KCSAN: data-race in __follow_mount_rcu / do_new_mount (2)

Status: moderation: reported on 2026/09/28 18:31
Subsystems: fs
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+b50faea713ddad0f135e@syzkaller.appspotmail.com
First crash: 18d, last: 7d18h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
b3660103 repro-c Reproduced: ✅ ❓ KCSAN: data-race in __follow_mount_rcu / do_new_mount (2) 2026/10/13 03:52 2026/10/13 03:52 2026/10/13 04:05 745a967f
8a970a49 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __follow_mount_rcu / do_new_mount (2) 2026/09/30 04:50 2026/09/30 04:50 2026/09/30 04:56 69537153
f941989e assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __follow_mount_rcu / do_new_mount (2) 2026/09/28 18:40 2026/09/28 18:40 2026/09/28 19:13 58f15308
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __follow_mount_rcu / do_new_mount fs prio:low 6 1 196d 196d 0/29 auto-obsoleted due to no activity on 2026/05/29 23:38
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/13 04:41 24m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 no crash job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / do_new_mount

read to 0xffff8881004066c0 of 4 bytes by task 10843 on cpu 1:
 __follow_mount_rcu+0x156/0x2a0 fs/namei.c:1714
 handle_mounts fs/namei.c:1740 [inline]
 step_into_slowpath+0x30c/0x4c0 fs/namei.c:2104
 step_into fs/namei.c:2152 [inline]
 walk_component fs/namei.c:2288 [inline]
 link_path_walk+0x947/0xdd0 fs/namei.c:-1
 path_openat+0xe7/0x10d0 fs/namei.c:4996
 do_file_open+0x16c/0x290 fs/namei.c:5029
 do_sys_openat2+0xa0/0x130 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1434
 x64_sys_call+0x1f72/0x2550 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read-write to 0xffff8881004066c0 of 4 bytes by task 10842 on cpu 0:
 maybe_free_mountpoint fs/namespace.c:928 [inline]
 unpin_mountpoint fs/namespace.c:943 [inline]
 __unlock_mount fs/namespace.c:2810 [inline]
 unlock_mount fs/namespace.c:2818 [inline]
 do_new_mount_fc fs/namespace.c:3795 [inline]
 do_new_mount+0x6a3/0x8d0 fs/namespace.c:3848
 path_mount+0x4ad/0xb90 fs/namespace.c:4168
 do_mount fs/namespace.c:4181 [inline]
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4374
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4374
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10842 Comm: syz.6.1855 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/09 20:09 upstream af32da41b032 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / do_new_mount
2026/09/28 18:30 upstream 72d3fcf802c4 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / do_new_mount
* Struck through repros no longer work on HEAD.