last executing test programs: 2.032875363s ago: executing program 1 (id=246): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/fuse', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse', 0x800, 0x0) 2.022204663s ago: executing program 1 (id=251): munmap(0x0, 0x0) 2.005279304s ago: executing program 1 (id=256): syz_init_net_socket$llc(0x1a, 0x1, 0x0) 2.004729064s ago: executing program 1 (id=260): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dri/renderD128', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dri/renderD128', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dri/renderD128', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dri/renderD128', 0x800, 0x0) 1.992490065s ago: executing program 1 (id=265): rt_sigreturn() 1.517163378s ago: executing program 2 (id=429): syz_open_dev$tee(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$tee(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$tee(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$tee(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$tee(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$tee(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$tee(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$tee(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$tee(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$tee(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$tee(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$tee(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$tee(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$tee(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$tee(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$tee(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$tee(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$tee(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$tee(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$tee(&(0x7f0000000500), 0x4, 0x800) 1.516710978s ago: executing program 2 (id=433): getegid() 1.500663118s ago: executing program 2 (id=438): syncfs(0xffffffffffffffff) 1.482521799s ago: executing program 2 (id=442): mremap(0x0, 0x0, 0x0, 0x0, 0x0) 1.482190799s ago: executing program 2 (id=446): socket$pppoe(0x18, 0x1, 0x0) 1.46715008s ago: executing program 2 (id=449): pause() 878.916358ms ago: executing program 0 (id=602): semtimedop(0x0, &(0x7f0000000000), 0x0, &(0x7f0000000000)) 878.216668ms ago: executing program 0 (id=606): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer', 0x800, 0x0) 877.505258ms ago: executing program 0 (id=610): capset(&(0x7f0000000000), &(0x7f0000000000)) 850.959249ms ago: executing program 0 (id=613): mlock(0x0, 0x0) 850.610439ms ago: executing program 0 (id=616): epoll_create1(0x0) 814.238721ms ago: executing program 3 (id=620): fgetxattr(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000), 0x0) 814.129261ms ago: executing program 3 (id=621): mbind(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0, 0x0) 813.863571ms ago: executing program 3 (id=623): syz_open_dev$vcsa(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$vcsa(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$vcsa(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$vcsa(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$vcsa(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$vcsa(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$vcsa(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$vcsa(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$vcsa(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$vcsa(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$vcsa(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$vcsa(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$vcsa(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$vcsa(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$vcsa(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$vcsa(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$vcsa(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$vcsa(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$vcsa(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$vcsa(&(0x7f0000000500), 0x4, 0x800) 813.695911ms ago: executing program 4 (id=624): syslog(0x0, 0x0, 0x0) 813.593931ms ago: executing program 3 (id=625): pkey_free(0xffffffffffffffff) 765.530833ms ago: executing program 4 (id=626): clone3(&(0x7f0000000000), 0x0) exit(0x0) 765.337203ms ago: executing program 4 (id=628): listns(&(0x7f0000000000), &(0x7f0000000000), 0x0, 0x0) 765.289393ms ago: executing program 4 (id=629): truncate(&(0x7f0000000000), 0x0) 765.225153ms ago: executing program 4 (id=630): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/userfaultfd', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/userfaultfd', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/userfaultfd', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/userfaultfd', 0x800, 0x0) 549.227633ms ago: executing program 1 (id=632): socket$vsock_stream(0x28, 0x1, 0x0) 476.536217ms ago: executing program 3 (id=627): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 405.56323ms ago: executing program 0 (id=617): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 215.588019ms ago: executing program 3 (id=633): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 4 (id=634): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): [ 18.279142][ T29] audit: type=1400 audit(1789271064.341:103): avc: denied { search } for pid=3182 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 18.279176][ T29] audit: type=1400 audit(1789271064.341:104): avc: denied { search } for pid=3182 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.200065][ T29] kauditd_printk_skb: 9 callbacks suppressed [ 19.200080][ T29] audit: type=1400 audit(1789271065.261:114): avc: denied { write } for pid=3197 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.215394][ T29] audit: type=1400 audit(1789271065.271:115): avc: denied { write } for pid=3208 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.282396][ T29] audit: type=1400 audit(1789271065.341:116): avc: denied { write } for pid=3211 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.293304][ T29] audit: type=1400 audit(1789271065.351:117): avc: denied { write } for pid=3222 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.504812][ T29] audit: type=1400 audit(1789271065.561:118): avc: denied { write } for pid=3226 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.535405][ T29] audit: type=1400 audit(1789271065.591:119): avc: denied { write } for pid=3237 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.602964][ T29] audit: type=1400 audit(1789271065.661:120): avc: denied { write } for pid=3240 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.614481][ T29] audit: type=1400 audit(1789271065.671:121): avc: denied { write } for pid=3251 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.928050][ T29] audit: type=1400 audit(1789271065.981:122): avc: denied { write } for pid=3254 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.951435][ T29] audit: type=1400 audit(1789271066.001:123): avc: denied { write } for pid=3265 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.1.144' (ED25519) to the list of known hosts. [ 24.357825][ T29] kauditd_printk_skb: 2 callbacks suppressed [ 24.357840][ T29] audit: type=1400 audit(1789271070.411:126): avc: denied { mounton } for pid=3289 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 24.358057][ T29] audit: type=1400 audit(1789271070.411:127): avc: denied { mount } for pid=3289 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.358594][ T3289] cgroup: Unknown subsys name 'net' [ 24.364602][ T29] audit: type=1400 audit(1789271070.421:128): avc: denied { unmount } for pid=3289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 24.509046][ T3289] cgroup: Unknown subsys name 'cpuset' [ 24.509630][ T3289] cgroup: Unknown subsys name 'rlimit' [ 24.615871][ T29] audit: type=1400 audit(1789271070.671:129): avc: denied { setattr } for pid=3289 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 24.616783][ T29] audit: type=1400 audit(1789271070.671:130): avc: denied { create } for pid=3289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.616888][ T29] audit: type=1400 audit(1789271070.671:131): avc: denied { write } for pid=3289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 24.617049][ T29] audit: type=1400 audit(1789271070.671:132): avc: denied { read } for pid=3289 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 24.627329][ T29] audit: type=1400 audit(1789271070.681:133): avc: denied { mounton } for pid=3289 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 24.630242][ T29] audit: type=1400 audit(1789271070.681:134): avc: denied { mount } for pid=3289 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 24.642065][ T29] audit: type=1400 audit(1789271070.701:135): avc: denied { read } for pid=3025 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 24.734631][ T3293] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 24.749322][ T3289] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.909185][ T3452] mmap: syz.4.135 (3452) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 27.587462][ T3690] syz.4.363 (3690) used greatest stack depth: 11104 bytes left [ 27.642527][ T3584] syz.1.265 (3584) used greatest stack depth: 10976 bytes left [ 27.685477][ T3968] soft_limit_in_bytes is deprecated and will be removed. Writing any value to this file has no effect. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.148880][ T2986] ================================================================== [ 28.148911][ T2986] BUG: KCSAN: data-race in dentry_unlink_inode / step_into_slowpath [ 28.148951][ T2986] [ 28.148957][ T2986] write to 0xffff888107ac43f0 of 8 bytes by task 3985 on cpu 1: [ 28.148973][ T2986] dentry_unlink_inode+0x65/0x260 [ 28.148998][ T2986] d_delete+0x164/0x180 [ 28.149022][ T2986] d_delete_notify+0x32/0x100 [ 28.149055][ T2986] vfs_unlink+0x287/0x490 [ 28.149086][ T2986] filename_unlinkat+0x1dc/0x410 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 28.149120][ T2986] __se_sys_unlink+0x2b/0xe0 [ 28.149152][ T2986] __x64_sys_unlink+0x1f/0x30 [ 28.149180][ T2986] x64_sys_call+0x18ee/0x2550 [ 28.149203][ T2986] do_syscall_64+0x112/0x360 [ 28.149231][ T2986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 28.149255][ T2986] [ 28.149261][ T2986] read to 0xffff888107ac43f0 of 8 bytes by task 2986 on cpu 0: [ 28.149280][ T2986] step_into_slowpath+0x12c/0x4c0 [ 28.149304][ T2986] path_lookupat+0x2eb/0x4c0 [ 28.149331][ T2986] filename_lookup+0x18f/0x390 [ 28.149349][ T2986] do_readlinkat+0x74/0x2f0 [ 28.149370][ T2986] __x64_sys_readlink+0x47/0x60 [ 28.149393][ T2986] x64_sys_call+0x1d41/0x2550 [ 28.149416][ T2986] do_syscall_64+0x112/0x360 [ 28.149442][ T2986] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 28.149461][ T2986] [ 28.149465][ T2986] value changed: 0xffff88810b790b60 -> 0x0000000000000000 [ 28.149476][ T2986] [ 28.149480][ T2986] Reported by Kernel Concurrency Sanitizer on: [ 28.149498][ T2986] CPU: 0 UID: 0 PID: 2986 Comm: udevd Not tainted syzkaller #0 PREEMPT(lazy) [ 28.149525][ T2986] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 28.149539][ T2986] ==================================================================