syzbot


KCSAN: data-race in generic_fillattr / shmem_symlink (7)

Status: moderation: reported on 2026/06/25 21:20
Subsystems: mm
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+a46c99c93206dd90baf9@syzkaller.appspotmail.com
First crash: 2d19h, last: 2d19h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
cd06c82f-87e0-430b-a40f-3190bfe9b08b assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in generic_fillattr / shmem_symlink (7) 2026/06/27 00:50 2026/06/27 00:50 2026/06/27 00:53 7ff32d8bb9773a5f02d3db4c8207fc9251ebedc5

			
		
6ad94fda-60b2-45ec-90e5-7e6382517ea8 assessment-kcsan Benign: ✅ KCSAN: data-race in generic_fillattr / shmem_symlink (7) 2026/06/25 21:19 2026/06/25 21:19 2026/06/25 21:23 7ff32d8bb9773a5f02d3db4c8207fc9251ebedc5

			
		
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in generic_fillattr / shmem_symlink (2) mm 6 247 794d 934d 0/29 auto-obsoleted due to no activity on 2024/05/30 03:00
upstream KCSAN: data-race in generic_fillattr / shmem_symlink (5) mm 6 2 229d 257d 0/29 auto-obsoleted due to no activity on 2026/01/05 20:06
upstream KCSAN: data-race in generic_fillattr / shmem_symlink (3) mm 6 16 624d 731d 0/29 auto-obsoleted due to no activity on 2024/11/16 05:24
upstream KCSAN: data-race in generic_fillattr / shmem_symlink (4) mm 6 6 465d 565d 0/29 auto-obsoleted due to no activity on 2025/05/15 12:20
upstream KCSAN: data-race in generic_fillattr / shmem_symlink fs 6 30 2205d 2396d 0/29 closed as invalid on 2020/06/18 14:24
upstream KCSAN: data-race in generic_fillattr / shmem_symlink (6) mm 6 3 130d 136d 0/29 auto-obsoleted due to no activity on 2026/04/15 02:16

Sample crash report:
==================================================================
BUG: KCSAN: data-race in generic_fillattr / shmem_symlink

write to 0xffff8881047393fc of 4 bytes by task 3288 on cpu 0:
 inode_set_mtime_to_ts include/linux/fs.h:1655 [inline]
 shmem_symlink+0x369/0x3a0 mm/shmem.c:4066
 vfs_symlink+0xfd/0x220 fs/namei.c:5656
 filename_symlinkat+0xe8/0x2b0 fs/namei.c:5681
 __do_sys_symlink fs/namei.c:5708 [inline]
 __se_sys_symlink+0x42/0x1b0 fs/namei.c:5704
 __x64_sys_symlink+0x31/0x40 fs/namei.c:5704
 x64_sys_call+0x2465/0x3020 arch/x86/include/generated/asm/syscalls_64.h:89
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881047393fc of 4 bytes by task 3280 on cpu 1:
 inode_get_mtime_nsec include/linux/fs.h:1641 [inline]
 inode_get_mtime include/linux/fs.h:1647 [inline]
 generic_fillattr+0x214/0x340 fs/stat.c:102
 shmem_getattr+0x181/0x200 mm/shmem.c:1302
 vfs_getattr_nosec+0x146/0x1e0 fs/stat.c:213
 vfs_getattr+0x48/0x60 fs/stat.c:262
 vfs_statx_path+0x28/0x140 fs/stat.c:299
 vfs_statx+0xc4/0x170 fs/stat.c:356
 vfs_fstatat+0x118/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat+0x55/0x3e0 fs/stat.c:532
 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:532
 x64_sys_call+0x2c64/0x3020 arch/x86/include/generated/asm/syscalls_64.h:263
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0d7320d7 -> 0x0d7e64da

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3280 Comm: udevd Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/25 21:19 upstream a142da0b2d32 7ff32d8b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in generic_fillattr / shmem_symlink
* Struck through repros no longer work on HEAD.