syzbot

==================================================================
BUG: KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath

write to 0xffffc90002c6f640 of 1 bytes by task 23687 on cpu 0:
 rwsem_try_write_lock kernel/locking/rwsem.c:653 [inline]
 rwsem_down_write_slowpath+0x3c9/0xa90 kernel/locking/rwsem.c:1159
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0xab/0xc0 kernel/locking/rwsem.c:1591
 kernfs_add_one+0x5a/0x280 fs/kernfs/dir.c:796
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1086
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:313
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x441/0x9e0 fs/sysfs/group.c:189
 internal_create_groups fs/sysfs/group.c:229 [inline]
 sysfs_create_groups+0x3f/0xf0 fs/sysfs/group.c:255
 setup_gid_attrs drivers/infiniband/core/sysfs.c:1118 [inline]
 ib_setup_port_attrs+0xe89/0x1400 drivers/infiniband/core/sysfs.c:1394
 add_one_compat_dev+0x297/0x390 drivers/infiniband/core/device.c:977
 rdma_dev_init_net+0x1b9/0x240 drivers/infiniband/core/device.c:1193
 ops_init+0x22a/0x2e0 net/core/net_namespace.c:137
 setup_net+0x9f/0x230 net/core/net_namespace.c:446
 copy_net_ns+0x310/0x450 net/core/net_namespace.c:581
 create_new_namespaces+0x20e/0x440 kernel/nsproxy.c:130
 unshare_nsproxy_namespaces+0xe6/0x120 kernel/nsproxy.c:226
 ksys_unshare+0x3f2/0x6f0 kernel/fork.c:3174
 __do_sys_unshare kernel/fork.c:3245 [inline]
 __se_sys_unshare kernel/fork.c:3243 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3243
 x64_sys_call+0x1cef/0x3020 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffc90002c6f640 of 1 bytes by task 7874 on cpu 1:
 rwsem_down_write_slowpath+0x43d/0xa90 kernel/locking/rwsem.c:1177
 __down_write_common kernel/locking/rwsem.c:1317 [inline]
 __down_write kernel/locking/rwsem.c:1326 [inline]
 down_write+0xab/0xc0 kernel/locking/rwsem.c:1591
 kernfs_add_one+0x5a/0x280 fs/kernfs/dir.c:796
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1086
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:313
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x441/0x9e0 fs/sysfs/group.c:189
 internal_create_groups fs/sysfs/group.c:229 [inline]
 sysfs_create_groups+0x3f/0xf0 fs/sysfs/group.c:255
 netdev_queue_add_kobject net/core/net-sysfs.c:2003 [inline]
 netdev_queue_update_kobjects+0x1dd/0x4c0 net/core/net-sysfs.c:2056
 register_queue_kobjects net/core/net-sysfs.c:2119 [inline]
 netdev_register_kobject+0x1b7/0x230 net/core/net-sysfs.c:2362
 register_netdevice+0x8f3/0x1000 net/core/dev.c:11424
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1063 [inline]
 nsim_create+0x5ee/0x8f0 drivers/net/netdevsim/netdev.c:1145
 __nsim_dev_port_add+0x4d2/0x670 drivers/net/netdevsim/dev.c:1493
 nsim_dev_port_add_all+0x33/0xc0 drivers/net/netdevsim/dev.c:1549
 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1601 [inline]
 nsim_dev_reload_up+0x30c/0x480 drivers/net/netdevsim/dev.c:1058
 devlink_reload+0x323/0x590 net/devlink/dev.c:474
 devlink_pernet_pre_exit+0xdb/0x230 net/devlink/core.c:507
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0xb5/0x420 net/core/net_namespace.c:234
 cleanup_net+0x37c/0x5b0 net/core/net_namespace.c:704
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:436
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7874 Comm: kworker/u8:41 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: netns cleanup_net
==================================================================
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
batman_adv: batadv0: Removing interface: gretap1
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond0 (unregistering): Released all slaves
bond3 (unregistering): (slave veth3): Releasing active interface
bond3 (unregistering): Released all slaves
bond4 (unregistering): Released all slaves
bond5 (unregistering): Released all slaves
bond6 (unregistering): Released all slaves
bond7 (unregistering): Released all slaves
bond8 (unregistering): (slave veth7): Releasing active interface
batadv1: entered promiscuous mode
bond8 (unregistering): (slave batadv1): Releasing active interface
bond8 (unregistering): Released all slaves
tipc: Disabling bearer <udp:syz2>
tipc: Left network mode
IPVS: stopping master sync thread 15722 ...
hsr_slave_0: left promiscuous mode
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_1
batman_adv: batadv0: Removing interface: macsec2
team0 (unregistering): Port device team_slave_1 removed
IPVS: stop unused estimator thread 0...
netdevsim netdevsim3 eth3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
netdevsim netdevsim3 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 eth2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
netdevsim netdevsim3 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 eth1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
netdevsim netdevsim3 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim3 eth0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0
netdevsim netdevsim3 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
bond0 (unregistering): Released all slaves
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond3 (unregistering): (slave gretap1): Releasing active interface
bond1 (unregistering): (slave geneve2): Releasing active interface
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond3 (unregistering): Released all slaves
bond1 (unregistering): (slave gretap1): Releasing backup interface
bond1 (unregistering): (slave gretap1): the permanent HWaddr of slave - 86:9c:28:d4:7c:f8 - is still in use by bond - set the HWaddr of slave to a different address to avoid conflicts
gretap1 (unregistering): left promiscuous mode
gretap1 (unregistering): left allmulticast mode
bond1 (unregistering): (slave bond2): making interface the new active one
bond2 (unregistering): entered promiscuous mode
bond2 (unregistering): entered allmulticast mode
bond0 (unregistering): (slave bridge1): Releasing active interface
bridge1 (unregistering): left promiscuous mode
bridge1 (unregistering): left allmulticast mode
bond0 (unregistering): Released all slaves
bond1 (unregistering): (slave bond2): Releasing backup interface
bond2 (unregistering): left promiscuous mode
bond2 (unregistering): left allmulticast mode
bond1 (unregistering): Released all slaves
bond2 (unregistering): Released all slaves
bond3 (unregistering): (slave veth3): Releasing active interface
bond3 (unregistering): Released all slaves
bond4 (unregistering): (slave bond5): Releasing backup interface
bond5 (unregistering): left promiscuous mode
bond4 (unregistering): Released all slaves
bond5 (unregistering): Released all slaves
tipc: Left network mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_1
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Removing interface: batadv_slave_1
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
IPVS: stop unused estimator thread 0...
IPVS: stop unused estimator thread 0...