last executing test programs: 390.820768ms ago: executing program 0 (id=483): syz_open_dev$audion(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$audion(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$audion(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$audion(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$audion(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$audion(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$audion(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$audion(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$audion(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$audion(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$audion(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$audion(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$audion(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$audion(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$audion(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$audion(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$audion(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$audion(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$audion(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$audion(&(0x7f0000000500), 0x4, 0x800) 390.302538ms ago: executing program 2 (id=486): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl', 0x800, 0x0) 374.815248ms ago: executing program 0 (id=489): shmget(0xffffffffffffffff, 0x0, 0x0, 0x0) 374.343629ms ago: executing program 1 (id=491): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vmci', 0x2, 0x0) 374.235649ms ago: executing program 3 (id=492): sched_setparam(0x0, &(0x7f0000000000)) 374.183699ms ago: executing program 2 (id=493): setresgid(0x0, 0x0, 0x0) 374.136059ms ago: executing program 2 (id=494): readlink(&(0x7f0000000000), &(0x7f0000000000), 0x0) 374.020579ms ago: executing program 0 (id=495): rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000)) 373.887389ms ago: executing program 1 (id=496): socket$pppoe(0x18, 0x1, 0x0) 373.832429ms ago: executing program 4 (id=497): epoll_create(0x0) 358.27822ms ago: executing program 0 (id=498): brk(0x0) 357.955179ms ago: executing program 3 (id=499): signalfd(0xffffffffffffffff, &(0x7f0000000000), 0x0) 357.71147ms ago: executing program 4 (id=500): syz_open_dev$vcsn(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vcsn(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vcsn(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vcsn(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$vcsn(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$vcsn(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$vcsn(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$vcsn(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$vcsn(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$vcsn(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$vcsn(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$vcsn(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$vcsn(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$vcsn(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$vcsn(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$vcsn(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$vcsn(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$vcsn(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$vcsn(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$vcsn(&(0x7f0000000500), 0x4, 0x800) 357.63519ms ago: executing program 2 (id=501): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/keys', 0x0, 0x0) 357.49526ms ago: executing program 0 (id=502): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member', 0x2, 0x0) 357.35336ms ago: executing program 3 (id=503): listxattr(&(0x7f0000000000), &(0x7f0000000000), 0x0) 357.26056ms ago: executing program 1 (id=504): fremovexattr(0xffffffffffffffff, &(0x7f0000000000)) 357.13842ms ago: executing program 4 (id=505): fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) 337.16718ms ago: executing program 2 (id=506): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userfaultfd', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userfaultfd', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userfaultfd', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/userfaultfd', 0x800, 0x0) 337.046611ms ago: executing program 4 (id=507): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/ipv6host', 0x2, 0x0) 336.956381ms ago: executing program 1 (id=508): socket$nl_route(0x10, 0x3, 0x0) 336.830631ms ago: executing program 3 (id=509): syz_open_dev$sndpcmc(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$sndpcmc(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000140), 0xa, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000180), 0xa, 0x1) syz_open_dev$sndpcmc(&(0x7f00000001c0), 0xa, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000200), 0xa, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000240), 0x14, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000280), 0x14, 0x1) syz_open_dev$sndpcmc(&(0x7f00000002c0), 0x14, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000300), 0x14, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000340), 0x1e, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000380), 0x1e, 0x1) syz_open_dev$sndpcmc(&(0x7f00000003c0), 0x1e, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000400), 0x1e, 0x800) syz_open_dev$sndpcmc(&(0x7f0000000440), 0x28, 0x0) syz_open_dev$sndpcmc(&(0x7f0000000480), 0x28, 0x1) syz_open_dev$sndpcmc(&(0x7f00000004c0), 0x28, 0x2) syz_open_dev$sndpcmc(&(0x7f0000000500), 0x28, 0x800) 336.628471ms ago: executing program 0 (id=510): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/validatetrans', 0x1, 0x0) 336.566321ms ago: executing program 2 (id=511): socket$inet_dccp(0x2, 0x6, 0x0) 336.445161ms ago: executing program 3 (id=512): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 336.393371ms ago: executing program 4 (id=513): clock_gettime(0x0, &(0x7f0000000000)) 336.352971ms ago: executing program 1 (id=514): chmod(&(0x7f0000000000), 0x0) 284.238293ms ago: executing program 3 (id=515): socket$key(0xf, 0x3, 0x2) 250.103606ms ago: executing program 4 (id=517): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=518): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.255' (ED25519) to the list of known hosts. [ 27.035145][ T28] kauditd_printk_skb: 3 callbacks suppressed [ 27.035165][ T28] audit: type=1400 audit(1771099419.586:70): avc: denied { mounton } for pid=3300 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 27.066081][ T3300] cgroup: Unknown subsys name 'net' [ 27.068357][ T28] audit: type=1400 audit(1771099419.616:71): avc: denied { mount } for pid=3300 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.093494][ T28] audit: type=1400 audit(1771099419.616:72): avc: denied { unmount } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 27.225454][ T3300] cgroup: Unknown subsys name 'cpuset' [ 27.231590][ T3300] cgroup: Unknown subsys name 'rlimit' [ 27.343882][ T28] audit: type=1400 audit(1771099419.886:73): avc: denied { setattr } for pid=3300 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 27.373657][ T28] audit: type=1400 audit(1771099419.896:74): avc: denied { create } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.394488][ T28] audit: type=1400 audit(1771099419.896:75): avc: denied { write } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 27.401534][ T3303] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 27.415127][ T28] audit: type=1400 audit(1771099419.896:76): avc: denied { read } for pid=3300 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 27.443940][ T28] audit: type=1400 audit(1771099419.896:77): avc: denied { mounton } for pid=3300 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 27.468809][ T28] audit: type=1400 audit(1771099419.896:78): avc: denied { mount } for pid=3300 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 27.492171][ T28] audit: type=1400 audit(1771099419.916:79): avc: denied { read } for pid=3040 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 27.494756][ T3300] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 28.548334][ T3374] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 28.986898][ T3592] mmap: syz.1.266 (3592) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 29.266751][ T3707] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 29.886554][ T3001] ================================================================== [ 29.894670][ T3001] BUG: KCSAN: data-race in d_make_discardable / step_into_slowpath [ 29.902655][ T3001] [ 29.904971][ T3001] write to 0xffff88810a4b2540 of 4 bytes by task 3304 on cpu 1: [ 29.912684][ T3001] d_make_discardable+0x4f/0xa0 [ 29.917636][ T3001] simple_unlink+0x68/0x80 [ 29.922068][ T3001] shmem_unlink+0x12d/0x140 [ 29.926595][ T3001] vfs_unlink+0x1c7/0x490 [ 29.930928][ T3001] filename_unlinkat+0x1e2/0x410 [ 29.935946][ T3001] __se_sys_unlink+0x2b/0xe0 [ 29.940710][ T3001] __x64_sys_unlink+0x1f/0x30 [ 29.945562][ T3001] x64_sys_call+0x2eb6/0x3020 [ 29.950511][ T3001] do_syscall_64+0x12c/0x370 [ 29.955096][ T3001] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 29.961093][ T3001] [ 29.963402][ T3001] read to 0xffff88810a4b2540 of 4 bytes by task 3001 on cpu 0: [ 29.971189][ T3001] step_into_slowpath+0x139/0x4c0 [ 29.976204][ T3001] path_lookupat+0x330/0x500 [ 29.980781][ T3001] filename_lookup+0x190/0x390 [ 29.985534][ T3001] do_readlinkat+0x74/0x2f0 [ 29.990025][ T3001] __x64_sys_readlink+0x47/0x60 [ 29.994875][ T3001] x64_sys_call+0x2b51/0x3020 [ 29.999572][ T3001] do_syscall_64+0x12c/0x370 [ 30.004160][ T3001] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 30.010038][ T3001] [ 30.012430][ T3001] value changed: 0x08300080 -> 0x00004080 [ 30.018126][ T3001] [ 30.020429][ T3001] Reported by Kernel Concurrency Sanitizer on: [ 30.026604][ T3001] CPU: 0 UID: 0 PID: 3001 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 30.035442][ T3001] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 30.045578][ T3001] ==================================================================