last executing test programs: 1.147383937s ago: executing program 1 (id=313): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)) 1.132541027s ago: executing program 1 (id=319): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/i915', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/i915', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/i915', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/i915', 0x800, 0x0) 1.132202097s ago: executing program 1 (id=323): link(&(0x7f0000000000), &(0x7f0000000000)) 1.117849857s ago: executing program 1 (id=327): rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000)) 1.099522837s ago: executing program 1 (id=331): socket$packet(0x11, 0x2, 0x300) 1.098838788s ago: executing program 1 (id=335): msgrcv(0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) 740.390352ms ago: executing program 3 (id=484): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/change-rule', 0x2, 0x0) 739.849341ms ago: executing program 3 (id=488): syz_init_net_socket$x25(0x9, 0x5, 0x0) 722.762452ms ago: executing program 3 (id=492): time(&(0x7f0000000000)) 722.452462ms ago: executing program 3 (id=494): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vndbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vndbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vndbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vndbinder', 0x800, 0x0) 722.008652ms ago: executing program 3 (id=497): mq_notify(0xffffffffffffffff, &(0x7f0000000000)) 705.882942ms ago: executing program 3 (id=500): pause() 647.602633ms ago: executing program 2 (id=522): shmat(0x0, 0x0, 0x0) 647.468693ms ago: executing program 2 (id=523): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom', 0x800, 0x0) 647.245433ms ago: executing program 2 (id=526): getpriority(0x0, 0x0) 630.594583ms ago: executing program 2 (id=529): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/onlycap', 0x2, 0x0) 630.328573ms ago: executing program 2 (id=532): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/access', 0x2, 0x0) 629.963753ms ago: executing program 2 (id=536): rt_sigreturn() 458.300505ms ago: executing program 4 (id=583): timerfd_create(0x0, 0x0) 458.114305ms ago: executing program 4 (id=585): lstat(&(0x7f0000000000), &(0x7f0000000000)) 457.681585ms ago: executing program 4 (id=587): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rnullb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rnullb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rnullb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rnullb0', 0x800, 0x0) 429.345035ms ago: executing program 4 (id=589): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/btf/vmlinux', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/btf/vmlinux', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/btf/vmlinux', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/btf/vmlinux', 0x800, 0x0) 264.145167ms ago: executing program 4 (id=590): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 82.239249ms ago: executing program 0 (id=631): set_robust_list(&(0x7f0000000000), 0x0) 73.370069ms ago: executing program 0 (id=632): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cdrom', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cdrom', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cdrom', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cdrom', 0x800, 0x0) 24.345889ms ago: executing program 0 (id=633): newfstatat(0xffffffffffffff9c, &(0x7f0000000000), &(0x7f0000000000), 0x0) 24.232669ms ago: executing program 0 (id=634): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm', 0x2, 0x0) 24.129569ms ago: executing program 0 (id=635): io_uring_enter(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) 24.087389ms ago: executing program 0 (id=636): socket$nl_xfrm(0x10, 0x3, 0x6) 0s ago: executing program 4 (id=614): fsopen(&(0x7f0000000000), 0x0) kernel console output (not intermixed with test programs): [ 19.200191][ T28] kauditd_printk_skb: 13 callbacks suppressed [ 19.200205][ T28] audit: type=1400 audit(1778343355.782:118): avc: denied { write } for pid=3223 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.229447][ T28] audit: type=1400 audit(1778343355.802:119): avc: denied { write } for pid=3234 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.930051][ T28] audit: type=1400 audit(1778343356.512:120): avc: denied { write } for pid=3239 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.952974][ T28] audit: type=1400 audit(1778343356.532:121): avc: denied { write } for pid=3250 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.086775][ T28] audit: type=1400 audit(1778343356.672:122): avc: denied { write } for pid=3253 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.109694][ T28] audit: type=1400 audit(1778343356.682:123): avc: denied { write } for pid=3264 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.547541][ T28] audit: type=1400 audit(1778343357.132:124): avc: denied { write } for pid=3267 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.570464][ T28] audit: type=1400 audit(1778343357.152:125): avc: denied { write } for pid=3278 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.123' (ED25519) to the list of known hosts. [ 25.919878][ T28] audit: type=1400 audit(1778343362.502:126): avc: denied { mounton } for pid=3288 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 25.943017][ T28] audit: type=1400 audit(1778343362.532:127): avc: denied { mount } for pid=3288 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 25.943765][ T3288] cgroup: Unknown subsys name 'net' [ 25.972996][ T28] audit: type=1400 audit(1778343362.562:128): avc: denied { unmount } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.091732][ T3288] cgroup: Unknown subsys name 'cpuset' [ 26.097748][ T3288] cgroup: Unknown subsys name 'rlimit' [ 26.190909][ T28] audit: type=1400 audit(1778343362.772:129): avc: denied { setattr } for pid=3288 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.222660][ T28] audit: type=1400 audit(1778343362.782:130): avc: denied { create } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.243218][ T28] audit: type=1400 audit(1778343362.782:131): avc: denied { write } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.268762][ T3292] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 26.271221][ T28] audit: type=1400 audit(1778343362.782:132): avc: denied { read } for pid=3288 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 26.297702][ T28] audit: type=1400 audit(1778343362.792:133): avc: denied { mounton } for pid=3288 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.322656][ T28] audit: type=1400 audit(1778343362.792:134): avc: denied { mount } for pid=3288 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.327995][ T3288] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 26.346107][ T28] audit: type=1400 audit(1778343362.792:135): avc: denied { read } for pid=3023 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 27.421769][ T3401] mmap: syz.1.89 (3401) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 29.208399][ T2983] ================================================================== [ 29.216503][ T2983] BUG: KCSAN: data-race in d_make_discardable / path_lookupat [ 29.223971][ T2983] [ 29.226290][ T2983] write to 0xffff8881007cc780 of 4 bytes by task 3293 on cpu 0: [ 29.233915][ T2983] d_make_discardable+0x4f/0xa0 [ 29.238783][ T2983] simple_unlink+0x68/0x80 [ 29.243216][ T2983] shmem_unlink+0x12d/0x140 [ 29.247723][ T2983] vfs_unlink+0x1c7/0x490 [ 29.252054][ T2983] filename_unlinkat+0x1e2/0x410 SYZFAIL: failed to recv rpc [ 29.257006][ T2983] __se_sys_unlink+0x2b/0xe0 [ 29.261596][ T2983] __x64_sys_unlink+0x1f/0x30 [ 29.266272][ T2983] x64_sys_call+0x2eb6/0x3020 [ 29.270941][ T2983] do_syscall_64+0x12c/0x3b0 [ 29.275520][ T2983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 29.281421][ T2983] [ 29.283728][ T2983] read to 0xffff8881007cc780 of 4 bytes by task 2983 on cpu 1: [ 29.291262][ T2983] path_lookupat+0x1d8/0x500 [ 29.295839][ T2983] filename_lookup+0x190/0x390 [ 29.300591][ T2983] do_readlinkat+0x74/0x2f0 [ 29.305082][ T2983] __x64_sys_readlink+0x47/0x60 [ 29.309918][ T2983] x64_sys_call+0x2b51/0x3020 [ 29.314678][ T2983] do_syscall_64+0x12c/0x3b0 [ 29.319256][ T2983] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 29.325134][ T2983] [ 29.327452][ T2983] value changed: 0x08300080 -> 0x00004080 [ 29.333155][ T2983] [ 29.335458][ T2983] Reported by Kernel Concurrency Sanitizer on: [ 29.341625][ T2983] CPU: 1 UID: 0 PID: 2983 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 29.350476][ T2983] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 29.360690][ T2983] ==================================================================