syzbot


KCSAN: data-race in __follow_mount_rcu / d_set_mounted

Status: moderation: reported on 2025/12/03 12:52
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+ef7e2e63add8cfdc684f@syzkaller.appspotmail.com
First crash: 41d, last: 9d09h

Sample crash report:
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / d_set_mounted

read to 0xffff888100467540 of 4 bytes by task 3318 on cpu 1:
 __follow_mount_rcu+0x19a/0x2f0 fs/namei.c:1651
 handle_mounts fs/namei.c:1677 [inline]
 step_into_slowpath+0x2f3/0x480 fs/namei.c:2043
 step_into fs/namei.c:2091 [inline]
 walk_component fs/namei.c:2227 [inline]
 link_path_walk+0x974/0xe30 fs/namei.c:2589
 path_parentat fs/namei.c:2793 [inline]
 __filename_parentat+0x15c/0x3f0 fs/namei.c:2817
 filename_parentat fs/namei.c:2835 [inline]
 do_unlinkat+0x94/0x4b0 fs/namei.c:5408
 __do_sys_unlink fs/namei.c:5474 [inline]
 __se_sys_unlink fs/namei.c:5472 [inline]
 __x64_sys_unlink+0x2e/0x40 fs/namei.c:5472
 x64_sys_call+0x2f48/0x3000 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888100467540 of 4 bytes by task 4719 on cpu 0:
 d_set_mounted+0xff/0x160 fs/dcache.c:1477
 get_mountpoint+0x197/0x370 fs/namespace.c:903
 attach_recursive_mnt+0x11a/0x14c0 fs/namespace.c:2579
 graft_tree+0xf0/0x100 fs/namespace.c:2816
 do_loopback+0x21e/0x2a0 fs/namespace.c:2998
 path_mount+0x3e2/0xb80 fs/namespace.c:4016
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4719 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/04 15:01 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/15 01:46 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/03 12:51 upstream d61f1cc5db79 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
* Struck through repros no longer work on HEAD.