last executing test programs: 640.653641ms ago: executing program 0 (id=37): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/sync/sw_sync', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/sync/sw_sync', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/sync/sw_sync', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/sync/sw_sync', 0x800, 0x0) 622.623781ms ago: executing program 0 (id=41): syz_init_net_socket$rose(0xb, 0x5, 0x0) 584.270872ms ago: executing program 0 (id=59): execveat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), 0x0) 568.120183ms ago: executing program 0 (id=62): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsu', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsu', 0x800, 0x0) 567.648933ms ago: executing program 0 (id=66): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/kernel/yama/ptrace_scope', 0x2, 0x0) 555.772073ms ago: executing program 0 (id=70): rt_sigreturn() 193.304734ms ago: executing program 2 (id=217): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 173.861555ms ago: executing program 2 (id=220): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vhost-vsock', 0x2, 0x0) 173.081375ms ago: executing program 2 (id=225): lchown(&(0x7f0000000000), 0x0, 0x0) 151.792675ms ago: executing program 2 (id=228): clone3(&(0x7f0000000000), 0x0) exit(0x0) 151.665415ms ago: executing program 2 (id=230): io_submit(0x0, 0x0, &(0x7f0000000000)) 150.036495ms ago: executing program 2 (id=233): sync() 36.273789ms ago: executing program 1 (id=257): sysinfo(&(0x7f0000000000)) 36.180619ms ago: executing program 3 (id=258): syz_open_dev$dmmidi(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$dmmidi(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$dmmidi(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$dmmidi(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$dmmidi(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$dmmidi(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$dmmidi(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$dmmidi(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$dmmidi(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$dmmidi(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$dmmidi(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$dmmidi(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$dmmidi(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$dmmidi(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$dmmidi(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$dmmidi(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$dmmidi(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$dmmidi(&(0x7f0000000500), 0x4, 0x800) 36.108039ms ago: executing program 1 (id=259): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/netlabel', 0x2, 0x0) 36.022699ms ago: executing program 3 (id=260): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 35.984439ms ago: executing program 4 (id=261): mkdir(&(0x7f0000000000), 0x0) 17.85735ms ago: executing program 4 (id=262): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/udmabuf', 0x2, 0x0) 17.75303ms ago: executing program 1 (id=263): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer', 0x800, 0x0) 17.607079ms ago: executing program 3 (id=264): fanotify_init(0x0, 0x0) 17.46739ms ago: executing program 4 (id=265): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/capi20', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/capi20', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/capi20', 0x800, 0x0) 17.341559ms ago: executing program 3 (id=266): syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vim2m(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vim2m(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$vim2m(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$vim2m(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$vim2m(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$vim2m(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$vim2m(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$vim2m(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$vim2m(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$vim2m(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$vim2m(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$vim2m(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$vim2m(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$vim2m(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$vim2m(&(0x7f0000000500), 0x4, 0x800) 17.29937ms ago: executing program 1 (id=267): eventfd(0x0) 17.05897ms ago: executing program 4 (id=268): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vtpmx', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vtpmx', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vtpmx', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vtpmx', 0x800, 0x0) 647.11µs ago: executing program 1 (id=269): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/load', 0x2, 0x0) 518.23µs ago: executing program 3 (id=270): link(&(0x7f0000000000), &(0x7f0000000000)) 410.18µs ago: executing program 4 (id=271): poll(&(0x7f0000000000), 0x0, 0x0) 254.87µs ago: executing program 1 (id=272): socket$kcm(0x29, 0x2, 0x0) 126.1µs ago: executing program 3 (id=273): syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sg(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sg(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$sg(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$sg(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$sg(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$sg(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$sg(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$sg(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$sg(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$sg(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$sg(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$sg(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$sg(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$sg(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$sg(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$sg(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$sg(&(0x7f0000000500), 0x4, 0x800) 0s ago: executing program 4 (id=274): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status', 0x0, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.108' (ED25519) to the list of known hosts. [ 30.519786][ T28] audit: type=1400 audit(1781430059.458:117): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 30.543305][ T28] audit: type=1400 audit(1781430059.478:118): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.544067][ T3286] cgroup: Unknown subsys name 'net' [ 30.571475][ T28] audit: type=1400 audit(1781430059.508:119): avc: denied { unmount } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 30.685533][ T3286] cgroup: Unknown subsys name 'cpuset' [ 30.691818][ T3286] cgroup: Unknown subsys name 'rlimit' [ 30.804255][ T28] audit: type=1400 audit(1781430059.738:120): avc: denied { setattr } for pid=3286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.830261][ T28] audit: type=1400 audit(1781430059.748:121): avc: denied { create } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.854857][ T28] audit: type=1400 audit(1781430059.748:122): avc: denied { write } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.857621][ T3288] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 30.875665][ T28] audit: type=1400 audit(1781430059.748:123): avc: denied { read } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 30.904535][ T28] audit: type=1400 audit(1781430059.748:124): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.917219][ T3286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.929660][ T28] audit: type=1400 audit(1781430059.748:125): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.961936][ T28] audit: type=1400 audit(1781430059.768:126): avc: denied { read } for pid=3020 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 32.557728][ T3547] ================================================================== [ 32.566141][ T3547] BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked [ 32.573570][ T3547] [ 32.575916][ T3547] read-write to 0xffff888106d86908 of 8 bytes by task 49 on cpu 1: [ 32.583822][ T3547] __xa_clear_mark+0xf5/0x1e0 [ 32.588554][ T3547] __folio_end_writeback+0xf4/0x360 [ 32.593871][ T3547] folio_end_writeback_no_dropbehind+0x6d/0x1d0 [ 32.600417][ T3547] folio_end_writeback+0x1c/0x70 [ 32.605403][ T3547] ext4_finish_bio+0x454/0x770 [ 32.610207][ T3547] ext4_release_io_end+0x9f/0x1f0 [ 32.615272][ T3547] ext4_end_io_end+0x18d/0x240 [ 32.620073][ T3547] ext4_end_io_rsv_work+0x15b/0x1f0 [ 32.625309][ T3547] process_scheduled_works+0x4d4/0x9a0 [ 32.630808][ T3547] worker_thread+0x569/0x750 [ 32.635449][ T3547] kthread+0x221/0x270 [ 32.639637][ T3547] ret_from_fork+0x146/0x330 [ 32.644311][ T3547] ret_from_fork_asm+0x1a/0x30 [ 32.649110][ T3547] [ 32.651461][ T3547] read to 0xffff888106d86908 of 8 bytes by task 3547 on cpu 0: [ 32.659022][ T3547] xas_find_marked+0x211/0x650 [ 32.663827][ T3547] filemap_get_folios_tag+0xf7/0x400 [ 32.669158][ T3547] filemap_fdatawait_keep_errors+0x6c/0x190 [ 32.675172][ T3547] sync_inodes_sb+0x41e/0x4d0 [ 32.679973][ T3547] sync_inodes_one_sb+0x3d/0x50 [ 32.684943][ T3547] __iterate_supers+0x110/0x1f0 [ 32.689832][ T3547] iterate_supers+0x1f/0x30 [ 32.694370][ T3547] __ia32_sys_sync+0x5c/0xb0 [ 32.699008][ T3547] x64_sys_call+0x2f3a/0x3020 [ 32.703719][ T3547] do_syscall_64+0x136/0x3c0 [ 32.708346][ T3547] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.714260][ T3547] [ 32.716604][ T3547] value changed: 0xffffffffffffffff -> 0xffffffffff800000 [ 32.723730][ T3547] [ 32.726078][ T3547] Reported by Kernel Concurrency Sanitizer on: [ 32.732259][ T3547] CPU: 0 UID: 0 PID: 3547 Comm: syz.2.233 Not tainted syzkaller #0 PREEMPT(lazy) [ 32.741488][ T3547] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 32.751620][ T3547] ================================================================== [ 32.928856][ T3378] syz.0.70 (3378) used greatest stack depth: 11000 bytes left