syzbot


KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (3)

Status: moderation: reported on 2026/01/07 12:43
Subsystems: afs net
[Documentation on labels]
Reported-by: syzbot+17f64793f5ca7e8f5054@syzkaller.appspotmail.com
First crash: 22d, last: 2d16h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet net afs 6 2 267d 314d 0/29 auto-obsoleted due to no activity on 2025/06/16 08:50
upstream KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet (2) afs net 6 2 111d 155d 0/29 auto-obsoleted due to no activity on 2025/11/19 13:25

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet

write to 0xffff88810d458800 of 8 bytes by task 4488 on cpu 1:
 rxrpc_alloc_txqueue net/rxrpc/sendmsg.c:-1 [inline]
 rxrpc_send_data+0x8c5/0x1560 net/rxrpc/sendmsg.c:398
 rxrpc_do_sendmsg+0xc16/0xcc0 net/rxrpc/sendmsg.c:771
 rxrpc_sendmsg+0x47c/0x590 net/rxrpc/af_rxrpc.c:598
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x145/0x180 net/socket.c:742
 ____sys_sendmsg+0x31e/0x4a0 net/socket.c:2592
 ___sys_sendmsg+0x17b/0x1d0 net/socket.c:2646
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2683 [inline]
 __se_sys_sendmsg net/socket.c:2681 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2681
 x64_sys_call+0x17ba/0x3000 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810d458800 of 8 bytes by task 4496 on cpu 0:
 rxrpc_prepare_data_packet net/rxrpc/output.c:566 [inline]
 rxrpc_send_data_packet+0x465/0x1df0 net/rxrpc/output.c:664
 rxrpc_transmit_fresh_data net/rxrpc/call_event.c:255 [inline]
 rxrpc_transmit_some_data+0x63c/0x8b0 net/rxrpc/call_event.c:277
 rxrpc_input_call_event+0x8bb/0xf30 net/rxrpc/call_event.c:401
 rxrpc_io_thread+0x1c1e/0x21c0 net/rxrpc/io_thread.c:550
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x0000000000000000 -> 0xffff88810d45c800

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4496 Comm: krxrpcio/0 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/11 10:52 upstream 97313d6113ab d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet
2025/12/22 03:09 upstream 765b233a9b94 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rxrpc_send_data / rxrpc_send_data_packet
* Struck through repros no longer work on HEAD.