last executing test programs: 811.730415ms ago: executing program 3 (id=152): openat(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20ncci', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20ncci', 0x800, 0x0) 795.253425ms ago: executing program 3 (id=157): clock_getres(0x0, &(0x7f0000000000)) 779.928296ms ago: executing program 3 (id=161): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/netlabel', 0x2, 0x0) 779.603036ms ago: executing program 3 (id=165): set_mempolicy(0x0, &(0x7f0000000000), 0x0) 763.293646ms ago: executing program 3 (id=169): clock_adjtime(0x0, &(0x7f0000000000)) 762.948766ms ago: executing program 3 (id=174): pause() 543.781133ms ago: executing program 4 (id=265): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0', 0x2, 0x0) 543.506263ms ago: executing program 4 (id=268): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ndctl0', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ndctl0', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ndctl0', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ndctl0', 0x800, 0x0) 530.645204ms ago: executing program 4 (id=272): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/audio', 0x800, 0x0) 513.893525ms ago: executing program 4 (id=277): flock(0xffffffffffffffff, 0x0) 513.605594ms ago: executing program 4 (id=281): syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x800) 494.580175ms ago: executing program 4 (id=285): rt_sigreturn() 198.634974ms ago: executing program 2 (id=370): io_uring_setup(0x0, &(0x7f0000000000)) 197.875704ms ago: executing program 2 (id=374): select(0x0, &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000), &(0x7f0000000000)) 197.361295ms ago: executing program 2 (id=376): munmap(0x0, 0x0) 167.340705ms ago: executing program 2 (id=378): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/damon/rm_contexts', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/debug/damon/rm_contexts', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/debug/damon/rm_contexts', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/debug/damon/rm_contexts', 0x800, 0x0) 166.942965ms ago: executing program 2 (id=380): syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$evdev(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$evdev(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$evdev(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$evdev(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$evdev(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$evdev(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$evdev(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$evdev(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$evdev(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$evdev(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$evdev(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$evdev(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$evdev(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$evdev(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$evdev(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$evdev(&(0x7f0000000500), 0x4, 0x800) 144.918596ms ago: executing program 2 (id=388): sync() 41.039229ms ago: executing program 1 (id=403): sigaltstack(&(0x7f0000000000), 0x0) 40.681669ms ago: executing program 1 (id=405): pidfd_send_signal(0xffffffffffffffff, 0x0, &(0x7f0000000000), 0x0) 40.199709ms ago: executing program 1 (id=407): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/context', 0x2, 0x0) 39.854319ms ago: executing program 0 (id=408): fstat(0xffffffffffffffff, &(0x7f0000000000)) 537.8µs ago: executing program 1 (id=409): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/bluetooth/6lowpan_enable', 0x2, 0x0) 427.31µs ago: executing program 0 (id=410): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/validatetrans', 0x1, 0x0) 305.55µs ago: executing program 1 (id=411): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/failed_transaction_log', 0x0, 0x0) 268.18µs ago: executing program 0 (id=412): stat(&(0x7f0000000000), &(0x7f0000000000)) 196.33µs ago: executing program 1 (id=413): socket$caif_stream(0x25, 0x1, 0x0) 160.23µs ago: executing program 0 (id=414): setpriority(0x0, 0x0, 0x0) 48.98µs ago: executing program 0 (id=415): getdents64(0xffffffffffffffff, &(0x7f0000000000), 0x0) 0s ago: executing program 0 (id=416): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/btrfs-control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control', 0x800, 0x0) kernel console output (not intermixed with test programs): [ 19.064550][ T28] audit: type=1400 audit(1779293664.484:103): avc: denied { search } for pid=3176 comm="dhcpcd-run-hook" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 19.086605][ T28] audit: type=1400 audit(1779293664.484:104): avc: denied { search } for pid=3176 comm="dhcpcd-run-hook" name="dhcpcd" dev="tmpfs" ino=482 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.054043][ T28] kauditd_printk_skb: 9 callbacks suppressed [ 20.054060][ T28] audit: type=1400 audit(1779293665.474:114): avc: denied { write } for pid=3191 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.083044][ T28] audit: type=1400 audit(1779293665.494:115): avc: denied { write } for pid=3202 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.119540][ T28] audit: type=1400 audit(1779293665.544:116): avc: denied { write } for pid=3205 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.151582][ T28] audit: type=1400 audit(1779293665.574:117): avc: denied { write } for pid=3216 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.289112][ T28] audit: type=1400 audit(1779293665.714:118): avc: denied { write } for pid=3219 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.312038][ T28] audit: type=1400 audit(1779293665.724:119): avc: denied { write } for pid=3230 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.420395][ T28] audit: type=1400 audit(1779293665.844:120): avc: denied { write } for pid=3233 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.443395][ T28] audit: type=1400 audit(1779293665.854:121): avc: denied { write } for pid=3244 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.485952][ T28] audit: type=1400 audit(1779293665.904:122): avc: denied { write } for pid=3247 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.508875][ T28] audit: type=1400 audit(1779293665.924:123): avc: denied { write } for pid=3258 comm="rm" name="hook-state" dev="tmpfs" ino=486 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 Warning: Permanently added '10.128.0.35' (ED25519) to the list of known hosts. [ 24.932559][ T3283] cgroup: Unknown subsys name 'net' [ 25.058358][ T3283] cgroup: Unknown subsys name 'cpuset' [ 25.064406][ T3283] cgroup: Unknown subsys name 'rlimit' [ 25.176166][ T28] kauditd_printk_skb: 5 callbacks suppressed [ 25.176182][ T28] audit: type=1400 audit(1779293670.594:129): avc: denied { setattr } for pid=3283 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 25.215086][ T28] audit: type=1400 audit(1779293670.594:130): avc: denied { create } for pid=3283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.235703][ T28] audit: type=1400 audit(1779293670.594:131): avc: denied { write } for pid=3283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.242840][ T3285] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 25.256280][ T28] audit: type=1400 audit(1779293670.594:132): avc: denied { read } for pid=3283 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 25.285074][ T28] audit: type=1400 audit(1779293670.604:133): avc: denied { read } for pid=3019 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 25.306058][ T28] audit: type=1400 audit(1779293670.604:134): avc: denied { mounton } for pid=3283 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 25.330954][ T28] audit: type=1400 audit(1779293670.604:135): avc: denied { mount } for pid=3283 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 25.354472][ T28] audit: type=1400 audit(1779293670.694:136): avc: denied { relabelto } for pid=3285 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.380548][ T28] audit: type=1400 audit(1779293670.694:137): avc: denied { write } for pid=3285 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 25.382066][ T3283] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 25.406644][ T28] audit: type=1400 audit(1779293670.804:138): avc: denied { read } for pid=3283 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.778642][ T3529] mmap: syz.1.218 (3529) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 27.480161][ T3278] ================================================================== [ 27.488270][ T3278] BUG: KCSAN: data-race in fill_mg_cmtime / shmem_mknod [ 27.495224][ T3278] [ 27.497548][ T3278] write to 0xffff8881046223dc of 4 bytes by task 3287 on cpu 0: [ 27.505189][ T3278] shmem_mknod+0x143/0x170 [ 27.509617][ T3278] shmem_create+0x34/0x50 [ 27.513966][ T3278] path_openat+0xd75/0x2050 [ 27.518484][ T3278] do_file_open+0x16c/0x290 [ 27.522991][ T3278] do_sys_openat2+0x94/0x130 [ 27.527595][ T3278] __x64_sys_openat+0xf2/0x120 [ 27.532367][ T3278] x64_sys_call+0x1e39/0x3020 [ 27.537050][ T3278] do_syscall_64+0x12c/0x3b0 [ 27.541656][ T3278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.547556][ T3278] [ 27.549872][ T3278] read to 0xffff8881046223dc of 4 bytes by task 3278 on cpu 1: [ 27.557404][ T3278] fill_mg_cmtime+0x5b/0x240 [ 27.561996][ T3278] generic_fillattr+0x24a/0x340 [ 27.566899][ T3278] shmem_getattr+0x181/0x200 [ 27.571502][ T3278] vfs_getattr_nosec+0x146/0x1e0 [ 27.576454][ T3278] vfs_getattr+0x48/0x60 [ 27.580698][ T3278] vfs_statx_path+0x28/0x140 [ 27.585296][ T3278] vfs_statx+0xc4/0x170 [ 27.589459][ T3278] vfs_fstatat+0x118/0x170 [ 27.593878][ T3278] __se_sys_newfstatat+0x55/0x3e0 [ 27.598916][ T3278] __x64_sys_newfstatat+0x55/0x70 [ 27.603956][ T3278] x64_sys_call+0x2c64/0x3020 [ 27.608646][ T3278] do_syscall_64+0x12c/0x3b0 [ 27.613249][ T3278] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 27.619149][ T3278] [ 27.621471][ T3278] value changed: 0x366c699f -> 0x3674b0f2 [ 27.627196][ T3278] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 27.629512][ T3278] Reported by Kernel Concurrency Sanitizer on: [ 27.635682][ T3278] CPU: 1 UID: 0 PID: 3278 Comm: udevd Not tainted syzkaller #0 PREEMPT(full) [ 27.644533][ T3278] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 [ 27.654590][ T3278] ==================================================================