last executing test programs: 2.465413472s ago: executing program 4 (id=149): mknod(&(0x7f0000000000), 0x0, 0x0) 2.435921413s ago: executing program 4 (id=152): socket$inet_dccp(0x2, 0x6, 0x0) 2.370182584s ago: executing program 4 (id=182): rt_sigreturn() 2.003800109s ago: executing program 1 (id=303): poll(&(0x7f0000000000), 0x0, 0x0) 2.002426089s ago: executing program 1 (id=306): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/ambient', 0x2, 0x0) 1.98437673s ago: executing program 1 (id=309): rt_tgsigqueueinfo(0x0, 0x0, 0x0, &(0x7f0000000000)) 1.98389348s ago: executing program 1 (id=312): map_shadow_stack(0x0, 0x0, 0x0) 1.96524399s ago: executing program 1 (id=316): syslog(0x0, 0x0, 0x0) 1.939724831s ago: executing program 1 (id=322): pause() 955.120236ms ago: executing program 0 (id=576): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce', 0x800, 0x0) 930.084556ms ago: executing program 0 (id=580): truncate(&(0x7f0000000000), 0x0) 929.570396ms ago: executing program 0 (id=582): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/logging', 0x2, 0x0) 929.402956ms ago: executing program 2 (id=583): setreuid(0x0, 0x0) 882.001906ms ago: executing program 2 (id=584): socket$inet6_dccp(0xa, 0x6, 0x0) 881.698677ms ago: executing program 0 (id=585): nanosleep(&(0x7f0000000000), 0x0) 825.510588ms ago: executing program 4 (id=592): getcwd(&(0x7f0000000000), 0x0) 825.186487ms ago: executing program 3 (id=593): syz_open_dev$loop(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$loop(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$loop(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$loop(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$loop(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$loop(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$loop(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$loop(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$loop(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$loop(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$loop(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$loop(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$loop(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$loop(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$loop(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$loop(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$loop(&(0x7f0000000500), 0x4, 0x800) 825.069887ms ago: executing program 2 (id=594): execve(&(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) 620.693721ms ago: executing program 0 (id=589): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 378.839474ms ago: executing program 2 (id=596): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 211.291557ms ago: executing program 4 (id=597): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 191.383947ms ago: executing program 0 (id=599): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 183.443667ms ago: executing program 3 (id=598): setresuid(0x0, 0x0, 0x0) 166.082128ms ago: executing program 3 (id=603): syz_open_dev$dricontrol(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dricontrol(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$dricontrol(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$dricontrol(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$dricontrol(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$dricontrol(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$dricontrol(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$dricontrol(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$dricontrol(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$dricontrol(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$dricontrol(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$dricontrol(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$dricontrol(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$dricontrol(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$dricontrol(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$dricontrol(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$dricontrol(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$dricontrol(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$dricontrol(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$dricontrol(&(0x7f0000000500), 0x4, 0x800) 140.161138ms ago: executing program 2 (id=600): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vndbinder', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vndbinder', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vndbinder', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vndbinder', 0x800, 0x0) 139.783968ms ago: executing program 3 (id=604): rt_sigtimedwait(&(0x7f0000000000), 0x0, &(0x7f0000000000), 0x0) 136.105228ms ago: executing program 3 (id=605): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ashmem', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ashmem', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ashmem', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ashmem', 0x800, 0x0) 131.180998ms ago: executing program 2 (id=606): sched_rr_get_interval(0x0, &(0x7f0000000000)) 127.280848ms ago: executing program 3 (id=607): syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x0) syz_open_dev$sndmidi(&(0x7f0000000080), 0x2, 0x1) syz_open_dev$sndmidi(&(0x7f00000000c0), 0x2, 0x2) syz_open_dev$sndmidi(&(0x7f0000000100), 0x2, 0x800) syz_open_dev$sndmidi(&(0x7f0000000140), 0xc, 0x0) syz_open_dev$sndmidi(&(0x7f0000000180), 0xc, 0x1) syz_open_dev$sndmidi(&(0x7f00000001c0), 0xc, 0x2) syz_open_dev$sndmidi(&(0x7f0000000200), 0xc, 0x800) syz_open_dev$sndmidi(&(0x7f0000000240), 0x16, 0x0) syz_open_dev$sndmidi(&(0x7f0000000280), 0x16, 0x1) syz_open_dev$sndmidi(&(0x7f00000002c0), 0x16, 0x2) syz_open_dev$sndmidi(&(0x7f0000000300), 0x16, 0x800) syz_open_dev$sndmidi(&(0x7f0000000340), 0x20, 0x0) syz_open_dev$sndmidi(&(0x7f0000000380), 0x20, 0x1) syz_open_dev$sndmidi(&(0x7f00000003c0), 0x20, 0x2) syz_open_dev$sndmidi(&(0x7f0000000400), 0x20, 0x800) syz_open_dev$sndmidi(&(0x7f0000000440), 0x2a, 0x0) syz_open_dev$sndmidi(&(0x7f0000000480), 0x2a, 0x1) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2a, 0x2) syz_open_dev$sndmidi(&(0x7f0000000500), 0x2a, 0x800) 2.37876ms ago: executing program 5 (id=601): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/capi20', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/capi20', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/capi20', 0x800, 0x0) 0s ago: executing program 4 (id=602): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rnullb0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rnullb0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rnullb0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rnullb0', 0x800, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.150' (ED25519) to the list of known hosts. [ 28.098445][ T29] audit: type=1400 audit(1750064976.886:62): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 28.099641][ T3296] cgroup: Unknown subsys name 'net' [ 28.121385][ T29] audit: type=1400 audit(1750064976.886:63): avc: denied { mount } for pid=3296 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.148985][ T29] audit: type=1400 audit(1750064976.916:64): avc: denied { unmount } for pid=3296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 28.368247][ T3296] cgroup: Unknown subsys name 'cpuset' [ 28.374632][ T3296] cgroup: Unknown subsys name 'rlimit' [ 28.565557][ T29] audit: type=1400 audit(1750064977.346:65): avc: denied { setattr } for pid=3296 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 28.590097][ T29] audit: type=1400 audit(1750064977.346:66): avc: denied { create } for pid=3296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.611141][ T29] audit: type=1400 audit(1750064977.356:67): avc: denied { write } for pid=3296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.631863][ T29] audit: type=1400 audit(1750064977.356:68): avc: denied { read } for pid=3296 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 28.640554][ T3300] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 28.652229][ T29] audit: type=1400 audit(1750064977.356:69): avc: denied { mounton } for pid=3296 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 28.685622][ T29] audit: type=1400 audit(1750064977.356:70): avc: denied { mount } for pid=3296 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 28.709099][ T29] audit: type=1400 audit(1750064977.446:71): avc: denied { relabelto } for pid=3300 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 28.750565][ T3296] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 29.860474][ T3426] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.958123][ T3468] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 30.329504][ T3602] mmap: syz.3.280 (3602) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 31.730231][ T3929] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.440393][ T2999] ================================================================== [ 32.448625][ T2999] BUG: KCSAN: data-race in dont_mount / lookup_fast [ 32.455321][ T2999] [ 32.457750][ T2999] read-write to 0xffff888106ac66c0 of 4 bytes by task 3809 on cpu 1: [ 32.465990][ T2999] dont_mount+0x2a/0x40 [ 32.470284][ T2999] vfs_unlink+0x28f/0x420 [ 32.474651][ T2999] do_unlinkat+0x28e/0x4c0 [ 32.479172][ T2999] __x64_sys_unlink+0x2e/0x40 [ 32.483946][ T2999] x64_sys_call+0x22a6/0x2fb0 [ 32.488648][ T2999] do_syscall_64+0xd2/0x200 [ 32.493708][ T2999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.499988][ T2999] [ 32.502547][ T2999] read to 0xffff888106ac66c0 of 4 bytes by task 2999 on cpu 0: [ 32.510103][ T2999] lookup_fast+0xf0/0x320 [ 32.514475][ T2999] walk_component+0x3f/0x220 [ 32.519090][ T2999] path_lookupat+0xfe/0x2a0 [ 32.523808][ T2999] filename_lookup+0x147/0x340 [ 32.528603][ T2999] do_readlinkat+0x7d/0x320 [ 32.533141][ T2999] __x64_sys_readlink+0x47/0x60 [ 32.538052][ T2999] x64_sys_call+0x2cf3/0x2fb0 [ 32.542771][ T2999] do_syscall_64+0xd2/0x200 [ 32.547661][ T2999] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.553588][ T2999] [ 32.555929][ T2999] value changed: 0x00300008 -> 0x00004008 [ 32.561774][ T2999] [ 32.564103][ T2999] Reported by Kernel Concurrency Sanitizer on: [ 32.570300][ T2999] CPU: 0 UID: 0 PID: 2999 Comm: udevd Not tainted 6.16.0-rc2-syzkaller #0 PREEMPT(voluntary) [ 32.580570][ T2999] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 32.590644][ T2999] ==================================================================