last executing test programs: 1.297886146s ago: executing program 3 (id=368): syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sg(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$sg(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$sg(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$sg(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$sg(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$sg(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$sg(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$sg(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$sg(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$sg(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$sg(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$sg(&(0x7f0000000500), 0x4, 0x800) 1.281769626s ago: executing program 3 (id=376): mq_unlink(&(0x7f0000000000)) 1.252593927s ago: executing program 3 (id=382): capget(&(0x7f0000000000), &(0x7f0000000000)) 1.241776227s ago: executing program 3 (id=385): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer', 0x800, 0x0) 1.241094397s ago: executing program 3 (id=389): getpgid(0x0) 1.214725997s ago: executing program 3 (id=393): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member', 0x2, 0x0) 963.747502ms ago: executing program 0 (id=465): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 963.643832ms ago: executing program 0 (id=466): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/user', 0x2, 0x0) 963.440012ms ago: executing program 0 (id=469): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey', 0x800, 0x0) 942.760342ms ago: executing program 0 (id=471): pidfd_open(0x0, 0x0) 921.911543ms ago: executing program 0 (id=478): tkill(0x0, 0x0) 921.360823ms ago: executing program 0 (id=481): pause() 439.863042ms ago: executing program 1 (id=602): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/fs/binfmt_misc/syz0', 0x2, 0x0) 439.758212ms ago: executing program 1 (id=603): lremovexattr(&(0x7f0000000000), &(0x7f0000000000)) 439.665862ms ago: executing program 2 (id=604): set_robust_list(&(0x7f0000000000), 0x0) 414.841543ms ago: executing program 1 (id=605): mlock2(0x0, 0x0, 0x0) 414.658473ms ago: executing program 2 (id=606): signalfd(0xffffffffffffffff, &(0x7f0000000000), 0x0) 414.356243ms ago: executing program 1 (id=607): mlock(0x0, 0x0) 414.206253ms ago: executing program 2 (id=608): fsopen(&(0x7f0000000000), 0x0) 413.993403ms ago: executing program 1 (id=611): syz_open_dev$cec(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$cec(&(0x7f0000000100), 0x0, 0x800) 396.080323ms ago: executing program 4 (id=613): socket$inet(0x2, 0x1, 0x0) 395.925983ms ago: executing program 2 (id=614): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0', 0x2, 0x0) 395.811753ms ago: executing program 4 (id=615): prlimit64(0x0, 0x0, 0x0, 0x0) 395.690203ms ago: executing program 4 (id=616): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/unconfined', 0x2, 0x0) 395.630403ms ago: executing program 2 (id=617): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem', 0x1, 0x0) 395.420822ms ago: executing program 2 (id=618): syz_open_dev$mouse(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$mouse(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$mouse(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$mouse(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$mouse(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$mouse(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$mouse(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$mouse(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$mouse(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$mouse(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$mouse(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$mouse(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$mouse(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$mouse(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$mouse(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$mouse(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$mouse(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$mouse(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$mouse(&(0x7f0000000500), 0x4, 0x800) 395.307043ms ago: executing program 4 (id=619): unlink(&(0x7f0000000000)) 344.546174ms ago: executing program 4 (id=621): syz_open_dev$admmidi(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$admmidi(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$admmidi(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$admmidi(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$admmidi(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$admmidi(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$admmidi(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$admmidi(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$admmidi(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$admmidi(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$admmidi(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$admmidi(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$admmidi(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$admmidi(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$admmidi(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$admmidi(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$admmidi(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$admmidi(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$admmidi(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$admmidi(&(0x7f0000000500), 0x4, 0x800) 344.390044ms ago: executing program 4 (id=623): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse', 0x2, 0x0) 0s ago: executing program 1 (id=622): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): [ 14.044205][ T29] audit: type=1400 audit(1757714052.476:60): avc: denied { rlimitinh } for pid=3173 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 14.047192][ T29] audit: type=1400 audit(1757714052.476:61): avc: denied { siginh } for pid=3173 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.211' (ED25519) to the list of known hosts. [ 21.475882][ T29] audit: type=1400 audit(1757714059.916:62): avc: denied { mounton } for pid=3245 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 21.476733][ T3245] cgroup: Unknown subsys name 'net' [ 21.498713][ T29] audit: type=1400 audit(1757714059.916:63): avc: denied { mount } for pid=3245 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.526192][ T29] audit: type=1400 audit(1757714059.956:64): avc: denied { unmount } for pid=3245 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 21.762031][ T3245] cgroup: Unknown subsys name 'cpuset' [ 21.768168][ T3245] cgroup: Unknown subsys name 'rlimit' [ 21.959890][ T29] audit: type=1400 audit(1757714060.396:65): avc: denied { setattr } for pid=3245 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 21.983212][ T29] audit: type=1400 audit(1757714060.396:66): avc: denied { create } for pid=3245 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.003732][ T29] audit: type=1400 audit(1757714060.396:67): avc: denied { write } for pid=3245 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.024117][ T29] audit: type=1400 audit(1757714060.396:68): avc: denied { read } for pid=3245 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.030962][ T3291] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.044392][ T29] audit: type=1400 audit(1757714060.406:69): avc: denied { mounton } for pid=3245 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.077687][ T29] audit: type=1400 audit(1757714060.406:70): avc: denied { mount } for pid=3245 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 22.101030][ T29] audit: type=1400 audit(1757714060.506:71): avc: denied { relabelto } for pid=3291 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 22.130581][ T3245] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 23.966499][ T3763] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.048376][ T3786] mmap: syz.1.457 (3786) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 24.222591][ T3844] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 24.256515][ T3724] chnl_net:caif_netlink_parms(): no params data found [ 24.457050][ T3724] bridge0: port 1(bridge_slave_0) entered blocking state [ 24.464249][ T3724] bridge0: port 1(bridge_slave_0) entered disabled state [ 24.521614][ T3724] bridge_slave_0: entered allmulticast mode [ 24.544655][ T3724] bridge_slave_0: entered promiscuous mode [ 24.567852][ T3724] bridge0: port 2(bridge_slave_1) entered blocking state [ 24.574957][ T3724] bridge0: port 2(bridge_slave_1) entered disabled state [ 24.611082][ T3724] bridge_slave_1: entered allmulticast mode [ 24.637318][ T3724] bridge_slave_1: entered promiscuous mode [ 24.709392][ T3724] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 24.722908][ T3724] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 24.786198][ T3724] team0: Port device team_slave_0 added [ 24.839232][ T3724] team0: Port device team_slave_1 added [ 24.914424][ T3724] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 24.921380][ T3724] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.947667][ T3724] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 24.961692][ T3724] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 24.968636][ T3724] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 24.994586][ T3724] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 25.029445][ T2993] ================================================================== [ 25.037707][ T2993] BUG: KCSAN: data-race in dont_mount / lookup_fast [ 25.044308][ T2993] [ 25.046631][ T2993] read-write to 0xffff88810725f900 of 4 bytes by task 3975 on cpu 0: [ 25.054690][ T2993] dont_mount+0x2a/0x40 [ 25.058865][ T2993] vfs_unlink+0x28f/0x420 [ 25.063200][ T2993] do_unlinkat+0x24e/0x480 [ 25.067601][ T2993] __x64_sys_unlink+0x2e/0x40 [ 25.072266][ T2993] x64_sys_call+0x2dc0/0x2ff0 [ 25.076931][ T2993] do_syscall_64+0xd2/0x200 [ 25.081426][ T2993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 25.087320][ T2993] [ 25.089633][ T2993] read to 0xffff88810725f900 of 4 bytes by task 2993 on cpu 1: [ 25.097154][ T2993] lookup_fast+0xf0/0x320 [ 25.101472][ T2993] walk_component+0x3f/0x220 [ 25.106083][ T2993] path_lookupat+0xfe/0x2a0 [ 25.110579][ T2993] filename_lookup+0x147/0x340 [ 25.115337][ T2993] do_readlinkat+0x7d/0x320 [ 25.119818][ T2993] __x64_sys_readlink+0x47/0x60 [ 25.124658][ T2993] x64_sys_call+0x28da/0x2ff0 [ 25.129406][ T2993] do_syscall_64+0xd2/0x200 [ 25.133909][ T2993] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 25.139791][ T2993] [ 25.142099][ T2993] value changed: 0x00300080 -> 0x00004080 [ 25.147792][ T2993] [ 25.150096][ T2993] Reported by Kernel Concurrency Sanitizer on: [ 25.156239][ T2993] CPU: 1 UID: 0 PID: 2993 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) [ 25.165504][ T2993] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 25.175542][ T2993] ================================================================== [ 25.312262][ T51] bridge_slave_1: left allmulticast mode [ 25.317937][ T51] bridge_slave_1: left promiscuous mode [ 25.323754][ T51] bridge0: port 2(bridge_slave_1) entered disabled state [ 25.331366][ T51] bridge_slave_0: left allmulticast mode [ 25.337192][ T51] bridge_slave_0: left promiscuous mode [ 25.342997][ T51] bridge0: port 1(bridge_slave_0) entered disabled state [ 25.413506][ T51] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 25.423128][ T51] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 25.433168][ T51] bond0 (unregistering): Released all slaves [ 25.525336][ T51] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 25.532860][ T51] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 25.547920][ T51] team0 (unregistering): Port device team_slave_1 removed [ 25.556925][ T51] team0 (unregistering): Port device team_slave_0 removed