last executing test programs: 1.215526772s ago: executing program 2 (id=213): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/socket/zygote', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/socket/zygote', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/socket/zygote', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/socket/zygote', 0x800, 0x0) 1.215437452s ago: executing program 2 (id=215): geteuid() 1.203367653s ago: executing program 2 (id=221): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/i915', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/i915', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/i915', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/i915', 0x800, 0x0) 1.189741104s ago: executing program 2 (id=225): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vndbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vndbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vndbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vndbinder', 0x800, 0x0) 1.188468334s ago: executing program 2 (id=231): getxattr(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0) 1.168341816s ago: executing program 2 (id=236): pause() 1.100289111s ago: executing program 0 (id=265): mq_timedreceive(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 1.100040801s ago: executing program 0 (id=266): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 1.081815653s ago: executing program 0 (id=271): close(0xffffffffffffffff) 1.056911235s ago: executing program 0 (id=277): io_getevents(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) 1.055705835s ago: executing program 0 (id=285): socket$inet6(0xa, 0x1, 0x0) 1.037877256s ago: executing program 0 (id=286): rt_sigreturn() 383.131159ms ago: executing program 1 (id=469): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm', 0x800, 0x0) 382.758749ms ago: executing program 1 (id=472): socket$l2tp6(0xa, 0x2, 0x73) 382.0379ms ago: executing program 4 (id=476): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fb0', 0x800, 0x0) 359.408521ms ago: executing program 1 (id=477): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord', 0x800, 0x0) 359.092991ms ago: executing program 3 (id=478): msgsnd(0x0, &(0x7f0000000000), 0x0, 0x0) 358.959711ms ago: executing program 4 (id=479): socket$nl_route(0x10, 0x3, 0x0) 358.591352ms ago: executing program 3 (id=480): fremovexattr(0xffffffffffffffff, &(0x7f0000000000)) 358.519832ms ago: executing program 1 (id=481): readv(0xffffffffffffffff, &(0x7f0000000000), 0x0) 358.428121ms ago: executing program 4 (id=482): get_robust_list(0x0, &(0x7f0000000000), &(0x7f0000000000)) 358.361951ms ago: executing program 3 (id=483): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ocfs2_control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ocfs2_control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ocfs2_control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ocfs2_control', 0x800, 0x0) 358.316691ms ago: executing program 4 (id=484): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/validatetrans', 0x1, 0x0) 312.049565ms ago: executing program 1 (id=485): clock_nanosleep(0x0, 0x0, &(0x7f0000000000), 0x0) 311.759985ms ago: executing program 4 (id=486): socket$pppl2tp(0x18, 0x1, 0x1) 311.669555ms ago: executing program 3 (id=487): timer_gettime(0x0, &(0x7f0000000000)) 311.585975ms ago: executing program 3 (id=488): socket$pppoe(0x18, 0x1, 0x0) 179.367436ms ago: executing program 1 (id=489): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 72.447274ms ago: executing program 3 (id=491): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=490): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): [ 19.029076][ T29] audit: type=1400 audit(1723654075.393:81): avc: denied { read } for pid=2942 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.1.55' (ED25519) to the list of known hosts. [ 24.859909][ T29] audit: type=1400 audit(1723654081.223:82): avc: denied { mounton } for pid=3248 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.860873][ T3248] cgroup: Unknown subsys name 'net' [ 24.882789][ T29] audit: type=1400 audit(1723654081.223:83): avc: denied { mount } for pid=3248 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.910213][ T29] audit: type=1400 audit(1723654081.243:84): avc: denied { unmount } for pid=3248 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.050292][ T3248] cgroup: Unknown subsys name 'rlimit' [ 25.142233][ T29] audit: type=1400 audit(1723654081.503:85): avc: denied { setattr } for pid=3248 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=118 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.165726][ T29] audit: type=1400 audit(1723654081.503:86): avc: denied { create } for pid=3248 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.186244][ T29] audit: type=1400 audit(1723654081.503:87): avc: denied { write } for pid=3248 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.206642][ T29] audit: type=1400 audit(1723654081.503:88): avc: denied { read } for pid=3248 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.214242][ T3252] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.226916][ T29] audit: type=1400 audit(1723654081.503:89): avc: denied { mounton } for pid=3248 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.260808][ T29] audit: type=1400 audit(1723654081.503:90): avc: denied { mount } for pid=3248 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.284217][ T29] audit: type=1400 audit(1723654081.593:91): avc: denied { relabelto } for pid=3252 comm="mkswap" name="swap-file" dev="sda1" ino=1928 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.313915][ T3248] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.679559][ T3529] mmap: syz.1.256 (3529) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 26.908599][ T3601] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.184787][ T3678] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 27.595704][ T3560] syz.0.286 (3560) used greatest stack depth: 10792 bytes left [ 27.838724][ T3680] ================================================================== [ 27.846843][ T3680] BUG: KCSAN: data-race in generic_fillattr / inode_set_ctime_current [ 27.855098][ T3680] [ 27.857426][ T3680] write to 0xffff888102fc1550 of 4 bytes by task 3778 on cpu 0: [ 27.865145][ T3680] inode_set_ctime_current+0x35/0x50 [ 27.870450][ T3680] shmem_mknod+0x117/0x180 [ 27.874871][ T3680] shmem_create+0x34/0x40 [ 27.879252][ T3680] path_openat+0xdbc/0x1f10 [ 27.883859][ T3680] do_filp_open+0xf7/0x200 [ 27.888299][ T3680] do_sys_openat2+0xab/0x120 [ 27.892900][ T3680] __x64_sys_openat+0xf3/0x120 [ 27.898015][ T3680] x64_sys_call+0x1025/0x2d60 [ 27.902705][ T3680] do_syscall_64+0xc9/0x1c0 [ 27.907219][ T3680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.913126][ T3680] [ 27.915448][ T3680] read to 0xffff888102fc1550 of 4 bytes by task 3680 on cpu 1: [ 27.922995][ T3680] generic_fillattr+0x1dd/0x2f0 [ 27.927849][ T3680] shmem_getattr+0x17b/0x200 [ 27.932447][ T3680] vfs_getattr+0x19b/0x1e0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 27.936874][ T3680] vfs_statx+0x134/0x2f0 [ 27.941121][ T3680] vfs_fstatat+0xec/0x110 [ 27.945463][ T3680] __se_sys_newfstatat+0x58/0x260 [ 27.950936][ T3680] __x64_sys_newfstatat+0x55/0x70 [ 27.955983][ T3680] x64_sys_call+0x141f/0x2d60 [ 27.960712][ T3680] do_syscall_64+0xc9/0x1c0 [ 27.965396][ T3680] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.971304][ T3680] [ 27.973619][ T3680] value changed: 0x0b2c2938 -> 0x0bc4bfb9 [ 27.979929][ T3680] [ 27.982233][ T3680] Reported by Kernel Concurrency Sanitizer on: [ 27.988365][ T3680] CPU: 1 UID: 0 PID: 3680 Comm: udevd Not tainted 6.11.0-rc3-syzkaller-00036-g9d5906799f7d #0 [ 27.998756][ T3680] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 [ 28.008799][ T3680] ==================================================================