last executing test programs: 73.618958ms ago: executing program 4 (id=260): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snapshot', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot', 0x800, 0x0) 73.084458ms ago: executing program 0 (id=261): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qrtr-tun', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qrtr-tun', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qrtr-tun', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qrtr-tun', 0x800, 0x0) 53.754449ms ago: executing program 3 (id=275): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/md0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/md0', 0x800, 0x0) 38.929729ms ago: executing program 0 (id=277): exit(0x0) 38.434379ms ago: executing program 4 (id=278): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vsock', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock', 0x800, 0x0) 37.962889ms ago: executing program 3 (id=279): timer_settime(0x0, 0x0, &(0x7f0000000000), 0x0) 37.579819ms ago: executing program 4 (id=280): syz_open_dev$vcsn(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vcsn(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vcsn(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$vcsn(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$vcsn(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$vcsn(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$vcsn(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$vcsn(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$vcsn(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$vcsn(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$vcsn(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$vcsn(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$vcsn(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$vcsn(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$vcsn(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$vcsn(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$vcsn(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$vcsn(&(0x7f0000000500), 0x4, 0x800) 36.664329ms ago: executing program 1 (id=282): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem', 0x800, 0x0) 36.132279ms ago: executing program 0 (id=283): perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0) 35.028449ms ago: executing program 2 (id=284): pwritev(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 34.764469ms ago: executing program 4 (id=285): sched_setattr(0x0, &(0x7f0000000000), 0x0) 21.83011ms ago: executing program 3 (id=286): epoll_pwait(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0) 21.18963ms ago: executing program 2 (id=287): getgid() 19.70484ms ago: executing program 1 (id=288): unlinkat(0xffffffffffffffff, &(0x7f0000000000), 0x0) 18.53969ms ago: executing program 3 (id=289): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/thread-self/attr/exec', 0x2, 0x0) 17.95232ms ago: executing program 4 (id=290): io_submit(0x0, 0x0, &(0x7f0000000000)) 17.80662ms ago: executing program 1 (id=291): syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) 17.60523ms ago: executing program 2 (id=292): munmap(0x0, 0x0) 16.84657ms ago: executing program 0 (id=293): move_mount(0xffffffffffffffff, &(0x7f0000000000), 0xffffffffffffffff, &(0x7f0000000000), 0x0) 16.45778ms ago: executing program 1 (id=294): gettid() 15.92174ms ago: executing program 0 (id=295): open(&(0x7f0000000000), 0x0, 0x0) 15.0912ms ago: executing program 2 (id=296): socket$isdn_base(0x22, 0x3, 0x0) 1.53897ms ago: executing program 0 (id=297): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/schemes', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/schemes', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/schemes', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/schemes', 0x800, 0x0) 1.24835ms ago: executing program 3 (id=298): utimes(&(0x7f0000000000), &(0x7f0000000000)) 1.02876ms ago: executing program 4 (id=299): sched_yield() 925.48µs ago: executing program 1 (id=300): socket$l2tp(0x2, 0x2, 0x73) 681.94µs ago: executing program 1 (id=301): fsopen(&(0x7f0000000000), 0x0) 534.97µs ago: executing program 2 (id=302): socket$inet6_tcp(0xa, 0x1, 0x0) 155.59µs ago: executing program 3 (id=303): timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000)) 0s ago: executing program 2 (id=304): newfstatat(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): [ 18.339812][ T28] audit: type=1400 audit(1774654695.654:62): avc: denied { search } for pid=3193 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.361758][ T28] audit: type=1400 audit(1774654695.654:63): avc: denied { search } for pid=3193 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.384498][ T28] audit: type=1400 audit(1774654695.654:64): avc: denied { search } for pid=3193 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.407824][ T28] audit: type=1400 audit(1774654695.654:65): avc: denied { search } for pid=3193 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.431445][ T28] audit: type=1400 audit(1774654695.664:66): avc: denied { read open } for pid=3194 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.53' (ED25519) to the list of known hosts. [ 23.134203][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 23.134217][ T28] audit: type=1400 audit(1774654700.454:70): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 23.163441][ T28] audit: type=1400 audit(1774654700.484:71): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.164130][ T3298] cgroup: Unknown subsys name 'net' [ 23.191095][ T28] audit: type=1400 audit(1774654700.514:72): avc: denied { unmount } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 23.311275][ T3298] cgroup: Unknown subsys name 'cpuset' [ 23.317497][ T3298] cgroup: Unknown subsys name 'rlimit' [ 23.430151][ T28] audit: type=1400 audit(1774654700.744:73): avc: denied { setattr } for pid=3298 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 23.458216][ T28] audit: type=1400 audit(1774654700.754:74): avc: denied { create } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.478775][ T28] audit: type=1400 audit(1774654700.754:75): avc: denied { write } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.499354][ T28] audit: type=1400 audit(1774654700.754:76): avc: denied { read } for pid=3298 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 23.519935][ T28] audit: type=1400 audit(1774654700.764:77): avc: denied { read } for pid=3040 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 23.526913][ T3304] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 23.541119][ T28] audit: type=1400 audit(1774654700.764:78): avc: denied { mounton } for pid=3298 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 23.574741][ T28] audit: type=1400 audit(1774654700.764:79): avc: denied { mount } for pid=3298 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 23.614093][ T3298] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.696584][ T3442] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 25.895055][ T3535] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.071860][ T30] ================================================================== [ 26.079995][ T30] BUG: KCSAN: data-race in copy_process / free_pid [ 26.086556][ T30] [ 26.088899][ T30] read-write to 0xffffffff86c5ffa8 of 4 bytes by task 3312 on cpu 1: [ 26.096951][ T30] free_pid+0xbc/0x1e0 [ 26.101022][ T30] free_pids+0x54/0xb0 [ 26.105081][ T30] release_task+0x9a7/0xb60 [ 26.109582][ T30] wait_consider_task+0x1160/0x1670 [ 26.114801][ T30] __do_wait+0xf9/0x510 [ 26.118955][ T30] do_wait+0xb6/0x260 [ 26.122943][ T30] kernel_wait4+0x19f/0x210 [ 26.127445][ T30] __x64_sys_wait4+0x91/0x120 [ 26.132131][ T30] x64_sys_call+0x2aee/0x3020 [ 26.136895][ T30] do_syscall_64+0x12c/0x370 [ 26.141471][ T30] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 26.147368][ T30] [ 26.149680][ T30] read to 0xffffffff86c5ffa8 of 4 bytes by task 30 on cpu 0: [ 26.157313][ T30] copy_process+0x187f/0x20b0 [ 26.161979][ T30] kernel_clone+0x16b/0x5d0 [ 26.166475][ T30] user_mode_thread+0x9c/0xd0 [ 26.171150][ T30] call_usermodehelper_exec_work+0x7a/0x160 [ 26.177044][ T30] process_scheduled_works+0x513/0xa10 [ 26.182501][ T30] worker_thread+0x58a/0x780 [ 26.187080][ T30] kthread+0x22a/0x280 [ 26.191215][ T30] ret_from_fork+0x150/0x360 [ 26.195796][ T30] ret_from_fork_asm+0x1a/0x30 [ 26.200553][ T30] [ 26.202854][ T30] value changed: 0x80000096 -> 0x80000095 [ 26.208551][ T30] [ 26.210854][ T30] Reported by Kernel Concurrency Sanitizer on: SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 26.217018][ T30] CPU: 0 UID: 0 PID: 30 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) [ 26.226297][ T30] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 26.236337][ T30] Workqueue: events_unbound call_usermodehelper_exec_work [ 26.243542][ T30] ==================================================================