syzbot

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision	Error
3784c218-3ac1-417a-aa2e-514896a1a9d6	repro		❓	KCSAN: data-race in dont_mount / step_into_slowpath	2026/03/08 05:03	2026/03/08 05:03	2026/03/08 05:10	31e9c887f7dc24e04b3ca70d0d54fc34141844b0

repro

❓

KCSAN: data-race in dont_mount / step_into_slowpath

2026/03/08 05:03

2026/03/08 05:10

31e9c887f7dc24e04b3ca70d0d54fc34141844b0

================================================================== BUG: KCSAN: data-race in dont_mount / step_into_slowpath read-write to 0xffff88811bec9600 of 4 bytes by task 3304 on cpu 0: dont_mount+0x2a/0x40 include/linux/dcache.h:382 vfs_unlink+0x206/0x490 fs/namei.c:5472 filename_unlinkat+0x1e2/0x410 fs/namei.c:5540 __do_sys_unlink fs/namei.c:5575 [inline] __se_sys_unlink+0x2b/0xe0 fs/namei.c:5572 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5572 x64_sys_call+0x2eb6/0x3020 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811bec9600 of 4 bytes by task 2999 on cpu 1: __d_entry_type include/linux/dcache.h:416 [inline] d_is_symlink include/linux/dcache.h:446 [inline] step_into_slowpath+0x139/0x4c0 fs/namei.c:2105 step_into fs/namei.c:2149 [inline] walk_component fs/namei.c:2285 [inline] lookup_last fs/namei.c:2780 [inline] path_lookupat+0x330/0x500 fs/namei.c:2804 filename_lookup+0x190/0x390 fs/namei.c:2833 do_readlinkat+0x74/0x2f0 fs/stat.c:571 __do_sys_readlink fs/stat.c:605 [inline] __se_sys_readlink fs/stat.c:602 [inline] __x64_sys_readlink+0x47/0x60 fs/stat.c:602 x64_sys_call+0x2b51/0x3020 arch/x86/include/generated/asm/syscalls_64.h:90 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00300080 -> 0x00004080 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 2999 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 ==================================================================

Trajectory:
Seq	Timestamp	Type	Name	Duration
0/0	2026/03/08 05:03	flow	repro	6m Results: map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true } ReproSyz:symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00') unlink(&(0x7f0000000080)='./file1\x00') readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100) SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
1/1	2026/03/08 05:03	action	provide-var	0m Results: map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]
2/1	2026/03/08 05:03	action	kernel-checkouter	0m Results: map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/0e0543b6728a481f7d36ab5dee63cf72a341470b]
3/1	2026/03/08 05:04	action	kernel-builder	3m Results: map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/ab46ffce72d0488f35bcd81d33f5cf480fb66a36]
4/1	2026/03/08 05:08	agent	crash-repro-finder	1m Model: gemini-3-pro-preview Results: map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }] Instruction: You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug. Print only the syz program that could be executed directly, without backticks. Use set-results tool to provide results of the analysis. It must be called exactly once before the final reply. Ignore results of this tool. Prompt: Bug Title: KCSAN: data-race in dont_mount / step_into_slowpath Original Crash Report: ================================================================== BUG: KCSAN: data-race in dont_mount / step_into_slowpath read-write to 0xffff88811bec9600 of 4 bytes by task 3304 on cpu 0: dont_mount+0x2a/0x40 include/linux/dcache.h:382 vfs_unlink+0x206/0x490 fs/namei.c:5472 filename_unlinkat+0x1e2/0x410 fs/namei.c:5540 __do_sys_unlink fs/namei.c:5575 [inline] __se_sys_unlink+0x2b/0xe0 fs/namei.c:5572 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5572 x64_sys_call+0x2eb6/0x3020 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff88811bec9600 of 4 bytes by task 2999 on cpu 1: __d_entry_type include/linux/dcache.h:416 [inline] d_is_symlink include/linux/dcache.h:446 [inline] step_into_slowpath+0x139/0x4c0 fs/namei.c:2105 step_into fs/namei.c:2149 [inline] walk_component fs/namei.c:2285 [inline] lookup_last fs/namei.c:2780 [inline] path_lookupat+0x330/0x500 fs/namei.c:2804 filename_lookup+0x190/0x390 fs/namei.c:2833 do_readlinkat+0x74/0x2f0 fs/stat.c:571 __do_sys_readlink fs/stat.c:605 [inline] __se_sys_readlink fs/stat.c:602 [inline] __x64_sys_readlink+0x47/0x60 fs/stat.c:602 x64_sys_call+0x2b51/0x3020 arch/x86/include/generated/asm/syscalls_64.h:90 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00300080 -> 0x00004080 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 2999 Comm: udevd Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 ================================================================== The list of existing description files: acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt Reply: symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00') unlink(&(0x7f0000000080)='./file1\x00') readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)
5/2	2026/03/08 05:08	llm	crash-repro-finder	1m Model: gemini-3-pro-preview Tokens: input: 2798 output: 40 thoughts: 7710 Thoughts: KCSAN Race Reproduction Program Okay, so the task at hand is to generate a Syzkaller program that can reliably reproduce a KCSAN data race bug occurring within the `dont_mount` and `step_into_slowpath` functions. The core issue, as I understand it, is a race condition where one thread is unlinking a dentry (likely a symlink or something mount-related) while another thread is concurrently accessing that same dentry, specifically checking if it is a symlink via `d_is_symlink`. The kernel reports a data race where one thread writes to `dentry->d_flags` and another reads it concurrently. The first thread, the writer, is involved in unlinking the file in question. Specifically, the function `dont_mount` is being called which is responsible for modifying the `dentry->d_flags` by clearing `DCACHE_MOUNTED`, but in any case, it’s writing to `d_flags` to clear `DCACHE_MOUNTED` (or similar). This function is called from `vfs_unlink`, which is ultimately called by `sys_unlink`. The second thread, the reader, is looking up the same dentry, and is calling `d_is_symlink` which checks that same `dentry->d_flags` to see if `DCACHE_SYMLINK_TYPE` is set. The call stack indicates this happens during the `sys_readlink` system call and likely while traversing a path via `step_into_slowpath`. The heart of the race resides in the modification of the `d_flags` field in `dentry` by `dont_mount`, and the concurrent read of that same field by `d_is_symlink` within `step_into_slowpath`. The crash report shows a flag change of `0x00300080` to `0x00004080`. This looks like bits are being set and unset in `d_flags` on the fly. It's likely that a read-modify-write operation is happening on `dentry->d_flags`. To trigger the race, the Syzkaller program must setup a scenario that unlinks and accesses the same dentry concurrently. The easiest way to do this is with a symlink. So the program will: 1. Create a symlink called `file1` pointing to an existing file called `file0`. 2. Have one thread call `unlink("file1")`. 3. Have a second thread call `readlink("file1", buffer, length)`. The `readlink` call forces the path lookup that causes the race because it is accessing and walking the symlink during the lookup, specifically calling `d_is_symlink`. By using `unlink` in one thread and `readlink` in another, both threads are accessing that same dentry and that triggers the data race on `dentry->d_flags`. I believe the key to reproducing it reliably is to make those two calls concurrent. Syzkaller supports this with its threading and `collide` option. The program doesn't need a loop as long as the options are set correctly. So, here's the Syzkaller program. This should reproduce the KCSAN report if executed with threading and collision enabled in Syzkaller: ```syz symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00') unlink(&(0x7f0000000080)='./file1\x00') readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100) ```
6/2	2026/03/08 05:09	tool	set-results	0m Args: map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }] Results: map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }]
7/2	2026/03/08 05:09	llm	crash-repro-finder	0m Model: gemini-3-pro-preview Tokens: input: 11440 output: 126 thoughts: 2020 Thoughts: Finalizing the Syz Program for Race Condition Okay, the user wants the syz program; I've already done the analysis and considered the options. Time to generate the code. The core logic is clear: exploit a race condition between `unlink` and `readlink` on a symlink. The basic idea is: create a symlink, quickly unlink it, and then try to read its link target. If `unlink` happens at the right time in relation to `readlink`, we should be able to trigger a race. The program should be: ``` symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00') unlink(&(0x7f0000000080)='./file1\x00') readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100) ``` I'll check the syscall is available. `readlink` is a standard syscall, present in `sys.txt` or `filesystem.txt`, which the provided list contains. Even though `readlinkat` is the preferred option, `readlink` is still available on x86_64 and the crash report specifies `__x64_sys_readlink`. So, we're good there. I considered whether to include more variations to increase coverage, but for a repro, simplicity is best. The race is on `unlink` and `readlink`. The initial `symlink` is critical to ensure the file exists prior to `unlink` is called. The `collide` option will launch the `unlink` and `readlink` in parallel. Before I output, I'll double-check the addresses and syntax. `&(0x7f0000000000)` is syzkaller's standard pointer notation, and inline strings are correct. The race: `unlink` removes the name, and `readlink` uses the name. The race occurs if `unlink` executes concurrently with `readlink`. `vfs_unlink` calls `dont_mount` before `dir->i_op->unlink`, but the dentry is still reachable in the dcache until `d_delete` occurs or `unlink` completes. `vfs_unlink` calls `dont_mount` early, so the dentry will be in the dcache, so reachable. `readlink` checks `d_is_symlink` and `dont_mount` modifies d_flags. So the race is plausible. The program is solid. Addresses, buffer lengths (`0x100`), and `0x7f0000000100` for the buffer are all good. Now, I will make sure the syscall names are correct. `symlink` is `sys_symlink`, `unlink` is `sys_unlink`, `readlink` is `sys_readlink`. They're standard. I'll revisit the `dont_mount` call in `vfs_unlink`. `do_rmdir` calls `vfs_rmdir`, which calls `dont_mount`. But the report says `vfs_unlink`. So it must be a non-directory. Symlinks are non-directories. So `unlink` is the right syscall. `file0` is the target of the symlink. It doesn't need to exist. The race is on the dentry of `file1`. I'll verify the program again: `symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00') unlink(&(0x7f0000000080)='./file1\x00') readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)` I'll verify that the syscall numbers are correct. On x86_64, `readlink` is 89. The report mentions `__x64_sys_readlink`, so we have the right syscall. The syzkaller description for `readlink` says: `readlink(path ptr[in, string], buf ptr[out, array[int8]], bufsiz len[

Trajectory:

Seq

Timestamp

Type

Name

Duration

0/0

2026/03/08 05:03

flow

repro

Results:

map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true } ReproSyz:symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00')
unlink(&(0x7f0000000080)='./file1\x00')
readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100) SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

1/1

2026/03/08 05:03

action

provide-var

Results:

map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

2/1

2026/03/08 05:03

action

kernel-checkouter

Results:

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/0e0543b6728a481f7d36ab5dee63cf72a341470b]

3/1

2026/03/08 05:04

action

kernel-builder

Results:

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/ab46ffce72d0488f35bcd81d33f5cf480fb66a36]

4/1

2026/03/08 05:08

agent

crash-repro-finder

Model:

gemini-3-pro-preview

Results:

map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }]

Instruction:

You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.




Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:

Bug Title: KCSAN: data-race in dont_mount / step_into_slowpath

Original Crash Report:
==================================================================
BUG: KCSAN: data-race in dont_mount / step_into_slowpath

read-write to 0xffff88811bec9600 of 4 bytes by task 3304 on cpu 0:
 dont_mount+0x2a/0x40 include/linux/dcache.h:382
 vfs_unlink+0x206/0x490 fs/namei.c:5472
 filename_unlinkat+0x1e2/0x410 fs/namei.c:5540
 __do_sys_unlink fs/namei.c:5575 [inline]
 __se_sys_unlink+0x2b/0xe0 fs/namei.c:5572
 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5572
 x64_sys_call+0x2eb6/0x3020 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811bec9600 of 4 bytes by task 2999 on cpu 1:
 __d_entry_type include/linux/dcache.h:416 [inline]
 d_is_symlink include/linux/dcache.h:446 [inline]
 step_into_slowpath+0x139/0x4c0 fs/namei.c:2105
 step_into fs/namei.c:2149 [inline]
 walk_component fs/namei.c:2285 [inline]
 lookup_last fs/namei.c:2780 [inline]
 path_lookupat+0x330/0x500 fs/namei.c:2804
 filename_lookup+0x190/0x390 fs/namei.c:2833
 do_readlinkat+0x74/0x2f0 fs/stat.c:571
 __do_sys_readlink fs/stat.c:605 [inline]
 __se_sys_readlink fs/stat.c:602 [inline]
 __x64_sys_readlink+0x47/0x60 fs/stat.c:602
 x64_sys_call+0x2b51/0x3020 arch/x86/include/generated/asm/syscalls_64.h:90
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00300080 -> 0x00004080

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 2999 Comm: udevd Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

Reply:

symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00')
unlink(&(0x7f0000000080)='./file1\x00')
readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)

5/2

2026/03/08 05:08

llm

crash-repro-finder

Model:

gemini-3-pro-preview

Tokens:

							input: 2798
							output: 40
							thoughts: 7710

Thoughts:

**KCSAN Race Reproduction Program**

Okay, so the task at hand is to generate a Syzkaller program that can reliably reproduce a KCSAN data race bug occurring within the `dont_mount` and `step_into_slowpath` functions. The core issue, as I understand it, is a race condition where one thread is unlinking a dentry (likely a symlink or something mount-related) while another thread is concurrently accessing that same dentry, specifically checking if it is a symlink via `d_is_symlink`. The kernel reports a data race where one thread writes to `dentry->d_flags` and another reads it concurrently.

The first thread, the writer, is involved in unlinking the file in question. Specifically, the function `dont_mount` is being called which is responsible for modifying the `dentry->d_flags` by clearing `DCACHE_MOUNTED`, but in any case, it’s writing to `d_flags` to clear `DCACHE_MOUNTED` (or similar). This function is called from `vfs_unlink`, which is ultimately called by `sys_unlink`.

The second thread, the reader, is looking up the same dentry, and is calling `d_is_symlink` which checks that same `dentry->d_flags` to see if `DCACHE_SYMLINK_TYPE` is set. The call stack indicates this happens during the `sys_readlink` system call and likely while traversing a path via `step_into_slowpath`.

The heart of the race resides in the modification of the `d_flags` field in `dentry` by `dont_mount`, and the concurrent read of that same field by `d_is_symlink` within `step_into_slowpath`. The crash report shows a flag change of `0x00300080` to `0x00004080`. This looks like bits are being set and unset in `d_flags` on the fly. It's likely that a read-modify-write operation is happening on `dentry->d_flags`.

To trigger the race, the Syzkaller program must setup a scenario that unlinks and accesses the same dentry concurrently. The easiest way to do this is with a symlink. So the program will:
1. Create a symlink called `file1` pointing to an existing file called `file0`.
2. Have one thread call `unlink("file1")`.
3. Have a second thread call `readlink("file1", buffer, length)`.

The `readlink` call forces the path lookup that causes the race because it is accessing and walking the symlink during the lookup, specifically calling `d_is_symlink`. By using `unlink` in one thread and `readlink` in another, both threads are accessing that same dentry and that triggers the data race on `dentry->d_flags`. I believe the key to reproducing it reliably is to make those two calls concurrent. Syzkaller supports this with its threading and `collide` option. The program doesn't *need* a loop as long as the options are set correctly.

So, here's the Syzkaller program. This should reproduce the KCSAN report if executed with threading and collision enabled in Syzkaller:

```syz
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00')
unlink(&(0x7f0000000080)='./file1\x00')
readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)
```

6/2

2026/03/08 05:09

tool

set-results

Args:

map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }]

Results:

map[ReproOpts:{ "procs": 8, "repeat": true, "threaded": true, "collide": true }]

7/2

2026/03/08 05:09

llm

crash-repro-finder

Model:

gemini-3-pro-preview

Tokens:

							input: 11440
							output: 126
							thoughts: 2020

Thoughts:

**Finalizing the Syz Program for Race Condition**

Okay, the user wants the syz program; I've already done the analysis and considered the options. Time to generate the code. The core logic is clear: exploit a race condition between `unlink` and `readlink` on a symlink. The basic idea is: create a symlink, quickly unlink it, and then try to read its link target. If `unlink` happens at the right time in relation to `readlink`, we should be able to trigger a race.

The program should be:
```
symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00')
unlink(&(0x7f0000000080)='./file1\x00')
readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)
```

I'll check the syscall is available. `readlink` is a standard syscall, present in `sys.txt` or `filesystem.txt`, which the provided list contains. Even though `readlinkat` is the preferred option, `readlink` is still available on x86_64 and the crash report specifies `__x64_sys_readlink`. So, we're good there.

I considered whether to include more variations to increase coverage, but for a repro, simplicity is best.  The race is on `unlink` and `readlink`.  The initial `symlink` is critical to ensure the file exists prior to `unlink` is called.

The `collide` option will launch the `unlink` and `readlink` in parallel.

Before I output, I'll double-check the addresses and syntax. `&(0x7f0000000000)` is syzkaller's standard pointer notation, and inline strings are correct.

The race: `unlink` removes the name, and `readlink` uses the name. The race occurs if `unlink` executes concurrently with `readlink`. `vfs_unlink` calls `dont_mount` before `dir->i_op->unlink`, but the dentry is still reachable in the dcache until `d_delete` occurs or `unlink` completes. `vfs_unlink` calls `dont_mount` early, so the dentry will be in the dcache, so reachable. `readlink` checks `d_is_symlink` and `dont_mount` modifies d_flags. So the race is plausible. The program is solid. Addresses, buffer lengths (`0x100`), and `0x7f0000000100` for the buffer are all good.

Now, I will make sure the syscall names are correct. `symlink` is `sys_symlink`, `unlink` is `sys_unlink`, `readlink` is `sys_readlink`. They're standard.

I'll revisit the `dont_mount` call in `vfs_unlink`.  `do_rmdir` calls `vfs_rmdir`, which calls `dont_mount`. But the report says `vfs_unlink`. So it must be a non-directory. Symlinks are non-directories. So `unlink` is the right syscall.

`file0` is the target of the symlink. It doesn't need to exist. The race is on the dentry of `file1`.

I'll verify the program again:
`symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file1\x00')
unlink(&(0x7f0000000080)='./file1\x00')
readlink(&(0x7f0000000080)='./file1\x00', &(0x7f0000000100), 0x100)`

I'll verify that the syscall numbers are correct. On x86_64, `readlink` is 89. The report mentions `__x64_sys_readlink`, so we have the right syscall.

The syzkaller description for `readlink` says: `readlink(path ptr[in, string], buf ptr[out, array[int8]], bufsiz len[