KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath

Status: moderation: reported on 2026/01/19 04:38
Subsystems: kernfs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+f5e0ba366db50663c2e2@syzkaller.appspotmail.com
First crash: 289d, last: 3d04h
▶ ▼ ✨ AI Jobs (6)
ID Workflow Result Correct Bug Created Started Finished Revision
dfabef63 repro-c 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/10/14 08:11 2026/10/14 08:12 2026/10/14 09:32 7321cd29
9f11f59c repro-c 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/10/12 16:26 2026/10/12 16:26 2026/10/12 18:15 745a967f
6d6c3987 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/06/02 03:27 2026/06/02 03:27 2026/06/02 04:22 386cc6da
acc7cc4b assessment-security 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/05/21 12:06 2026/05/21 12:06 2026/05/21 12:45 cf874a1c
ee12a410 repro ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/03/10 13:38 2026/03/11 03:47 2026/03/11 03:57 86914af9
e2847366 assessment-kcsan Benign: ✅ Confident: ✅ ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/01/19 04:37 2026/01/19 04:37 2026/01/19 04:41 a9d6a792

Sample crash report:
bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
==================================================================
BUG: KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath

write to 0xffffc90001d1b1d8 of 1 bytes by task 30642 on cpu 0:
 rwsem_try_write_lock kernel/locking/rwsem.c:676 [inline]
 rwsem_down_write_slowpath+0x3fd/0xb10 kernel/locking/rwsem.c:1189
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write+0xa8/0xc0 kernel/locking/rwsem.c:1632
 kernfs_add_one+0x5a/0x310 fs/kernfs/dir.c:833
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1100
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:316
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x43e/0x9e0 fs/sysfs/group.c:189
 internal_create_groups fs/sysfs/group.c:229 [inline]
 sysfs_create_groups+0x3f/0xf0 fs/sysfs/group.c:255
 setup_gid_attrs drivers/infiniband/core/sysfs.c:1123 [inline]
 ib_setup_port_attrs+0xeda/0x14a0 drivers/infiniband/core/sysfs.c:1399
 add_one_compat_dev+0x25c/0x360 drivers/infiniband/core/device.c:1002
 rdma_dev_init_net+0x17d/0x210 drivers/infiniband/core/device.c:1227
 ops_init+0x22a/0x2e0 net/core/net_namespace.c:137
 setup_net+0x9f/0x230 net/core/net_namespace.c:443
 copy_net_ns+0x339/0x490 net/core/net_namespace.c:584
 create_new_namespaces+0x1f6/0x420 kernel/nsproxy.c:132
 unshare_nsproxy_namespaces+0x115/0x150 kernel/nsproxy.c:234
 ksys_unshare+0x3a3/0x690 kernel/fork.c:3298
 __do_sys_unshare kernel/fork.c:3364 [inline]
 __se_sys_unshare kernel/fork.c:3362 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3362
 x64_sys_call+0x1e33/0x2550 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffc90001d1b1d8 of 1 bytes by task 30591 on cpu 1:
 rwsem_down_write_slowpath+0x473/0xb10 kernel/locking/rwsem.c:1207
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write+0xa8/0xc0 kernel/locking/rwsem.c:1632
 kernfs_add_one+0x5a/0x310 fs/kernfs/dir.c:833
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1100
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:316
 sysfs_merge_group+0xed/0x1c0 fs/sysfs/group.c:382
 dpm_sysfs_add+0xaf/0x1e0 drivers/base/power/sysfs.c:704
 device_add+0x3bc/0x790 drivers/base/core.c:3723
 netdev_register_kobject+0x127/0x240 net/core/net-sysfs.c:2381
 register_netdevice+0xc68/0x13f0 net/core/dev.c:11701
 veth_newlink+0x4a1/0x9b0 drivers/net/veth.c:1906
 rtnl_newlink_create+0x1e4/0x4a0 net/core/rtnetlink.c:4006
 __rtnl_newlink net/core/rtnetlink.c:4135 [inline]
 rtnl_newlink+0x1255/0x1510 net/core/rtnetlink.c:4252
 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:7169
 netlink_rcv_skb+0x11e/0x220 net/netlink/af_netlink.c:2584
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7196
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x665/0x740 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x5ef/0x740 net/netlink/af_netlink.c:1920
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 __sys_sendto+0x429/0x480 net/socket.c:2283
 __do_sys_sendto net/socket.c:2290 [inline]
 __se_sys_sendto net/socket.c:2286 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2286
 x64_sys_call+0x200c/0x2550 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 30591 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
==================================================================
team0: Port device team_slave_0 added
team0: Port device team_slave_1 added
batman_adv: batadv0: Adding interface: batadv_slave_0
batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
batman_adv: batadv0: Adding interface: batadv_slave_1
batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
hsr_slave_0: entered promiscuous mode
hsr_slave_1: entered promiscuous mode
debugfs: 'hsr0' already exists in 'hsr'
Cannot create hsr debugfs directory
netdevsim netdevsim9 netdevsim0: renamed from eth0
8021q: adding VLAN 0 to HW filter on device netdevsim0
netdevsim netdevsim9 netdevsim1: renamed from eth1
8021q: adding VLAN 0 to HW filter on device netdevsim1
netdevsim netdevsim9 netdevsim2: renamed from eth2
8021q: adding VLAN 0 to HW filter on device netdevsim2
netdevsim netdevsim9 netdevsim3: renamed from eth3
8021q: adding VLAN 0 to HW filter on device netdevsim3
8021q: adding VLAN 0 to HW filter on device bond0
8021q: adding VLAN 0 to HW filter on device team0
8021q: adding VLAN 0 to HW filter on device batadv0
veth0_vlan: entered promiscuous mode
veth1_vlan: entered promiscuous mode
veth0_macvtap: entered promiscuous mode
veth1_macvtap: entered promiscuous mode
batman_adv: batadv0: Interface activated: batadv_slave_0
batman_adv: batadv0: Interface activated: batadv_slave_1

Crashes (106):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/01 17:08 upstream cbbddb6b08cc 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/10/15 17:51 upstream 9aa622dbaab8 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/26 14:15 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/22 21:16 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/21 13:23 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/20 22:51 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/19 05:11 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/16 07:44 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/15 20:37 upstream f6e7b42bf05b 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/11 06:11 upstream 08df884136f1 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/09 13:38 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/09 01:06 upstream 893e11787f78 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/04 17:22 upstream bc35965f6940 f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/04 06:18 upstream 8ab1afb2eb24 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/03 10:33 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/26 21:20 upstream 73ae59e97596 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/16 06:05 upstream 3eb40771c00a 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/10 11:01 upstream db2ddb871435 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/09 01:15 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/04 03:23 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/02 09:49 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/28 11:23 upstream 62cc90241548 45ae1df4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/27 12:10 upstream f5098b6bae76 aae9036b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/26 06:18 upstream 0ce37745d4bf 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/25 07:20 upstream e2a936998ab2 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/15 01:01 upstream 3b029c035b34 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/12 02:31 upstream dd3210c47e8d d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/10 12:31 upstream a635d6748234 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/08 17:10 upstream 0e35b9b6ec0f 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/02 23:17 upstream 4a50a141f05a 2b70b115 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/02 02:04 upstream 4a50a141f05a 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/29 12:27 upstream dc59e4fea9d8 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/29 05:01 upstream dc59e4fea9d8 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/24 22:03 upstream 840ef6c78e6a 302586aa .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/23 01:49 upstream 1dc18801be29 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/21 16:16 upstream 390d73adf896 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/14 17:28 upstream 8cd9520d35a6 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/13 17:22 upstream 062871f1371b 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/12 12:19 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/12 01:07 upstream 2b414a95b8f7 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/11 16:54 upstream 9716c086c8e8 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/02 12:15 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/01 17:19 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/31 03:04 upstream 9d87d0fc8c8e 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/29 23:59 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/28 10:29 upstream eb3f4b7426cf 4c36e7e5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/23 19:48 upstream eed108edc117 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/23 07:59 upstream 79bd2dded182 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/17 13:27 upstream 6916d5703ddf de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/03/09 23:45 upstream 1f318b96cc84 176bead5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/01/19 04:37 upstream e84d960149e7 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
* Struck through repros no longer work on HEAD.