syzbot


KCSAN: data-race in __dentry_kill / d_alloc_parallel (5)

Status: moderation: reported on 2025/07/04 10:09
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+2aec59abff0dc8c53a9b@syzkaller.appspotmail.com
First crash: 10d, last: 10d
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __dentry_kill / d_alloc_parallel fs 6 36 1988d 2091d 0/29 auto-closed as invalid on 2020/04/13 06:40
upstream KCSAN: data-race in __dentry_kill / d_alloc_parallel (2) fs 6 3 1809d 1840d 0/29 auto-closed as invalid on 2020/09/05 03:58
upstream KCSAN: data-race in __dentry_kill / d_alloc_parallel (3) fs 6 1 1772d 1772d 0/29 auto-closed as invalid on 2020/10/11 15:50
upstream KCSAN: data-race in __dentry_kill / d_alloc_parallel (4) fs 6 1 1532d 1532d 0/29 auto-closed as invalid on 2021/06/09 01:27

Sample crash report:
loop3: detected capacity change from 0 to 1024
EXT4-fs: Ignoring removed bh option
EXT4-fs (loop3): can't mount with data=, fs mounted w/o journal
==================================================================
BUG: KCSAN: data-race in __dentry_kill / d_alloc_parallel

read-write to 0xffff888106da1480 of 4 bytes by task 9092 on cpu 1:
 d_alloc_parallel+0xa8e/0xc40 fs/dcache.c:2624
 __lookup_slow+0x8c/0x250 fs/namei.c:1802
 lookup_slow+0x3c/0x60 fs/namei.c:1834
 walk_component+0x1ec/0x220 fs/namei.c:2138
 lookup_last fs/namei.c:2639 [inline]
 path_lookupat+0xfe/0x2a0 fs/namei.c:2663
 filename_lookup+0x147/0x340 fs/namei.c:2692
 do_readlinkat+0x7d/0x320 fs/stat.c:576
 __do_sys_readlink fs/stat.c:613 [inline]
 __se_sys_readlink fs/stat.c:610 [inline]
 __x64_sys_readlink+0x47/0x60 fs/stat.c:610
 x64_sys_call+0x2cf3/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:90
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888106da1480 of 4 bytes by task 9075 on cpu 0:
 dentry_unlist fs/dcache.c:639 [inline]
 __dentry_kill+0x2aa/0x4b0 fs/dcache.c:683
 dput+0x5e/0xd0 fs/dcache.c:911
 handle_mounts fs/namei.c:1640 [inline]
 step_into+0x5b2/0x820 fs/namei.c:1976
 walk_component+0x162/0x220 fs/namei.c:2144
 lookup_last fs/namei.c:2639 [inline]
 path_lookupat+0xfe/0x2a0 fs/namei.c:2663
 filename_lookup+0x147/0x340 fs/namei.c:2692
 user_path_at+0x3e/0x130 fs/namei.c:3136
 __do_sys_chdir fs/open.c:560 [inline]
 __se_sys_chdir+0x45/0x1b0 fs/open.c:554
 __x64_sys_chdir+0x1f/0x30 fs/open.c:554
 x64_sys_call+0x2ad8/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:81
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x01000008

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9075 Comm: syz.3.1571 Tainted: G        W           6.16.0-rc4-syzkaller-00108-g17bbde2e1716 #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/04 10:08 upstream 17bbde2e1716 76ad128c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __dentry_kill / d_alloc_parallel
* Struck through repros no longer work on HEAD.