last executing test programs: 2.087225019s ago: executing program 1 (id=68): socket$unix(0x1, 0x1, 0x0) 2.06588276s ago: executing program 1 (id=75): io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) 2.065366709s ago: executing program 1 (id=78): getpgid(0x0) 2.04078966s ago: executing program 1 (id=83): syz_init_net_socket$x25(0x9, 0x5, 0x0) 2.0400431s ago: executing program 1 (id=87): rt_sigreturn() 906.131832ms ago: executing program 2 (id=423): file_setattr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0) 879.663133ms ago: executing program 2 (id=426): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/load', 0x2, 0x0) 879.412083ms ago: executing program 2 (id=429): personality(0x0) 855.900824ms ago: executing program 2 (id=434): socket$pppl2tp(0x18, 0x1, 0x1) 855.691504ms ago: executing program 2 (id=436): futex_waitv(&(0x7f0000000000), 0x0, 0x0, &(0x7f0000000000), 0x0) 829.466704ms ago: executing program 2 (id=441): pause() 223.420226ms ago: executing program 4 (id=568): capget(&(0x7f0000000000), &(0x7f0000000000)) 223.190716ms ago: executing program 4 (id=571): sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) 197.067616ms ago: executing program 4 (id=572): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/load', 0x2, 0x0) 196.474056ms ago: executing program 4 (id=575): setrlimit(0x0, &(0x7f0000000000)) 196.347956ms ago: executing program 4 (id=577): setreuid(0x0, 0x0) 148.801407ms ago: executing program 4 (id=580): sync() 148.588218ms ago: executing program 1 (id=584): timer_delete(0x0) 45.988849ms ago: executing program 0 (id=589): alarm(0x0) 45.817869ms ago: executing program 0 (id=590): futimesat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 45.744549ms ago: executing program 3 (id=591): mlock2(0x0, 0x0, 0x0) 45.400289ms ago: executing program 0 (id=592): setresuid(0x0, 0x0, 0x0) 45.378369ms ago: executing program 3 (id=593): socket$tipc(0x1e, 0x2, 0x0) 45.322039ms ago: executing program 3 (id=594): copy_file_range(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) 668.14µs ago: executing program 0 (id=595): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cachefiles', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cachefiles', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cachefiles', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles', 0x800, 0x0) 464.31µs ago: executing program 0 (id=596): nanosleep(&(0x7f0000000000), 0x0) 364.73µs ago: executing program 3 (id=597): getpriority(0x0, 0x0) 231.6µs ago: executing program 3 (id=598): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm', 0x800, 0x0) 83.54µs ago: executing program 0 (id=599): syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$vim2m(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$vim2m(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$vim2m(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$vim2m(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$vim2m(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$vim2m(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$vim2m(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$vim2m(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$vim2m(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$vim2m(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$vim2m(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$vim2m(&(0x7f0000000500), 0x4, 0x800) 0s ago: executing program 3 (id=600): syz_open_dev$dvb_demux(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$dvb_demux(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$dvb_demux(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$dvb_demux(&(0x7f0000000140), 0xa, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000180), 0xa, 0x1) syz_open_dev$dvb_demux(&(0x7f00000001c0), 0xa, 0x2) syz_open_dev$dvb_demux(&(0x7f0000000200), 0xa, 0x800) syz_open_dev$dvb_demux(&(0x7f0000000240), 0x14, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000280), 0x14, 0x1) syz_open_dev$dvb_demux(&(0x7f00000002c0), 0x14, 0x2) syz_open_dev$dvb_demux(&(0x7f0000000300), 0x14, 0x800) syz_open_dev$dvb_demux(&(0x7f0000000340), 0x1e, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000380), 0x1e, 0x1) syz_open_dev$dvb_demux(&(0x7f00000003c0), 0x1e, 0x2) syz_open_dev$dvb_demux(&(0x7f0000000400), 0x1e, 0x800) syz_open_dev$dvb_demux(&(0x7f0000000440), 0x28, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000480), 0x28, 0x1) syz_open_dev$dvb_demux(&(0x7f00000004c0), 0x28, 0x2) syz_open_dev$dvb_demux(&(0x7f0000000500), 0x28, 0x800) kernel console output (not intermixed with test programs): [ 25.999409][ T28] audit: type=1400 audit(1784061192.481:103): avc: denied { search } for pid=3177 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.022108][ T28] audit: type=1400 audit(1784061192.481:104): avc: denied { search } for pid=3177 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.678089][ T28] kauditd_printk_skb: 13 callbacks suppressed [ 26.678110][ T28] audit: type=1400 audit(1784061193.151:118): avc: denied { write } for pid=3219 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 26.715690][ T28] audit: type=1400 audit(1784061193.191:119): avc: denied { write } for pid=3230 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.018010][ T28] audit: type=1400 audit(1784061193.491:120): avc: denied { write } for pid=3233 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.048272][ T28] audit: type=1400 audit(1784061193.521:121): avc: denied { write } for pid=3244 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.123687][ T28] audit: type=1400 audit(1784061193.601:122): avc: denied { write } for pid=3247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.154163][ T28] audit: type=1400 audit(1784061193.631:123): avc: denied { write } for pid=3258 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.229798][ T28] audit: type=1400 audit(1784061193.711:124): avc: denied { write } for pid=3261 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 27.260503][ T28] audit: type=1400 audit(1784061193.741:125): avc: denied { write } for pid=3272 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.148' (ED25519) to the list of known hosts. [ 31.066087][ T28] audit: type=1400 audit(1784061197.541:126): avc: denied { mounton } for pid=3280 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 31.089576][ T28] audit: type=1400 audit(1784061197.571:127): avc: denied { mount } for pid=3280 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.093007][ T3280] cgroup: Unknown subsys name 'net' [ 31.239762][ T3280] cgroup: Unknown subsys name 'cpuset' [ 31.246520][ T3280] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.406903][ T3285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 31.446510][ T3280] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 32.222978][ T28] kauditd_printk_skb: 12 callbacks suppressed [ 32.223002][ T28] audit: type=1400 audit(1784061198.701:140): avc: denied { execmem } for pid=3289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 32.279822][ T28] audit: type=1400 audit(1784061198.741:141): avc: denied { read } for pid=3295 comm="syz-executor" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 32.311081][ T28] audit: type=1400 audit(1784061198.741:142): avc: denied { open } for pid=3295 comm="syz-executor" path="net:[4026531833]" dev="nsfs" ino=4026531833 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 32.336072][ T28] audit: type=1400 audit(1784061198.741:143): avc: denied { mounton } for pid=3294 comm="syz-executor" path="/" dev="sda1" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:root_t tclass=dir permissive=1 [ 32.396378][ T28] audit: type=1400 audit(1784061198.871:144): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/root/syzkaller.cSr0OO/syz-tmp" dev="sda1" ino=2042 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_home_t tclass=dir permissive=1 [ 32.421625][ T28] audit: type=1400 audit(1784061198.871:145): avc: denied { mount } for pid=3296 comm="syz-executor" name="/" dev="tmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 32.457996][ T28] audit: type=1400 audit(1784061198.871:146): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/root/syzkaller.cSr0OO/syz-tmp/newroot/dev" dev="tmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 32.484027][ T28] audit: type=1400 audit(1784061198.871:147): avc: denied { mount } for pid=3296 comm="syz-executor" name="/" dev="proc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 32.510507][ T28] audit: type=1400 audit(1784061198.871:148): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/root/syzkaller.cSr0OO/syz-tmp/newroot/sys/kernel/debug" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=dir permissive=1 [ 32.576178][ T28] audit: type=1400 audit(1784061198.871:149): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/root/syzkaller.cSr0OO/syz-tmp/newroot/proc/sys/fs/binfmt_misc" dev="proc" ino=2570 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysctl_fs_t tclass=dir permissive=1 [ 34.693922][ T3392] syz.1.87 (3392) used greatest stack depth: 11040 bytes left [ 34.851203][ T3908] ================================================================== [ 34.859636][ T3908] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 34.867319][ T3908] [ 34.869812][ T3908] read-write to 0xffff888106ea8478 of 8 bytes by task 30 on cpu 0: [ 34.877735][ T3908] __xa_clear_mark+0xf5/0x1e0 [ 34.882553][ T3908] __folio_end_writeback+0xf4/0x360 [ 34.887993][ T3908] folio_end_writeback_no_dropbehind+0x6d/0x1d0 [ 34.894299][ T3908] folio_end_writeback+0x1c/0x70 [ 34.899527][ T3908] ext4_finish_bio+0x454/0x770 [ 34.904526][ T3908] ext4_release_io_end+0x9f/0x1f0 [ 34.909683][ T3908] ext4_end_io_end+0x18d/0x240 [ 34.914860][ T3908] ext4_end_io_rsv_work+0x15b/0x1f0 [ 34.920142][ T3908] process_scheduled_works+0x4d4/0x9a0 [ 34.925845][ T3908] worker_thread+0x569/0x750 [ 34.930644][ T3908] kthread+0x221/0x270 [ 34.934824][ T3908] ret_from_fork+0x146/0x330 [ 34.939551][ T3908] ret_from_fork_asm+0x1a/0x30 [ 34.944543][ T3908] [ 34.946918][ T3908] read to 0xffff888106ea8478 of 8 bytes by task 3908 on cpu 1: [ 34.954755][ T3908] xas_find_marked+0x211/0x650 [ 34.960086][ T3908] filemap_get_folios_tag+0xf7/0x400 [ 34.966237][ T3908] filemap_fdatawait_keep_errors+0x6c/0x190 [ 34.973374][ T3908] sync_inodes_sb+0x41e/0x4d0 [ 34.978640][ T3908] sync_inodes_one_sb+0x3d/0x50 [ 34.983694][ T3908] __iterate_supers+0x110/0x1f0 [ 34.988768][ T3908] iterate_supers+0x1f/0x30 [ 34.993395][ T3908] __ia32_sys_sync+0x5c/0xb0 [ 34.998811][ T3908] x64_sys_call+0x2f3a/0x3020 [ 35.003798][ T3908] do_syscall_64+0x136/0x3c0 [ 35.008514][ T3908] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.014615][ T3908] [ 35.016994][ T3908] value changed: 0xfffc000000000000 -> 0x0000000000000000 [ 35.024561][ T3908] [ 35.027356][ T3908] Reported by Kernel Concurrency Sanitizer on: [ 35.033636][ T3908] CPU: 1 UID: 0 PID: 3908 Comm: syz.4.580 Not tainted syzkaller #0 PREEMPT(lazy) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 35.043245][ T3908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 35.053335][ T3908] ==================================================================