ircomm(&(0x7f0000000500), 0x4, 0x800) 177.498941ms ago: executing program 1 (id=455): io_submit(0x0, 0x0, &(0x7f0000000000)) 177.305741ms ago: executing program 1 (id=456): msgrcv(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) 160.031602ms ago: executing program 4 (id=463): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_congestion_control', 0x1, 0x0) 159.907742ms ago: executing program 4 (id=464): setns(0xffffffffffffffff, 0x0) 141.847203ms ago: executing program 4 (id=466): exit_group(0x0) 141.716203ms ago: executing program 4 (id=467): socket$nl_netfilter(0x10, 0x3, 0xc) 141.326283ms ago: executing program 4 (id=469): rt_sigsuspend(&(0x7f0000000000), 0x0) 141.009273ms ago: executing program 4 (id=472): sync() 89.047476ms ago: executing program 3 (id=477): name_to_handle_at(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0) 89.002526ms ago: executing program 2 (id=478): process_vm_writev(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0, 0x0) 88.977206ms ago: executing program 3 (id=479): alarm(0x0) 87.828196ms ago: executing program 2 (id=480): pwrite64(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 79.380816ms ago: executing program 2 (id=481): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/comedi0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/comedi0', 0x800, 0x0) 78.801666ms ago: executing program 3 (id=482): readlinkat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 68.485676ms ago: executing program 2 (id=483): utimes(&(0x7f0000000000), &(0x7f0000000000)) 68.301376ms ago: executing program 3 (id=484): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwbinder', 0x800, 0x0) 17.286469ms ago: executing program 2 (id=485): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 16.919909ms ago: executing program 3 (id=486): faccessat2(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 16.88009ms ago: executing program 2 (id=487): clock_getres(0x0, &(0x7f0000000000)) 0s ago: executing program 3 (id=488): socket$inet_smc(0x2b, 0x1, 0x0) kernel console output (not intermixed with test programs): syzkaller login: [ 17.344647][ T28] kauditd_printk_skb: 44 callbacks suppressed [ 17.344661][ T28] audit: type=1400 audit(1773975263.119:57): avc: denied { transition } for pid=3187 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 17.348954][ T28] audit: type=1400 audit(1773975263.119:58): avc: denied { noatsecure } for pid=3187 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 17.351903][ T28] audit: type=1400 audit(1773975263.119:59): avc: denied { write } for pid=3187 comm="sh" path="pipe:[2470]" dev="pipefs" ino=2470 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 17.354933][ T28] audit: type=1400 audit(1773975263.119:60): avc: denied { rlimitinh } for pid=3187 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 17.357540][ T28] audit: type=1400 audit(1773975263.119:61): avc: denied { siginh } for pid=3187 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 18.179421][ T28] audit: type=1400 audit(1773975263.959:62): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.201361][ T28] audit: type=1400 audit(1773975263.959:63): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.223995][ T28] audit: type=1400 audit(1773975263.959:64): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.246955][ T28] audit: type=1400 audit(1773975263.959:65): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.270009][ T28] audit: type=1400 audit(1773975263.959:66): avc: denied { read open } for pid=3193 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.187' (ED25519) to the list of known hosts. [ 24.772168][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 24.772182][ T28] audit: type=1400 audit(1773975270.549:70): avc: denied { mounton } for pid=3299 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.801156][ T28] audit: type=1400 audit(1773975270.579:71): avc: denied { mount } for pid=3299 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.801878][ T3299] cgroup: Unknown subsys name 'net' [ 24.828870][ T28] audit: type=1400 audit(1773975270.599:72): avc: denied { unmount } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.951113][ T3299] cgroup: Unknown subsys name 'cpuset' [ 24.957171][ T3299] cgroup: Unknown subsys name 'rlimit' [ 25.069077][ T28] audit: type=1400 audit(1773975270.839:73): avc: denied { setattr } for pid=3299 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.099532][ T28] audit: type=1400 audit(1773975270.839:74): avc: denied { create } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.120029][ T28] audit: type=1400 audit(1773975270.839:75): avc: denied { write } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.140394][ T28] audit: type=1400 audit(1773975270.839:76): avc: denied { read } for pid=3299 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.160711][ T28] audit: type=1400 audit(1773975270.849:77): avc: denied { mounton } for pid=3299 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.167768][ T3301] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.185639][ T28] audit: type=1400 audit(1773975270.849:78): avc: denied { mount } for pid=3299 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.217396][ T28] audit: type=1400 audit(1773975270.869:79): avc: denied { read } for pid=3039 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 25.263287][ T3299] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.592601][ T3571] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.800751][ T3674] mmap: syz.2.349 (3674) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 26.812734][ T3673] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.182445][ T3800] ================================================================== [ 27.190676][ T3800] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 27.198072][ T3800] [ 27.200488][ T3800] read-write to 0xffff888107d7e478 of 8 bytes by task 30 on cpu 0: [ 27.208735][ T3800] __xa_clear_mark+0xf5/0x1e0 [ 27.213520][ T3800] __folio_end_writeback+0xf4/0x360 [ 27.218829][ T3800] folio_end_writeback_no_dropbehind+0x6d/0x1d0 [ 27.225089][ T3800] folio_end_writeback+0x1c/0x70 [ 27.230044][ T3800] ext4_finish_bio+0x459/0x8b0 [ 27.234910][ T3800] ext4_release_io_end+0x9f/0x1f0 [ 27.239950][ T3800] ext4_end_io_end+0x18d/0x240 [ 27.244710][ T3800] ext4_end_io_rsv_work+0x15b/0x1f0 [ 27.249916][ T3800] process_scheduled_works+0x513/0xa10 [ 27.255374][ T3800] worker_thread+0x58a/0x780 [ 27.259956][ T3800] kthread+0x22a/0x280 [ 27.264044][ T3800] ret_from_fork+0x150/0x360 [ 27.268726][ T3800] ret_from_fork_asm+0x1a/0x30 [ 27.273501][ T3800] [ 27.275813][ T3800] read to 0xffff888107d7e478 of 8 bytes by task 3800 on cpu 1: [ 27.283347][ T3800] xas_find_marked+0x213/0x620 [ 27.288104][ T3800] filemap_get_folios_tag+0xfa/0x510 [ 27.293376][ T3800] filemap_fdatawait_keep_errors+0x6c/0x190 [ 27.299257][ T3800] sync_inodes_sb+0x40e/0x4c0 [ 27.303928][ T3800] sync_inodes_one_sb+0x3d/0x50 [ 27.308784][ T3800] __iterate_supers+0x110/0x220 [ 27.313638][ T3800] iterate_supers+0x1f/0x30 [ 27.318142][ T3800] __ia32_sys_sync+0x5c/0xb0 [ 27.322729][ T3800] x64_sys_call+0x2f3a/0x3020 [ 27.327409][ T3800] do_syscall_64+0x12c/0x370 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 27.331994][ T3800] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.337887][ T3800] [ 27.340202][ T3800] value changed: 0xfffffc0000000000 -> 0xfffff00000000000 [ 27.347301][ T3800] [ 27.349622][ T3800] Reported by Kernel Concurrency Sanitizer on: [ 27.355817][ T3800] CPU: 1 UID: 0 PID: 3800 Comm: syz.4.472 Not tainted syzkaller #0 PREEMPT(full) [ 27.365000][ T3800] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 27.375051][ T3800] ==================================================================