KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (4)

Status: moderation: reported on 2026/10/13 16:38
Subsystems: net afs
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+18fb13469510ea411d87@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
d31b09ab assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (4) 2026/10/11 00:21 2026/10/11 00:21 2026/10/11 00:44 4f92358f
43adc0e5 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (4) 2026/10/09 16:27 2026/10/09 16:27 2026/10/09 17:46 549ef7e3
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet afs net 6 2 540d 587d 0/29 auto-obsoleted due to no activity on 2025/06/16 08:50
upstream KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (2) afs net 6 2 384d 428d 0/29 auto-obsoleted due to no activity on 2025/11/19 13:25
upstream KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (3) net afs 6 4 244d 279d 0/29 auto-obsoleted due to no activity on 2026/04/08 02:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet

write to 0xffff88811a8cd800 of 8 bytes by task 10214 on cpu 1:
 rxrpc_alloc_txqueue net/rxrpc/sendmsg.c:295 [inline]
 rxrpc_send_data+0x83e/0x14c0 net/rxrpc/sendmsg.c:399
 rxrpc_do_sendmsg+0xd94/0xe40 net/rxrpc/sendmsg.c:772
 rxrpc_sendmsg+0x46c/0x580 net/rxrpc/af_rxrpc.c:601
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x532/0x580 net/socket.c:2713
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2802
 x64_sys_call+0x22ab/0x2550 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811a8cd800 of 8 bytes by task 10216 on cpu 0:
 rxrpc_prepare_data_packet net/rxrpc/output.c:566 [inline]
 rxrpc_send_data_packet+0x452/0x1d80 net/rxrpc/output.c:664
 rxrpc_transmit_fresh_data net/rxrpc/call_event.c:257 [inline]
 rxrpc_transmit_some_data+0x6e5/0x920 net/rxrpc/call_event.c:280
 rxrpc_input_call_event+0x862/0x11c0 net/rxrpc/call_event.c:404
 rxrpc_io_thread+0x1a60/0x1f90 net/rxrpc/io_thread.c:531
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0000000000000000 -> 0xffff88811ae61000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10216 Comm: krxrpcio/0 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/09 16:27 upstream af32da41b032 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet
* Struck through repros no longer work on HEAD.