KCSAN: data-race in __follow_mount_rcu / do_new_mount (2)

Status: moderation: reported on 2026/09/28 18:31
Subsystems: fs
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+b50faea713ddad0f135e@syzkaller.appspotmail.com
First crash: 1d17h, last: 1d17h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
8a970a49 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __follow_mount_rcu / do_new_mount (2) 2026/09/30 04:50 2026/09/30 04:50 2026/09/30 04:56 69537153
f941989e assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __follow_mount_rcu / do_new_mount (2) 2026/09/28 18:40 2026/09/28 18:40 2026/09/28 19:13 58f15308
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __follow_mount_rcu / do_new_mount fs prio:low 6 1 179d 179d 0/29 auto-obsoleted due to no activity on 2026/05/29 23:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / do_new_mount

read to 0xffff8881004066c0 of 4 bytes by task 3294 on cpu 1:
 __follow_mount_rcu+0x156/0x2a0 fs/namei.c:1714
 handle_mounts fs/namei.c:1740 [inline]
 step_into_slowpath+0x30c/0x4c0 fs/namei.c:2104
 step_into fs/namei.c:2152 [inline]
 walk_component fs/namei.c:2288 [inline]
 link_path_walk+0x947/0xdd0 fs/namei.c:-1
 path_lookupat+0x53/0x4c0 fs/namei.c:2812
 filename_lookup+0x18f/0x390 fs/namei.c:2842
 vfs_statx+0x96/0x170 fs/stat.c:353
 vfs_fstatat+0x118/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat+0x55/0x3e0 fs/stat.c:532
 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:532
 x64_sys_call+0xee6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:263
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read-write to 0xffff8881004066c0 of 4 bytes by task 5727 on cpu 0:
 maybe_free_mountpoint fs/namespace.c:928 [inline]
 unpin_mountpoint fs/namespace.c:943 [inline]
 __unlock_mount fs/namespace.c:2810 [inline]
 unlock_mount fs/namespace.c:2818 [inline]
 do_new_mount_fc fs/namespace.c:3795 [inline]
 do_new_mount+0x6a3/0x8d0 fs/namespace.c:3848
 path_mount+0x4ad/0xb90 fs/namespace.c:4168
 do_mount fs/namespace.c:4181 [inline]
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4374
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4374
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 5727 Comm: syz.3.390 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/28 18:30 upstream 72d3fcf802c4 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / do_new_mount
* Struck through repros no longer work on HEAD.