last executing test programs: 1.197972454s ago: executing program 0 (id=325): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cdrom', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/cdrom', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/cdrom', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cdrom', 0x800, 0x0) 1.166814744s ago: executing program 0 (id=333): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/snd/seq', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snd/seq', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snd/seq', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snd/seq', 0x800, 0x0) 1.165872824s ago: executing program 0 (id=337): getpriority(0x0, 0x0) 1.145841684s ago: executing program 0 (id=340): setfsgid(0x0) 1.145469994s ago: executing program 0 (id=342): capset(&(0x7f0000000000), &(0x7f0000000000)) 1.144856264s ago: executing program 0 (id=345): rt_sigreturn() 593.747682ms ago: executing program 3 (id=526): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status', 0x0, 0x0) 569.576442ms ago: executing program 3 (id=531): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptp1', 0x800, 0x0) 569.040792ms ago: executing program 3 (id=535): rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0) 549.547813ms ago: executing program 3 (id=536): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nmem0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nmem0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/nmem0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/nmem0', 0x800, 0x0) 532.671863ms ago: executing program 3 (id=543): ftruncate(0xffffffffffffffff, 0x0) 531.218663ms ago: executing program 3 (id=548): pause() 399.601885ms ago: executing program 2 (id=578): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/xen/evtchn', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/xen/evtchn', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/xen/evtchn', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/xen/evtchn', 0x800, 0x0) 399.372065ms ago: executing program 4 (id=580): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/kernel/yama/ptrace_scope', 0x2, 0x0) 399.267745ms ago: executing program 1 (id=581): memfd_secret(0x0) 398.851235ms ago: executing program 2 (id=582): get_mempolicy(&(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0, 0x0) 398.617125ms ago: executing program 4 (id=583): syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x800) 398.078785ms ago: executing program 2 (id=584): syz_init_net_socket$x25(0x9, 0x5, 0x0) 398.035875ms ago: executing program 1 (id=585): shmat(0x0, 0x0, 0x0) 397.803095ms ago: executing program 4 (id=586): lchown(&(0x7f0000000000), 0x0, 0x0) 371.496695ms ago: executing program 1 (id=587): statfs(&(0x7f0000000000), &(0x7f0000000000)) 371.244715ms ago: executing program 2 (id=588): syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) 371.154275ms ago: executing program 2 (id=589): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold', 0x2, 0x0) 371.019435ms ago: executing program 4 (id=590): umount2(&(0x7f0000000000), 0x0) 370.966645ms ago: executing program 1 (id=591): ioperm(0x0, 0x0, 0x0) 370.883245ms ago: executing program 4 (id=592): wait4(0x0, 0x0, 0x0, 0x0) 370.785125ms ago: executing program 1 (id=593): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/random', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/random', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/random', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/random', 0x800, 0x0) 370.621515ms ago: executing program 2 (id=594): listxattr(&(0x7f0000000000), &(0x7f0000000000), 0x0) 317.483496ms ago: executing program 1 (id=596): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 257.97µs ago: executing program 5 (id=598): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=595): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): syzkaller syzkaller login: [ 23.445379][ T29] kauditd_printk_skb: 48 callbacks suppressed [ 23.445410][ T29] audit: type=1400 audit(1746628837.576:60): avc: denied { transition } for pid=3292 comm="sshd-session" path="/bin/sh" dev="sda1" ino=90 scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.449620][ T29] audit: type=1400 audit(1746628837.576:61): avc: denied { noatsecure } for pid=3292 comm="sshd-session" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.452402][ T29] audit: type=1400 audit(1746628837.576:62): avc: denied { write } for pid=3292 comm="sh" path="pipe:[597]" dev="pipefs" ino=597 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 23.455565][ T29] audit: type=1400 audit(1746628837.576:63): avc: denied { rlimitinh } for pid=3292 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 23.458284][ T29] audit: type=1400 audit(1746628837.576:64): avc: denied { siginh } for pid=3292 comm="sh" scontext=system_u:system_r:sshd_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 Warning: Permanently added '10.128.1.76' (ED25519) to the list of known hosts. [ 31.485731][ T29] audit: type=1400 audit(1746628845.616:65): avc: denied { mounton } for pid=3306 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 31.486814][ T3306] cgroup: Unknown subsys name 'net' [ 31.508485][ T29] audit: type=1400 audit(1746628845.616:66): avc: denied { mount } for pid=3306 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.535900][ T29] audit: type=1400 audit(1746628845.636:67): avc: denied { unmount } for pid=3306 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 31.674920][ T3306] cgroup: Unknown subsys name 'cpuset' [ 31.681117][ T3306] cgroup: Unknown subsys name 'rlimit' [ 31.872260][ T29] audit: type=1400 audit(1746628845.996:68): avc: denied { setattr } for pid=3306 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 31.897928][ T29] audit: type=1400 audit(1746628845.996:69): avc: denied { create } for pid=3306 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 31.918428][ T29] audit: type=1400 audit(1746628845.996:70): avc: denied { write } for pid=3306 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 31.922476][ T3308] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 31.938860][ T29] audit: type=1400 audit(1746628845.996:71): avc: denied { read } for pid=3306 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 31.964026][ T3306] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 31.967651][ T29] audit: type=1400 audit(1746628846.006:72): avc: denied { mounton } for pid=3306 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 32.001327][ T29] audit: type=1400 audit(1746628846.006:73): avc: denied { mount } for pid=3306 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 32.024574][ T29] audit: type=1400 audit(1746628846.076:74): avc: denied { relabelto } for pid=3308 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 33.117503][ T3446] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 33.999023][ T3757] mmap: syz.4.424 (3757) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 34.803501][ T3941] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 35.194305][ T3939] chnl_net:caif_netlink_parms(): no params data found [ 35.281840][ T3005] ================================================================== [ 35.289972][ T3005] BUG: KCSAN: data-race in dont_mount / lookup_fast [ 35.296600][ T3005] [ 35.298921][ T3005] read-write to 0xffff888106df7f00 of 4 bytes by task 3309 on cpu 1: [ 35.306985][ T3005] dont_mount+0x2a/0x40 [ 35.311144][ T3005] vfs_unlink+0x28f/0x420 [ 35.315477][ T3005] do_unlinkat+0x28e/0x4c0 [ 35.319902][ T3005] __x64_sys_unlink+0x2e/0x40 [ 35.324598][ T3005] x64_sys_call+0x22a6/0x2fb0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 35.329331][ T3005] do_syscall_64+0xd0/0x1a0 [ 35.333865][ T3005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.339786][ T3005] [ 35.342116][ T3005] read to 0xffff888106df7f00 of 4 bytes by task 3005 on cpu 0: [ 35.349714][ T3005] lookup_fast+0xf0/0x320 [ 35.354062][ T3005] walk_component+0x3f/0x220 [ 35.358704][ T3005] path_lookupat+0xfe/0x2a0 [ 35.363253][ T3005] filename_lookup+0x147/0x340 [ 35.368043][ T3005] do_readlinkat+0x7d/0x320 [ 35.372556][ T3005] __x64_sys_readlink+0x47/0x60 [ 35.377413][ T3005] x64_sys_call+0x2cf3/0x2fb0 [ 35.382099][ T3005] do_syscall_64+0xd0/0x1a0 [ 35.386615][ T3005] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 35.392527][ T3005] [ 35.395372][ T3005] value changed: 0x00300008 -> 0x00004008 [ 35.401087][ T3005] [ 35.403412][ T3005] Reported by Kernel Concurrency Sanitizer on: [ 35.409619][ T3005] CPU: 0 UID: 0 PID: 3005 Comm: udevd Not tainted 6.15.0-rc5-syzkaller-00038-g707df3375124 #0 PREEMPT(voluntary) [ 35.421606][ T3005] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 [ 35.431671][ T3005] ================================================================== [ 35.726123][ T2167] bond0 (unregistering): Released all slaves