syzbot

SELinux:  policydb magic number 0x10 does not match expected magic number 0xf97cff8c
SELinux: failed to load policy
==================================================================
BUG: KCSAN: data-race in sg_fill_request_table / sg_rq_end_io

write to 0xffff888109748111 of 1 bytes by interrupt on cpu 1:
 sg_rq_end_io+0x1a2/0x740 drivers/scsi/sg.c:1349
 __blk_mq_end_request+0x260/0x350 block/blk-mq.c:1139
 scsi_end_request+0x29c/0x4c0 drivers/scsi/scsi_lib.c:670
 scsi_io_completion+0x7f/0x200 drivers/scsi/scsi_lib.c:1078
 scsi_finish_command+0x1c7/0x1e0 drivers/scsi/scsi.c:198
 scsi_complete+0xc3/0x1e0 drivers/scsi/scsi_lib.c:1547
 blk_complete_reqs block/blk-mq.c:1224 [inline]
 blk_done_softirq+0x74/0xb0 block/blk-mq.c:1229
 handle_softirqs+0xb7/0x290 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:680
 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:285
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
 kcsan_setup_watchpoint+0x415/0x430 kernel/kcsan/core.c:705
 __tlb_remove_folio_pages_size mm/mmu_gather.c:-1 [inline]
 __tlb_remove_folio_pages+0x7b/0x220 mm/mmu_gather.c:208
 zap_present_folio_ptes mm/memory.c:1534 [inline]
 zap_present_ptes mm/memory.c:1590 [inline]
 do_zap_pte_range mm/memory.c:1691 [inline]
 zap_pte_range mm/memory.c:1735 [inline]
 zap_pmd_range mm/memory.c:1827 [inline]
 zap_pud_range mm/memory.c:1856 [inline]
 zap_p4d_range mm/memory.c:1877 [inline]
 unmap_page_range+0x158a/0x2740 mm/memory.c:1898
 unmap_single_vma mm/memory.c:1941 [inline]
 unmap_vmas+0x23d/0x3a0 mm/memory.c:1985
 exit_mmap+0x1b0/0x6c0 mm/mmap.c:1284
 __mmput+0x28/0x1c0 kernel/fork.c:1121
 mmput+0x40/0x50 kernel/fork.c:1144
 exit_mm+0xe4/0x190 kernel/exit.c:581
 do_exit+0x40b/0x1590 kernel/exit.c:943
 do_group_exit+0xff/0x140 kernel/exit.c:1104
 get_signal+0xe59/0xf70 kernel/signal.c:3034
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x7a/0x100 kernel/entry/common.c:111
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x1d6/0x200 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888109748111 of 1 bytes by task 30184 on cpu 0:
 sg_fill_request_table+0x65/0x1e0 drivers/scsi/sg.c:865
 sg_ioctl_common drivers/scsi/sg.c:1082 [inline]
 sg_ioctl+0x6b1/0x1360 drivers/scsi/sg.c:1156
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:893
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:893
 x64_sys_call+0x19a8/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 30184 Comm: syz.4.19304 Tainted: G        W           6.15.0-syzkaller-13659-g5b032cac6225 #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================
netlink: 'syz.4.19304': attribute type 10 has an invalid length.
netlink: 40 bytes leftover after parsing attributes in process `syz.4.19304'.