last executing test programs: 433.172196ms ago: executing program 4: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/raw-gadget', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/raw-gadget', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/raw-gadget', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/raw-gadget', 0x800, 0x0) 416.803658ms ago: executing program 4: set_robust_list(&(0x7f0000000000), 0x0) 406.554049ms ago: executing program 4: quotactl$Q_GETFMT(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000)) 393.686401ms ago: executing program 4: bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000), 0x0) 367.141266ms ago: executing program 4: capget(&(0x7f0000000000), &(0x7f0000000000)) 341.522159ms ago: executing program 4: sync() 171.460484ms ago: executing program 3: sched_getattr(0x0, &(0x7f0000000000), 0x0, 0x0) 156.978967ms ago: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/acpi_thermal_rel', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/acpi_thermal_rel', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/acpi_thermal_rel', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/acpi_thermal_rel', 0x800, 0x0) 156.455527ms ago: executing program 3: close(0xffffffffffffffff) 142.180199ms ago: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls', 0x0, 0x0) 132.72246ms ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/sync/sw_sync', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/sync/sw_sync', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/sync/sw_sync', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/sync/sw_sync', 0x800, 0x0) 114.155823ms ago: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/msm', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/msm', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/msm', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/msm', 0x800, 0x0) 108.877414ms ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2', 0x800, 0x0) 86.035007ms ago: executing program 3: openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy', 0x0, 0x0) 85.394378ms ago: executing program 1: openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0) 85.206878ms ago: executing program 0: cachestat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 77.555039ms ago: executing program 2: getrusage(0x0, &(0x7f0000000000)) 72.428499ms ago: executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hpet', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hpet', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hpet', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hpet', 0x800, 0x0) 69.84903ms ago: executing program 1: syz_open_dev$vivid(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vivid(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vivid(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vivid(&(0x7f0000000100), 0x0, 0x800) 66.76703ms ago: executing program 0: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/irnet', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/irnet', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/irnet', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/irnet', 0x800, 0x0) 51.412993ms ago: executing program 2: mincore(0x0, 0x0, &(0x7f0000000000)) 50.991753ms ago: executing program 3: syz_open_dev$rtc(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$rtc(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$rtc(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$rtc(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$rtc(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$rtc(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$rtc(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$rtc(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$rtc(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$rtc(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$rtc(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$rtc(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$rtc(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$rtc(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$rtc(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$rtc(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$rtc(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$rtc(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$rtc(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$rtc(&(0x7f0000000500), 0x4, 0x800) 46.005324ms ago: executing program 0: rmdir(&(0x7f0000000000)) 45.491043ms ago: executing program 1: removexattr(&(0x7f0000000000), &(0x7f0000000000)) 31.402416ms ago: executing program 2: setresgid(0x0, 0x0, 0x0) 28.624436ms ago: executing program 1: openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/rm_contexts', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/rm_contexts', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/rm_contexts', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/rm_contexts', 0x800, 0x0) 23.896897ms ago: executing program 2: openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/pktcdvd/control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control', 0x800, 0x0) 9.444899ms ago: executing program 1: add_key(&(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0, 0x0) 7.205319ms ago: executing program 2: timer_gettime(0x0, &(0x7f0000000000)) 0s ago: executing program 1: rt_sigpending(&(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): [ 17.464102][ T29] audit: type=1400 audit(1719138302.525:81): avc: denied { read } for pid=2765 comm="syslogd" name="log" dev="sda1" ino=1915 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 Warning: Permanently added '10.128.1.113' (ED25519) to the list of known hosts. 2024/06/23 10:25:06 fuzzer started 2024/06/23 10:25:07 dialing manager at 10.128.0.163:30031 [ 22.011632][ T29] audit: type=1400 audit(1719138307.075:82): avc: denied { node_bind } for pid=3074 comm="syz-fuzzer" saddr=::1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:node_t tclass=tcp_socket permissive=1 [ 22.032186][ T29] audit: type=1400 audit(1719138307.075:83): avc: denied { name_bind } for pid=3074 comm="syz-fuzzer" src=6060 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=tcp_socket permissive=1 [ 22.102812][ T29] audit: type=1400 audit(1719138307.165:84): avc: denied { mounton } for pid=3082 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=1925 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 22.126839][ T3082] cgroup: Unknown subsys name 'net' [ 22.129684][ T29] audit: type=1400 audit(1719138307.195:85): avc: denied { mount } for pid=3082 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.158758][ T29] audit: type=1400 audit(1719138307.195:86): avc: denied { unmount } for pid=3082 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 22.178630][ T29] audit: type=1400 audit(1719138307.205:87): avc: denied { mounton } for pid=3095 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 22.203563][ T29] audit: type=1400 audit(1719138307.205:88): avc: denied { mount } for pid=3095 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 22.217401][ T3105] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 22.227040][ T29] audit: type=1400 audit(1719138307.245:89): avc: denied { create } for pid=3104 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.255783][ T29] audit: type=1400 audit(1719138307.245:90): avc: denied { write } for pid=3104 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.276110][ T29] audit: type=1400 audit(1719138307.245:91): avc: denied { read } for pid=3104 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 22.301378][ T3103] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 22.318729][ T3082] cgroup: Unknown subsys name 'rlimit' 2024/06/23 10:25:07 starting 5 executor processes [ 23.228540][ T3188] ================================================================== [ 23.236746][ T3188] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 23.244241][ T3188] [ 23.246568][ T3188] read-write to 0xffff8881057ec908 of 8 bytes by task 11 on cpu 0: [ 23.254463][ T3188] __xa_clear_mark+0xf8/0x1f0 [ 23.259156][ T3188] __folio_end_writeback+0x18f/0x4a0 [ 23.264720][ T3188] folio_end_writeback+0x74/0x1f0 [ 23.269750][ T3188] ext4_finish_bio+0x476/0x8e0 [ 23.274527][ T3188] ext4_release_io_end+0x8c/0x1f0 [ 23.279558][ T3188] ext4_end_io_rsv_work+0x2d3/0x370 [ 23.284776][ T3188] process_scheduled_works+0x483/0x9a0 [ 23.290240][ T3188] worker_thread+0x526/0x730 [ 23.294929][ T3188] kthread+0x1d1/0x210 [ 23.299007][ T3188] ret_from_fork+0x4b/0x60 [ 23.303429][ T3188] ret_from_fork_asm+0x1a/0x30 [ 23.308203][ T3188] [ 23.310609][ T3188] read to 0xffff8881057ec908 of 8 bytes by task 3188 on cpu 1: [ 23.318233][ T3188] xas_find_marked+0x216/0x660 [ 23.323019][ T3188] find_get_entry+0x5d/0x290 [ 23.327620][ T3188] filemap_get_folios_tag+0x136/0x210 [ 23.333002][ T3188] filemap_fdatawait_keep_errors+0x6a/0x180 [ 23.338902][ T3188] sync_inodes_sb+0x3bb/0x460 [ 23.343586][ T3188] sync_inodes_one_sb+0x3d/0x50 [ 23.348459][ T3188] iterate_supers+0xa3/0x140 [ 23.353055][ T3188] ksys_sync+0x5d/0xe0 [ 23.357139][ T3188] __do_sys_sync+0xe/0x20 [ 23.361474][ T3188] x64_sys_call+0xb99/0x2d70 [ 23.366078][ T3188] do_syscall_64+0xc9/0x1c0 [ 23.370595][ T3188] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 23.376592][ T3188] 2024/06/23 10:25:08 SYZFATAL: failed to send *flatrpc.ExecutorMessageRawT: write tcp 10.128.1.113:41738->10.128.0.163:30031: write: broken pipe [ 23.378923][ T3188] value changed: 0xffffffffffff0000 -> 0xffffffff00000000 [ 23.386207][ T3188] [ 23.388523][ T3188] Reported by Kernel Concurrency Sanitizer on: [ 23.394683][ T3188] CPU: 1 PID: 3188 Comm: syz-executor.4 Not tainted 6.10.0-rc4-syzkaller-00301-g5f583a3162ff #0 [ 23.405115][ T3188] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 23.415181][ T3188] ==================================================================