last executing test programs: 534.845367ms ago: executing program 2 (id=139): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vcsu', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vcsu', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vcsu', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcsu', 0x800, 0x0) 519.801077ms ago: executing program 2 (id=143): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm', 0x800, 0x0) 519.581237ms ago: executing program 3 (id=144): mincore(0x0, 0x0, &(0x7f0000000000)) 504.013007ms ago: executing program 2 (id=149): socket$phonet(0x23, 0x2, 0x1) 503.389927ms ago: executing program 3 (id=151): socket$nl_netfilter(0x10, 0x3, 0xc) 503.126597ms ago: executing program 1 (id=152): rt_sigsuspend(&(0x7f0000000000), 0x0) 502.937837ms ago: executing program 0 (id=153): rt_sigqueueinfo(0x0, 0x0, &(0x7f0000000000)) 502.531397ms ago: executing program 2 (id=155): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/input/mice', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/input/mice', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/input/mice', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/input/mice', 0x800, 0x0) 502.453837ms ago: executing program 3 (id=156): io_getevents(0x0, 0x0, 0x0, &(0x7f0000000000), 0x0) 490.486758ms ago: executing program 1 (id=157): nanosleep(&(0x7f0000000000), 0x0) 490.382718ms ago: executing program 0 (id=158): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ttyprintk', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ttyprintk', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ttyprintk', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ttyprintk', 0x800, 0x0) 490.283248ms ago: executing program 3 (id=159): socket$hf(0x13, 0x2, 0x0) 490.168828ms ago: executing program 2 (id=160): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom', 0x800, 0x0) 489.892768ms ago: executing program 1 (id=162): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/adsp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/adsp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/adsp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/adsp1', 0x800, 0x0) 489.624598ms ago: executing program 0 (id=163): clock_gettime(0x0, &(0x7f0000000000)) 449.460269ms ago: executing program 1 (id=164): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full', 0x800, 0x0) 448.980399ms ago: executing program 0 (id=167): kexec_load(0x0, 0x0, &(0x7f0000000000), 0x0) 448.888269ms ago: executing program 1 (id=168): remap_file_pages(0x0, 0x0, 0x0, 0x0, 0x0) 448.410539ms ago: executing program 0 (id=170): inotify_rm_watch(0xffffffffffffffff, 0x0) 425.864219ms ago: executing program 0 (id=172): syz_open_dev$dmmidi(&(0x7f0000000040), 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000080), 0x0, 0x1) syz_open_dev$dmmidi(&(0x7f00000000c0), 0x0, 0x2) syz_open_dev$dmmidi(&(0x7f0000000100), 0x0, 0x800) syz_open_dev$dmmidi(&(0x7f0000000140), 0x1, 0x0) syz_open_dev$dmmidi(&(0x7f0000000180), 0x1, 0x1) syz_open_dev$dmmidi(&(0x7f00000001c0), 0x1, 0x2) syz_open_dev$dmmidi(&(0x7f0000000200), 0x1, 0x800) syz_open_dev$dmmidi(&(0x7f0000000240), 0x2, 0x0) syz_open_dev$dmmidi(&(0x7f0000000280), 0x2, 0x1) syz_open_dev$dmmidi(&(0x7f00000002c0), 0x2, 0x2) syz_open_dev$dmmidi(&(0x7f0000000300), 0x2, 0x800) syz_open_dev$dmmidi(&(0x7f0000000340), 0x3, 0x0) syz_open_dev$dmmidi(&(0x7f0000000380), 0x3, 0x1) syz_open_dev$dmmidi(&(0x7f00000003c0), 0x3, 0x2) syz_open_dev$dmmidi(&(0x7f0000000400), 0x3, 0x800) syz_open_dev$dmmidi(&(0x7f0000000440), 0x4, 0x0) syz_open_dev$dmmidi(&(0x7f0000000480), 0x4, 0x1) syz_open_dev$dmmidi(&(0x7f00000004c0), 0x4, 0x2) syz_open_dev$dmmidi(&(0x7f0000000500), 0x4, 0x800) 425.52409ms ago: executing program 3 (id=173): openat(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/relabel-self', 0x2, 0x0) 425.053959ms ago: executing program 3 (id=176): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status', 0x0, 0x0) 242.111354ms ago: executing program 4 (id=198): openat(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls', 0x0, 0x0) 242.034794ms ago: executing program 4 (id=199): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm_plock', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock', 0x800, 0x0) 241.878174ms ago: executing program 4 (id=200): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/loop-control', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/loop-control', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control', 0x800, 0x0) 241.799384ms ago: executing program 4 (id=201): futimesat(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000000)) 231.627844ms ago: executing program 4 (id=202): fstatfs(0xffffffffffffffff, &(0x7f0000000000)) 208.202065ms ago: executing program 4 (id=203): openat(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp1', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dsp1', 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dsp1', 0x2, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp1', 0x800, 0x0) 158.849256ms ago: executing program 2 (id=165): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=180): mmap(&(0x7efffffff000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x1000000)=nil, 0x1000000, 0x7, 0x32, 0xffffffffffffffff, 0x0) mmap(&(0x7f0001000000/0x1000)=nil, 0x1000, 0x0, 0x32, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): [ 20.092997][ T28] audit: type=1400 audit(1786757122.939:101): avc: denied { write } for pid=3192 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.300823][ T28] audit: type=1400 audit(1786757123.149:102): avc: denied { write } for pid=3195 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 20.323945][ T28] audit: type=1400 audit(1786757123.169:103): avc: denied { write } for pid=3206 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 21.084919][ T28] audit: type=1400 audit(1786757123.939:104): avc: denied { write } for pid=3210 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 21.660285][ T28] kauditd_printk_skb: 17 callbacks suppressed [ 21.660303][ T28] audit: type=1400 audit(1786757124.509:122): avc: denied { write } for pid=3250 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 21.690359][ T28] audit: type=1400 audit(1786757124.529:123): avc: denied { write } for pid=3261 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 22.076645][ T28] audit: type=1400 audit(1786757124.929:124): avc: denied { write } for pid=3265 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 22.109478][ T28] audit: type=1400 audit(1786757124.949:125): avc: denied { write } for pid=3276 comm="rm" name="hook-state" dev="tmpfs" ino=487 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 22.327059][ T3249] scp (3249) used greatest stack depth: 11224 bytes left Warning: Permanently added '10.128.1.131' (ED25519) to the list of known hosts. [ 29.708507][ T28] audit: type=1400 audit(1786757132.559:126): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 29.731719][ T28] audit: type=1400 audit(1786757132.579:127): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.732452][ T3286] cgroup: Unknown subsys name 'net' [ 29.760082][ T28] audit: type=1400 audit(1786757132.609:128): avc: denied { unmount } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 29.873832][ T3286] cgroup: Unknown subsys name 'cpuset' [ 29.880153][ T3286] cgroup: Unknown subsys name 'rlimit' [ 30.001455][ T28] audit: type=1400 audit(1786757132.849:129): avc: denied { setattr } for pid=3286 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=142 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 30.025316][ T28] audit: type=1400 audit(1786757132.849:130): avc: denied { create } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 Setting up swapspace version 1, size = 127995904 bytes [ 30.040270][ T3289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 30.048205][ T28] audit: type=1400 audit(1786757132.849:131): avc: denied { write } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.075579][ T28] audit: type=1400 audit(1786757132.849:132): avc: denied { read } for pid=3286 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 30.096341][ T28] audit: type=1400 audit(1786757132.849:133): avc: denied { mounton } for pid=3286 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 30.122080][ T28] audit: type=1400 audit(1786757132.849:134): avc: denied { mount } for pid=3286 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 30.133509][ T3286] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 30.145862][ T28] audit: type=1400 audit(1786757132.909:135): avc: denied { read } for pid=3022 comm="dhcpcd" scontext=system_u:system_r:dhcpc_t tcontext=system_u:system_r:dhcpc_t tclass=netlink_kobject_uevent_socket permissive=1 [ 31.468324][ T3479] mmap: syz.1.168 (3479) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 31.709156][ T3480] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 32.001993][ T3290] ================================================================== [ 32.010140][ T3290] BUG: KCSAN: data-race in fill_mg_cmtime / simple_unlink [ 32.017302][ T3290] [ 32.019644][ T3290] write to 0xffff888103e02704 of 4 bytes by task 3530 on cpu 0: [ 32.027290][ T3290] simple_unlink+0x54/0x80 [ 32.031805][ T3290] shmem_unlink+0x12d/0x140 [ 32.036327][ T3290] shmem_rename2+0x185/0x310 [ 32.040953][ T3290] vfs_rename+0x963/0xac0 [ 32.045283][ T3290] filename_renameat2+0x3a4/0x6a0 [ 32.050332][ T3290] __se_sys_rename+0x4a/0x1c0 [ 32.055014][ T3290] __x64_sys_rename+0x31/0x40 [ 32.059685][ T3290] x64_sys_call+0x2b3/0x3020 [ 32.064270][ T3290] do_syscall_64+0x136/0x3c0 [ 32.068956][ T3290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.074885][ T3290] [ 32.077230][ T3290] read to 0xffff888103e02704 of 4 bytes by task 3290 on cpu 1: [ 32.084947][ T3290] fill_mg_cmtime+0x5b/0x240 [ 32.089758][ T3290] generic_fillattr+0x24d/0x340 [ 32.094816][ T3290] shmem_getattr+0x181/0x200 [ 32.099768][ T3290] vfs_getattr_nosec+0x146/0x1e0 [ 32.105075][ T3290] vfs_getattr+0x48/0x60 [ 32.109508][ T3290] vfs_statx_path+0x28/0x140 [ 32.114792][ T3290] vfs_statx+0xc4/0x170 [ 32.119148][ T3290] vfs_fstatat+0x118/0x170 [ 32.123784][ T3290] __se_sys_newfstatat+0x55/0x3e0 [ 32.128930][ T3290] __x64_sys_newfstatat+0x55/0x70 [ 32.133966][ T3290] x64_sys_call+0x2c64/0x3020 [ 32.138682][ T3290] do_syscall_64+0x136/0x3c0 [ 32.143577][ T3290] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 32.149477][ T3290] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 32.151809][ T3290] value changed: 0x335f07f2 -> 0x337af82c [ 32.157535][ T3290] [ 32.159941][ T3290] Reported by Kernel Concurrency Sanitizer on: [ 32.166538][ T3290] CPU: 1 UID: 0 PID: 3290 Comm: udevd Not tainted syzkaller #0 PREEMPT(lazy) [ 32.175568][ T3290] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 32.185804][ T3290] ==================================================================