syzbot

unknown

map[Benign:true Explanation:The KCSAN report indicates a data race between a write in `d_make_discardable` and a read in `do_readlinkat` (via `d_is_symlink`). The shared variable being accessed is `dentry->d_flags`.

The writer `d_make_discardable` modifies `d_flags` to clear the `DCACHE_PERSISTENT` bit:
```c
dentry->d_flags &= ~DCACHE_PERSISTENT;
```
This is done under `dentry->d_lock`.

The reader `do_readlinkat` calls `d_is_symlink`, which checks the `DCACHE_ENTRY_TYPE` bits in `d_flags`:
```c
static inline bool d_is_symlink(const struct dentry *dentry)
{
    return __d_entry_type(dentry) == DCACHE_SYMLINK_TYPE;
}
```
This read is performed locklessly.

The data race is on the `unsigned int d_flags` field.
1.  **Bit Disjointness**: The `DCACHE_PERSISTENT` bit and the `DCACHE_ENTRY_TYPE` bits are distinct. Modifying the persistent flag does not affect the file type (symlink, directory, etc.) encoded in the type bits.
2.  **Atomicity**: On the x86_64 architecture, aligned 32-bit loads and stores are atomic. The reader will see either the old value of `d_flags` or the new value. In either case, the `DCACHE_ENTRY_TYPE` bits remain unchanged by `d_make_discardable` (which only clears `DCACHE_PERSISTENT`). Thus, `d_is_symlink` returns the correct consistent result regardless of the race.
3.  **Lost Updates**: The "value changed" line in the report suggests the `DCACHE_REFERENCED` bit (0x100) might be involved (likely set by a concurrent lookup or dput). Since `d_make_discardable` performs a read-modify-write (`&=`), it could theoretically overwrite a concurrent setting of `DCACHE_REFERENCED`. However, `DCACHE_REFERENCED` is a heuristic flag used for LRU cache eviction. Losing an update to this flag is considered benign as it only affects performance/caching strategy, not correctness.

This pattern of lockless reads of `d_flags` for type checks while `d_flags` might be modified by other threads (holding `d_lock`) is a common and intentional design in the Linux kernel to optimize fast-path lookups. Therefore, this is a benign data race.

Result: Benign]

unknown

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/272a7bdfaebeadf1d6a179ddd415230a629d5d25]

unknown

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/d0b75086843172d23d111d20fb289b5f741e7258]

unknown

map[Index:codesearch-index]

unknown

map[Benign:true]

You are an experienced Linux kernel developer tasked with determining if the given kernel bug
report is actionable or not. Actionable means that it contains enough info to root cause
the underlying bug, and that the report is self-consistent and makes sense, rather than
a one-off nonsensical crash induced by a previous memory corruption.

Use the provided tools to confirm any assumptions, what variables/fields being accessed, etc.
In particular, don't make assumptions about the kernel source code,
use codesearch tools to read the actual source code.

The bug report is a data race report from KCSAN tool.
It contains 2 stack traces of the memory accesses that constitute a data race.
The report would be inconsistent, if the stacks point to different subsystems,
or if they access different fields.
The report would be non-actionable, if the underlysing data race is "benign".
That is, the race is on a simple int/bool or similar field, and the accesses
are not supposed to be protected by any mutual exclusion primitives.
Common examples of such "benign" data races are accesses to various flags fields,
statistics counters, and similar.
An actionable race is "harmful", that is can lead to corruption/crash even with
a conservative compiler that compiles memory accesses to primitive types
effectively as atomic. A common example of a "harmful" data races is race on
a complex container (list/hashmap/etc), where accesses are supposed to be protected
by a mutual exclusion primitive.
In the final reply explain why you think the report is consistent and the data race is harmful.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

The bug report is:

==================================================================
BUG: KCSAN: data-race in d_make_discardable / do_readlinkat

write to 0xffff88811a80a900 of 4 bytes by task 3549 on cpu 0:
 d_make_discardable+0x4f/0xa0 fs/dcache.c:936
 simple_unlink+0x68/0x80 fs/libfs.c:807
 shmem_unlink+0x12d/0x140 mm/shmem.c:3991
 vfs_unlink+0x28b/0x440 fs/namei.c:5378
 do_unlinkat+0x1cd/0x4b0 fs/namei.c:5448
 __do_sys_unlink fs/namei.c:5483 [inline]
 __se_sys_unlink fs/namei.c:5481 [inline]
 __x64_sys_unlink+0x2e/0x40 fs/namei.c:5481
 x64_sys_call+0x2f48/0x3000 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811a80a900 of 4 bytes by task 3005 on cpu 1:
 __d_entry_type include/linux/dcache.h:416 [inline]
 d_is_symlink include/linux/dcache.h:446 [inline]
 do_readlinkat+0x9f/0x320 fs/stat.c:585
 __do_sys_readlink fs/stat.c:613 [inline]
 __se_sys_readlink fs/stat.c:610 [inline]
 __x64_sys_readlink+0x47/0x60 fs/stat.c:610
 x64_sys_call+0x2af1/0x3000 arch/x86/include/generated/asm/syscalls_64.h:90
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x08300080 -> 0x00300180

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3005 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

The KCSAN report indicates a data race between a write in `d_make_discardable` and a read in `do_readlinkat` (via `d_is_symlink`). The shared variable being accessed is `dentry->d_flags`.

The writer `d_make_discardable` modifies `d_flags` to clear the `DCACHE_PERSISTENT` bit:
```c
dentry->d_flags &= ~DCACHE_PERSISTENT;
```
This is done under `dentry->d_lock`.

The reader `do_readlinkat` calls `d_is_symlink`, which checks the `DCACHE_ENTRY_TYPE` bits in `d_flags`:
```c
static inline bool d_is_symlink(const struct dentry *dentry)
{
    return __d_entry_type(dentry) == DCACHE_SYMLINK_TYPE;
}
```
This read is performed locklessly.

The data race is on the `unsigned int d_flags` field.
1.  **Bit Disjointness**: The `DCACHE_PERSISTENT` bit and the `DCACHE_ENTRY_TYPE` bits are distinct. Modifying the persistent flag does not affect the file type (symlink, directory, etc.) encoded in the type bits.
2.  **Atomicity**: On the x86_64 architecture, aligned 32-bit loads and stores are atomic. The reader will see either the old value of `d_flags` or the new value. In either case, the `DCACHE_ENTRY_TYPE` bits remain unchanged by `d_make_discardable` (which only clears `DCACHE_PERSISTENT`). Thus, `d_is_symlink` returns the correct consistent result regardless of the race.
3.  **Lost Updates**: The "value changed" line in the report suggests the `DCACHE_REFERENCED` bit (0x100) might be involved (likely set by a concurrent lookup or dput). Since `d_make_discardable` performs a read-modify-write (`&=`), it could theoretically overwrite a concurrent setting of `DCACHE_REFERENCED`. However, `DCACHE_REFERENCED` is a heuristic flag used for LRU cache eviction. Losing an update to this flag is considered benign as it only affects performance/caching strategy, not correctness.

This pattern of lockless reads of `d_flags` for type checks while `d_flags` might be modified by other threads (holding `d_lock`) is a common and intentional design in the Linux kernel to optimize fast-path lookups. Therefore, this is a benign data race.

Result: Benign

unknown

unknown

map[SourceFile:fs/dcache.c]

map[Entities:[map[Kind:function Name:___d_drop] map[Kind:function Name:__d_add] map[Kind:function Name:__d_alloc] map[Kind:function Name:__d_clear_type_and_inode] map[Kind:function Name:__d_drop] map[Kind:function Name:__d_drop] map[Kind:function Name:__d_find_alias] map[Kind:function Name:__d_find_any_alias] map[Kind:function Name:__d_free] map[Kind:function Name:__d_free_external] map[Kind:function Name:__d_instantiate] map[Kind:function Name:__d_lookup] map[Kind:function Name:__d_lookup_rcu] map[Kind:function Name:__d_lookup_rcu_op_compare] map[Kind:function Name:__d_lookup_unhash] map[Kind:function Name:__d_lookup_unhash_wake] map[Kind:function Name:__d_lookup_unhash_wake] map[Kind:function Name:__d_move] map[Kind:function Name:__d_obtain_alias] map[Kind:function Name:__d_rehash] map[Kind:function Name:__d_set_inode_and_type] map[Kind:function Name:__d_unalias] map[Kind:function Name:__dentry_kill] map[Kind:function Name:copy_name] map[Kind:function Name:d_add] map[Kind:function Name:d_add] map[Kind:function Name:d_add_ci] map[Kind:function Name:d_add_ci] map[Kind:function Name:d_alloc] map[Kind:function Name:d_alloc] map[Kind:function Name:d_alloc_anon] map[Kind:function Name:d_alloc_anon] map[Kind:function Name:d_alloc_cursor] map[Kind:function Name:d_alloc_name] map[Kind:function Name:d_alloc_name] map[Kind:function Name:d_alloc_parallel] map[Kind:function Name:d_alloc_parallel] map[Kind:function Name:d_alloc_pseudo] map[Kind:function Name:d_ancestor] map[Kind:function Name:d_delete] map[Kind:function Name:d_delete] map[Kind:function Name:d_dispose_if_unused] map[Kind:function Name:d_dispose_if_unused] map[Kind:function Name:d_drop] map[Kind:function Name:d_drop] map[Kind:function Name:d_exchange] map[Kind:function Name:d_exchange] map[Kind:function Name:d_find_alias] map[Kind:function Name:d_find_alias] map[Kind:function Name:d_find_alias_rcu] map[Kind:function Name:d_find_any_alias] map[Kind:function Name:d_find_any_alias] map[Kind:function Name:d_flags_for_inode] map[Kind:function Name:d_hash] map[Kind:function Name:d_hash_and_lookup] map[Kind:function Name:d_instantiate] map[Kind:function Name:d_instantiate] map[Kind:function Name:d_instantiate_new] map[Kind:function Name:d_instantiate_new] map[Kind:function Name:d_invalidate] map[Kind:function Name:d_invalidate] map[Kind:function Name:d_lookup] map[Kind:function Name:d_lookup] map[Kind:function Name:d_lru_add] map[Kind:function Name:d_lru_del] map[Kind:function Name:d_lru_isolate] map[Kind:function Name:d_lru_shrink_move] map[Kind:function Name:d_make_discardable] map[Kind:function Name:d_make_discardable] map[Kind:function Name:d_make_persistent] map[Kind:function Name:d_make_persistent] map[Kind:function Name:d_make_root] map[Kind:function Name:d_make_root] map[Kind:function Name:d_mark_dontcache] map[Kind:function Name:d_mark_dontcache] map[Kind:function Name:d_mark_tmpfile] map[Kind:function Name:d_mark_tmpfile] map[Kind:function Name:d_move] map[Kind:function Name:d_move] map[Kind:function Name:d_obtain_alias] map[Kind:function Name:d_obtain_alias] map[Kind:function Name:d_obtain_root] map[Kind:function Name:d_obtain_root] map[Kind:function Name:d_op_flags] map[Kind:function Name:d_parent_ino] map[Kind:function Name:d_parent_ino] map[Kind:function Name:d_prune_aliases] map[Kind:function Name:d_prune_aliases] map[Kind:function Name:d_rehash] map[Kind:function Name:d_rehash] map[Kind:function Name:d_same_name] map[Kind:function Name:d_same_name] map[Kind:function Name:d_set_d_op] map[Kind:function Name:d_set_mounted] map[Kind:function Name:d_shrink_add] map[Kind:function Name:d_shrink_del] map[Kind:function Name:d_splice_alias] map[Kind:function Name:d_splice_alias] map[Kind:function Name:d_splice_alias_ops] map[Kind:function Name:d_tmpfile] map[Kind:function Name:d_tmpfile] map[Kind:function Name:d_wait_lookup] map[Kind:function Name:d_walk] map[Kind:function Name:dcache_init] map[Kind:function Name:dcache_init_early] map[Kind:function Name:dentry_cmp] map[Kind:function Name:dentry_free] map[Kind:function Name:dentry_lru_isolate] map[Kind:function Name:dentry_lru_isolate_shrink] map[Kind:function Name:dentry_string_cmp] map[Kind:function Name:dentry_unlink_inode] map[Kind:function Name:dentry_unlist] map[Kind:function Name:dget_parent] map[Kind:function Name:dget_parent] map[Kind:function Name:dname_external] map[Kind:function Name:do_one_tree] map[Kind:function Name:dput] map[Kind:function Name:dput] map[Kind:function Name:dput_to_list] map[Kind:function Name:end_dir_add] map[Kind:function Name:external_name] map[Kind:function Name:fast_dput] map[Kind:function Name:find_submount] map[Kind:function Name:finish_dput] map[Kind:function Name:get_nr_dentry] map[Kind:function Name:get_nr_dentry_negative] map[Kind:function Name:get_nr_dentry_unused] map[Kind:function Name:in_lookup_hash] map[Kind:function Name:init_fs_dcache_sysctls] map[Kind:function Name:is_subdir] map[Kind:function Name:is_subdir] map[Kind:function Name:lock_for_kill] map[Kind:function Name:path_check_mount] map[Kind:function Name:path_has_submounts] map[Kind:function Name:path_has_submounts] map[Kind:function Name:proc_nr_dentry] map[Kind:function Name:prune_dcache_sb] map[Kind:function Name:release_dentry_name_snapshot] map[Kind:function Name:release_dentry_name_snapshot] map[Kind:function Name:retain_dentry] map[Kind:function Name:select_collect] map[Kind:function Name:select_collect2] map[Kind:function Name:select_collect_umount] map[Kind:function Name:set_default_d_op] map[Kind:function Name:set_default_d_op] map[Kind:function Name:set_dhash_entries] map[Kind:function Name:shrink_dcache_for_umount] map[Kind:function Name:shrink_dcache_parent] map[Kind:function Name:shrink_dcache_parent] map[Kind:function Name:shrink_dcache_sb] map[Kind:function Name:shrink_dcache_sb] map[Kind:function Name:shrink_dcache_tree] map[Kind:function Name:shrink_dentry_list] map[Kind:function Name:shrink_dentry_list] map[Kind:function Name:shrink_kill] map[Kind:function Name:start_dir_add] map[Kind:function Name:swap_names] map[Kind:function Name:take_dentry_name_snapshot] map[Kind:function Name:take_dentry_name_snapshot] map[Kind:function Name:to_shrink_list] map[Kind:function Name:umount_check] map[Kind:function Name:vfs_caches_init] map[Kind:function Name:vfs_caches_init_early] map[Kind:function Name:vfs_pressure_ratio] map[Kind:function Name:vfs_pressure_ratio]] Missing:false]

unknown

unknown

map[IncludeLines:true Name:d_make_discardable SourceFile:fs/dcache.c]

map[Missing:false SourceCode: 931:	void d_make_discardable(struct dentry *dentry)
 932:	{
 933:		spin_lock(&dentry->d_lock);
 934:		WARN_ON(!(dentry->d_flags & DCACHE_PERSISTENT));
 935:		dentry->d_flags &= ~DCACHE_PERSISTENT;
 936:		dentry->d_lockref.count--;
 937:		rcu_read_lock();
 938:		finish_dput(dentry);
 939:	}
 SourceFile:fs/dcache.c]

unknown

unknown

map[IncludeLines:true Name:dentry SourceFile:include/linux/dcache.h]

map[Missing:true SourceCode: SourceFile:]

unknown

unknown

map[IncludeLines:true Name:dentry SourceFile:include/linux/dcache.h]

map[Missing:true SourceCode: SourceFile:]

unknown

unknown

map[SourceFile:include/linux/dcache.h]

map[Entities:[map[Kind:function Name:__d_drop] map[Kind:function Name:__d_entry_type] map[Kind:function Name:__d_lookup_unhash_wake] map[Kind:function Name:__d_path] map[Kind:function Name:cant_mount] map[Kind:function Name:d_absolute_path] map[Kind:function Name:d_add] map[Kind:function Name:d_add_ci] map[Kind:function Name:d_alloc] map[Kind:function Name:d_alloc_anon] map[Kind:function Name:d_alloc_parallel] map[Kind:function Name:d_ancestor] map[Kind:function Name:d_backing_inode] map[Kind:function Name:d_can_lookup] map[Kind:function Name:d_count] map[Kind:function Name:d_delete] map[Kind:function Name:d_dispose_if_unused] map[Kind:function Name:d_drop] map[Kind:function Name:d_exchange] map[Kind:function Name:d_find_alias] map[Kind:function Name:d_find_alias_rcu] map[Kind:function Name:d_find_any_alias] map[Kind:function Name:d_first_child] map[Kind:function Name:d_flags_negative] map[Kind:function Name:d_in_lookup] map[Kind:function Name:d_inode] map[Kind:function Name:d_inode_rcu] map[Kind:function Name:d_instantiate] map[Kind:function Name:d_instantiate_new] map[Kind:function Name:d_invalidate] map[Kind:function Name:d_is_autodir] map[Kind:function Name:d_is_dir] map[Kind:function Name:d_is_file] map[Kind:function Name:d_is_miss] map[Kind:function Name:d_is_negative] map[Kind:function Name:d_is_positive] map[Kind:function Name:d_is_reg] map[Kind:function Name:d_is_special] map[Kind:function Name:d_is_symlink] map[Kind:function Name:d_is_whiteout] map[Kind:function Name:d_lookup] map[Kind:function Name:d_lookup_done] map[Kind:function Name:d_make_discardable] map[Kind:function Name:d_make_persistent] map[Kind:function Name:d_make_root] map[Kind:function Name:d_managed] map[Kind:function Name:d_mark_tmpfile] map[Kind:function Name:d_mountpoint] map[Kind:function Name:d_move] map[Kind:function Name:d_next_sibling] map[Kind:function Name:d_obtain_alias] map[Kind:function Name:d_obtain_root] map[Kind:function Name:d_parent_ino] map[Kind:function Name:d_path] map[Kind:function Name:d_prune_aliases] map[Kind:function Name:d_real] map[Kind:function Name:d_real_inode] map[Kind:function Name:d_really_is_negative] map[Kind:function Name:d_really_is_positive] map[Kind:function Name:d_rehash] map[Kind:function Name:d_same_name] map[Kind:function Name:d_splice_alias] map[Kind:function Name:d_splice_alias_ops] map[Kind:function Name:d_tmpfile] map[Kind:function Name:d_unhashed] map[Kind:function Name:d_unlinked] map[Kind:function Name:dentry_path] map[Kind:function Name:dentry_path_raw] map[Kind:function Name:dget] map[Kind:function Name:dget_dlock] map[Kind:function Name:dget_parent] map[Kind:function Name:dont_mount] map[Kind:function Name:dput] map[Kind:function Name:dynamic_dname] map[Kind:function Name:path_has_submounts] map[Kind:function Name:release_dentry_name_snapshot] map[Kind:function Name:set_default_d_op] map[Kind:function Name:shrink_dcache_parent] map[Kind:function Name:shrink_dcache_sb] map[Kind:function Name:shrink_dentry_list] map[Kind:function Name:simple_positive] map[Kind:function Name:take_dentry_name_snapshot] map[Kind:function Name:vfs_pressure_ratio]] Missing:false]

unknown

unknown

map[IncludeLines:true Name:dentry SourceFile:include/linux/dcache.h]

map[Missing:true SourceCode: SourceFile:]

unknown

unknown

map[IncludeLines:true Name:DCACHE_PERSISTENT SourceFile:include/linux/dcache.h]

map[Missing:true SourceCode: SourceFile:]

unknown

unknown

map[IncludeLines:true Name:__d_entry_type SourceFile:include/linux/dcache.h]

map[Missing:false SourceCode: 410:	/*
 411:	 * Directory cache entry type accessor functions.
 412:	 */
 413:	static inline unsigned __d_entry_type(const struct dentry *dentry)
 414:	{
 415:		return dentry->d_flags & DCACHE_ENTRY_TYPE;
 416:	}
 SourceFile:include/linux/dcache.h]

unknown

unknown

map[IncludeLines:true Name:do_readlinkat SourceFile:fs/stat.c]

map[Missing:false SourceCode: 562:	static int do_readlinkat(int dfd, const char __user *pathname,
 563:				 char __user *buf, int bufsiz)
 564:	{
 565:		struct path path;
 566:		struct filename *name;
 567:		int error;
 568:		unsigned int lookup_flags = LOOKUP_EMPTY;
 569:	
 570:		if (bufsiz <= 0)
 571:			return -EINVAL;
 572:	
 573:	retry:
 574:		name = getname_flags(pathname, lookup_flags);
 575:		error = filename_lookup(dfd, name, lookup_flags, &path, NULL);
 576:		if (unlikely(error)) {
 577:			putname(name);
 578:			return error;
 579:		}
 580:	
 581:		/*
 582:		 * AFS mountpoints allow readlink(2) but are not symlinks
 583:		 */
 584:		if (d_is_symlink(path.dentry) ||
 585:		    d_backing_inode(path.dentry)->i_op->readlink) {
 586:			error = security_inode_readlink(path.dentry);
 587:			if (!error) {
 588:				touch_atime(&path);
 589:				error = vfs_readlink(path.dentry, buf, bufsiz);
 590:			}
 591:		} else {
 592:			error = (name->name[0] == '\0') ? -ENOENT : -EINVAL;
 593:		}
 594:		path_put(&path);
 595:		putname(name);
 596:		if (retry_estale(error, lookup_flags)) {
 597:			lookup_flags |= LOOKUP_REVAL;
 598:			goto retry;
 599:		}
 600:		return error;
 601:	}
 SourceFile:fs/stat.c]

unknown

unknown

map[IncludeLines:true Name:d_unhashed SourceFile:include/linux/dcache.h]

map[Missing:false SourceCode: 357:	/**
 358:	 * d_unhashed - is dentry hashed
 359:	 * @dentry: entry to check
 360:	 *
 361:	 * Returns true if the dentry passed is not currently hashed.
 362:	 */
 363:	static inline int d_unhashed(const struct dentry *dentry)
 364:	{
 365:		return hlist_bl_unhashed(&dentry->d_hash);
 366:	}
 SourceFile:include/linux/dcache.h]

unknown

unknown

map[Name:DCACHE_SYMLINK_TYPE SourceFile:include/linux/dcache.h]

map[Comment: Kind: Missing:true]

unknown

unknown

map[IncludeLines:true Name:d_alloc SourceFile:include/linux/dcache.h]

map[Missing:false SourceCode: 243:	/* allocate/de-allocate */
 244:	extern struct dentry * d_alloc(struct dentry *, const struct qstr *);
 SourceFile:include/linux/dcache.h]

unknown

unknown

map[IncludeLines:true Name:d_path SourceFile:include/linux/dcache.h]

map[Missing:false SourceCode: 307:	extern char *d_path(const struct path *, char *, int);
 SourceFile:include/linux/dcache.h]

unknown

unknown

map[IncludeLines:true Name:dentry SourceFile:include/linux/dcache.h]

map[Missing:true SourceCode: SourceFile:]

unknown

unknown

map[IncludeLines:true Name:simple_unlink SourceFile:fs/libfs.c]

map[Missing:false SourceCode: 803:	int simple_unlink(struct inode *dir, struct dentry *dentry)
 804:	{
 805:		__simple_unlink(dir, dentry);
 806:		d_make_discardable(dentry);
 807:		return 0;
 808:	}
 SourceFile:fs/libfs.c]

unknown

unknown

map[Benign:true]

map[Benign:true]

unknown