last executing test programs: 1.274371679s ago: executing program 1 (id=105): landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, &(0x7f0000000000), 0x0) 1.25718649s ago: executing program 1 (id=110): quotactl$Q_GETFMT(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000)) 1.2563599s ago: executing program 1 (id=115): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats', 0x0, 0x0) 1.24026708s ago: executing program 1 (id=120): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current', 0x2, 0x0) 1.24012003s ago: executing program 1 (id=122): inotify_rm_watch(0xffffffffffffffff, 0x0) 1.218123501s ago: executing program 1 (id=126): rt_sigreturn() 1.109786043s ago: executing program 2 (id=162): wait4(0x0, 0x0, 0x0, 0x0) 1.109643183s ago: executing program 2 (id=164): signalfd4(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0) 1.095150824s ago: executing program 2 (id=169): dup2(0xffffffffffffffff, 0xffffffffffffffff) 1.075830094s ago: executing program 2 (id=172): socket$inet6_dccp(0xa, 0x6, 0x0) 1.011184736s ago: executing program 2 (id=186): mbind(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) 1.010669286s ago: executing program 2 (id=189): msgrcv(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) 179.778266ms ago: executing program 4 (id=394): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ubi_ctrl', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl', 0x800, 0x0) 179.448376ms ago: executing program 4 (id=397): listen(0xffffffffffffffff, 0x0) 157.398797ms ago: executing program 4 (id=400): getcwd(&(0x7f0000000000), 0x0) 157.060987ms ago: executing program 4 (id=402): personality(0x0) 156.782227ms ago: executing program 4 (id=404): ioprio_set$auto(0x0, 0x0, 0x0) 156.613617ms ago: executing program 4 (id=405): sync() 55.636069ms ago: executing program 3 (id=413): close(0xffffffffffffffff) 55.149069ms ago: executing program 0 (id=415): syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sndctrl(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sndctrl(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$sndctrl(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$sndctrl(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$sndctrl(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$sndctrl(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$sndctrl(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$sndctrl(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$sndctrl(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$sndctrl(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$sndctrl(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$sndctrl(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$sndctrl(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$sndctrl(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$sndctrl(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$sndctrl(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$sndctrl(&(0x7f0000000500), 0x4, 0x800) 55.086049ms ago: executing program 3 (id=416): timerfd_gettime(0xffffffffffffffff, &(0x7f0000000000)) 54.925529ms ago: executing program 0 (id=417): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyprintk', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyprintk', 0x800, 0x0) 54.320719ms ago: executing program 3 (id=418): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-net', 0x2, 0x0) 891.18µs ago: executing program 0 (id=419): time(&(0x7f0000000000)) 694.81µs ago: executing program 3 (id=420): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/img-rogue', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/img-rogue', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/img-rogue', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/img-rogue', 0x800, 0x0) 622.73µs ago: executing program 0 (id=421): recvmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x0, 0x0, 0x0) 402.38µs ago: executing program 3 (id=422): flock(0xffffffffffffffff, 0x0) 295.02µs ago: executing program 0 (id=423): perf_event_open(&(0x7f0000000000), 0x0, 0x0, 0xffffffffffffffff, 0x0) 235.58µs ago: executing program 3 (id=424): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sr0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sr0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sr0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sr0', 0x800, 0x0) 0s ago: executing program 0 (id=425): rename(&(0x7f0000000000), &(0x7f0000000000)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.188' (ED25519) to the list of known hosts. [ 33.402489][ T28] kauditd_printk_skb: 14 callbacks suppressed [ 33.402507][ T28] audit: type=1400 audit(1786707028.816:126): avc: denied { mounton } for pid=3285 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 33.431849][ T28] audit: type=1400 audit(1786707028.846:127): avc: denied { mount } for pid=3285 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.434260][ T3285] cgroup: Unknown subsys name 'net' [ 33.459713][ T28] audit: type=1400 audit(1786707028.866:128): avc: denied { unmount } for pid=3285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 33.572009][ T3285] cgroup: Unknown subsys name 'cpuset' [ 33.578340][ T3285] cgroup: Unknown subsys name 'rlimit' [ 33.713351][ T28] audit: type=1400 audit(1786707029.126:129): avc: denied { setattr } for pid=3285 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 33.736821][ T28] audit: type=1400 audit(1786707029.126:130): avc: denied { create } for pid=3285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.761871][ T28] audit: type=1400 audit(1786707029.126:131): avc: denied { write } for pid=3285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.782484][ T28] audit: type=1400 audit(1786707029.126:132): avc: denied { read } for pid=3285 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 33.802973][ T28] audit: type=1400 audit(1786707029.146:133): avc: denied { mounton } for pid=3285 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 33.828118][ T28] audit: type=1400 audit(1786707029.146:134): avc: denied { mount } for pid=3285 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 33.851664][ T28] audit: type=1400 audit(1786707029.166:135): avc: denied { read } for pid=3021 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 33.851935][ T3289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 33.916253][ T3285] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 35.239477][ T3457] mmap: syz.4.150 (3457) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 36.392316][ T3728] ================================================================== [ 36.400472][ T3728] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 36.407899][ T3728] [ 36.410255][ T3728] read-write to 0xffff8881006cf6b8 of 8 bytes by task 49 on cpu 0: [ 36.418174][ T3728] __xa_clear_mark+0xf5/0x1e0 [ 36.422900][ T3728] __folio_end_writeback+0xf4/0x360 [ 36.428148][ T3728] folio_end_writeback_no_dropbehind+0x6d/0x1d0 [ 36.434443][ T3728] folio_end_writeback+0x1c/0x70 [ 36.439470][ T3728] ext4_finish_bio+0x454/0x770 [ 36.444266][ T3728] ext4_release_io_end+0x9f/0x1f0 [ 36.449373][ T3728] ext4_end_io_end+0x18d/0x240 [ 36.454173][ T3728] ext4_end_io_rsv_work+0x15b/0x1f0 [ 36.459423][ T3728] process_scheduled_works+0x4d4/0x9a0 [ 36.464928][ T3728] worker_thread+0x569/0x750 [ 36.469564][ T3728] kthread+0x221/0x270 [ 36.473661][ T3728] ret_from_fork+0x146/0x330 [ 36.478282][ T3728] ret_from_fork_asm+0x1a/0x30 [ 36.483078][ T3728] [ 36.485432][ T3728] read to 0xffff8881006cf6b8 of 8 bytes by task 3728 on cpu 1: [ 36.492996][ T3728] xas_find_marked+0x211/0x650 [ 36.497798][ T3728] filemap_get_folios_tag+0xf7/0x400 [ 36.503115][ T3728] filemap_fdatawait_keep_errors+0x6c/0x190 [ 36.510237][ T3728] sync_inodes_sb+0x41e/0x4d0 [ 36.514976][ T3728] sync_inodes_one_sb+0x3d/0x50 [ 36.519902][ T3728] __iterate_supers+0x110/0x1f0 [ 36.524818][ T3728] iterate_supers+0x1f/0x30 [ 36.529376][ T3728] __ia32_sys_sync+0x5c/0xb0 [ 36.533999][ T3728] x64_sys_call+0x2f3a/0x3020 [ 36.538706][ T3728] do_syscall_64+0x136/0x3c0 [ 36.543335][ T3728] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 36.549263][ T3728] [ 36.551602][ T3728] value changed: 0xffffffffffffff80 -> 0xfffffffffffffc00 [ 36.558723][ T3728] [ 36.561067][ T3728] Reported by Kernel Concurrency Sanitizer on: [ 36.567246][ T3728] CPU: 1 UID: 0 PID: 3728 Comm: syz.4.405 Not tainted syzkaller #0 PREEMPT(lazy) [ 36.576602][ T3728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 36.586692][ T3728] ==================================================================