last executing test programs: 110.89972ms ago: executing program 1 (id=239): socket$phonet_pipe(0x23, 0x5, 0x2) 109.85771ms ago: executing program 1 (id=244): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsa', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsa', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsa', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsa', 0x800, 0x0) 98.035547ms ago: executing program 1 (id=245): syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$dri(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$dri(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$dri(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$dri(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$dri(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$dri(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$dri(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$dri(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$dri(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$dri(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$dri(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$dri(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$dri(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$dri(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$dri(&(0x7f0000000500), 0x4, 0x800) 97.441608ms ago: executing program 1 (id=249): sched_getparam(0x0, &(0x7f0000000000)) 97.321537ms ago: executing program 4 (id=250): close(0xffffffffffffffff) 73.770783ms ago: executing program 1 (id=251): socket$inet_smc(0x2b, 0x1, 0x0) 73.340223ms ago: executing program 4 (id=254): syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) 73.149893ms ago: executing program 1 (id=257): sync() 73.042953ms ago: executing program 0 (id=258): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/logging', 0x2, 0x0) 41.073567ms ago: executing program 0 (id=261): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 40.981807ms ago: executing program 4 (id=262): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member', 0x2, 0x0) 40.814197ms ago: executing program 2 (id=263): memfd_secret(0x0) 40.722757ms ago: executing program 3 (id=264): semget(0xffffffffffffffff, 0x0, 0x0) 40.642027ms ago: executing program 4 (id=265): syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sg(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$sg(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$sg(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$sg(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$sg(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$sg(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$sg(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$sg(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$sg(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$sg(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$sg(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$sg(&(0x7f0000000500), 0x4, 0x800) 40.592547ms ago: executing program 0 (id=266): fsopen(&(0x7f0000000000), 0x0) 40.530217ms ago: executing program 3 (id=267): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/sync/info', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/sync/info', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/sync/info', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/sync/info', 0x800, 0x0) 17.178572ms ago: executing program 2 (id=268): syz_open_dev$mouse(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$mouse(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$mouse(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$mouse(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$mouse(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$mouse(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$mouse(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$mouse(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$mouse(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$mouse(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$mouse(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$mouse(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$mouse(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$mouse(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$mouse(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$mouse(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$mouse(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$mouse(&(0x7f0000000500), 0x4, 0x800) 16.877252ms ago: executing program 3 (id=269): fdatasync(0xffffffffffffffff) 16.791773ms ago: executing program 3 (id=270): iopl(0x0) 16.682182ms ago: executing program 4 (id=271): setfsgid(0x0) 16.617582ms ago: executing program 0 (id=272): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce', 0x800, 0x0) 16.223342ms ago: executing program 2 (id=273): umount2(&(0x7f0000000000), 0x0) 896.849µs ago: executing program 0 (id=274): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhci', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vhci', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci', 0x800, 0x0) 744.029µs ago: executing program 2 (id=275): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys', 0x0, 0x0) 623.099µs ago: executing program 3 (id=276): utime(&(0x7f0000000000), &(0x7f0000000000)) 448.219µs ago: executing program 2 (id=277): fchownat(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 381.709µs ago: executing program 4 (id=278): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/virtual_nci', 0x2, 0x0) 292.959µs ago: executing program 3 (id=279): futex_waitv(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0) 204.479µs ago: executing program 0 (id=280): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/capi20', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/capi20', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/capi20', 0x800, 0x0) 0s ago: executing program 2 (id=281): inotify_init1(0x0) kernel console output (not intermixed with test programs): [ 20.456305][ T28] audit: type=1400 audit(1772645857.940:62): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.479895][ T28] audit: type=1400 audit(1772645857.940:63): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=483 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.505087][ T28] audit: type=1400 audit(1772645857.940:64): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.530510][ T28] audit: type=1400 audit(1772645857.940:65): avc: denied { search } for pid=3192 comm="dhcpcd-run-hook" name="resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.555731][ T28] audit: type=1400 audit(1772645857.950:66): avc: denied { read open } for pid=3193 comm="dhcpcd-run-hook" path="/run/dhcpcd/hook-state/resolv.conf" dev="tmpfs" ino=488 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.130' (ED25519) to the list of known hosts. [ 24.358280][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 24.358294][ T28] audit: type=1400 audit(1772645861.850:70): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.389527][ T28] audit: type=1400 audit(1772645861.880:71): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.390298][ T3295] cgroup: Unknown subsys name 'net' [ 24.419620][ T28] audit: type=1400 audit(1772645861.910:72): avc: denied { unmount } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.558299][ T3295] cgroup: Unknown subsys name 'cpuset' [ 24.564926][ T3295] cgroup: Unknown subsys name 'rlimit' [ 24.688095][ T28] audit: type=1400 audit(1772645862.180:73): avc: denied { setattr } for pid=3295 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.713402][ T28] audit: type=1400 audit(1772645862.180:74): avc: denied { create } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.744882][ T28] audit: type=1400 audit(1772645862.180:75): avc: denied { write } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.767100][ T28] audit: type=1400 audit(1772645862.180:76): avc: denied { read } for pid=3295 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.775626][ T3300] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.788568][ T28] audit: type=1400 audit(1772645862.200:77): avc: denied { mounton } for pid=3295 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.824491][ T28] audit: type=1400 audit(1772645862.200:78): avc: denied { mount } for pid=3295 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.850046][ T28] audit: type=1400 audit(1772645862.220:79): avc: denied { read } for pid=3039 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 24.873877][ T3295] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.100625][ T3501] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 26.340734][ T3579] ================================================================== [ 26.349278][ T3579] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 26.357008][ T3579] [ 26.359344][ T3579] read-write to 0xffff888107a25228 of 8 bytes by task 40 on cpu 0: [ 26.367667][ T3579] __xa_clear_mark+0xf5/0x1e0 [ 26.372460][ T3579] __folio_end_writeback+0xf4/0x360 [ 26.378380][ T3579] folio_end_writeback_no_dropbehind+0x6d/0x1d0 [ 26.385114][ T3579] folio_end_writeback+0x1c/0x70 [ 26.390489][ T3579] ext4_finish_bio+0x459/0x8b0 [ 26.395453][ T3579] ext4_release_io_end+0x9f/0x1f0 [ 26.401105][ T3579] ext4_end_io_end+0x18d/0x240 [ 26.406226][ T3579] ext4_end_io_rsv_work+0x15b/0x1f0 [ 26.412044][ T3579] process_scheduled_works+0x4de/0x9e0 [ 26.418002][ T3579] worker_thread+0x581/0x770 [ 26.422965][ T3579] kthread+0x22a/0x280 [ 26.427428][ T3579] ret_from_fork+0x150/0x360 [ 26.432762][ T3579] ret_from_fork_asm+0x1a/0x30 [ 26.437713][ T3579] [ 26.440220][ T3579] read to 0xffff888107a25228 of 8 bytes by task 3579 on cpu 1: [ 26.448010][ T3579] xas_find_marked+0x213/0x620 [ 26.453046][ T3579] filemap_get_folios_tag+0xfa/0x510 [ 26.458592][ T3579] filemap_fdatawait_keep_errors+0x6c/0x190 [ 26.464845][ T3579] sync_inodes_sb+0x40e/0x4c0 [ 26.469951][ T3579] sync_inodes_one_sb+0x3d/0x50 [ 26.474807][ T3579] __iterate_supers+0x110/0x220 [ 26.480037][ T3579] iterate_supers+0x1f/0x30 [ 26.485327][ T3579] __ia32_sys_sync+0x5c/0xb0 [ 26.490192][ T3579] x64_sys_call+0x2f3a/0x3020 [ 26.495406][ T3579] do_syscall_64+0x12c/0x370 [ 26.500533][ T3579] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 26.506817][ T3579] [ 26.509629][ T3579] value changed: 0xffffffffffff0000 -> 0xffffffffffe00000 [ 26.517807][ T3579] [ 26.520664][ T3579] Reported by Kernel Concurrency Sanitizer on: [ 26.527261][ T3579] CPU: 1 UID: 0 PID: 3579 Comm: syz.1.257 Not tainted syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 26.536721][ T3579] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 26.547377][ T3579] ==================================================================