KCSAN: data-race in __follow_mount_rcu / d_set_mounted

Status: moderation: reported on 2025/12/03 12:52
Subsystems: fs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+ef7e2e63add8cfdc684f@syzkaller.appspotmail.com
First crash: 324d, last: 9h19m
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
0c1cb83a repro-c Reproduced: ✅ ❓ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/10/13 03:19 2026/10/13 03:19 2026/10/13 03:51 745a967f
491bab2e assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/05/21 13:18 2026/05/21 13:18 2026/05/21 13:54 cf874a1c
f0a08668 repro ❓ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/03/10 13:46 2026/03/11 05:32 2026/03/11 05:51 86914af9
d159bd20 assessment-kcsan Benign: ✅ Confident: ✅ ❓ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/01/14 19:10 2026/01/14 19:11 2026/01/14 19:35 a9d6a792
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/13 05:41 15m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / d_set_mounted

read to 0xffff888100406600 of 4 bytes by task 9151 on cpu 1:
 __follow_mount_rcu+0x156/0x2a0 fs/namei.c:1714
 handle_mounts fs/namei.c:1740 [inline]
 step_into_slowpath+0x30c/0x4c0 fs/namei.c:2104
 step_into fs/namei.c:2152 [inline]
 walk_component fs/namei.c:2288 [inline]
 link_path_walk+0x953/0xde0 fs/namei.c:-1
 path_lookupat+0x53/0x4c0 fs/namei.c:2812
 filename_lookup+0x18f/0x390 fs/namei.c:2842
 kern_path+0x3b/0xf0 fs/namei.c:3036
 lookup_bdev+0x66/0x170 block/bdev.c:1268
 get_tree_bdev_flags+0x59/0x300 fs/super.c:1862
 get_tree_bdev+0x1f/0x30 fs/super.c:1906
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5897
 vfs_get_tree+0x57/0x1d0 fs/super.c:1943
 fc_mount fs/namespace.c:1282 [inline]
 do_new_mount_fc fs/namespace.c:3910 [inline]
 do_new_mount+0x288/0x730 fs/namespace.c:3986
 path_mount+0x4ad/0xb90 fs/namespace.c:4337
 do_mount fs/namespace.c:4350 [inline]
 __do_sys_mount fs/namespace.c:4565 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4542
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4542
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888100406600 of 4 bytes by task 9154 on cpu 0:
 d_set_mounted+0x119/0x190 fs/dcache.c:1621
 get_mountpoint+0x197/0x380 fs/namespace.c:948
 attach_recursive_mnt+0x1ea/0x17c0 fs/namespace.c:2676
 graft_tree fs/namespace.c:2940 [inline]
 do_add_mount fs/namespace.c:3897 [inline]
 do_new_mount_fc fs/namespace.c:3929 [inline]
 do_new_mount+0x64f/0x730 fs/namespace.c:3986
 path_mount+0x4ad/0xb90 fs/namespace.c:4337
 do_mount fs/namespace.c:4350 [inline]
 __do_sys_mount fs/namespace.c:4565 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4542
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4542
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9154 Comm: syz.0.1038 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
==================================================================

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/24 01:56 upstream 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/10/05 04:33 upstream a90ee4305c4a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/09/28 03:14 upstream efb44d93a620 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/09/15 00:46 upstream 704340f1cd0d 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/09/03 13:32 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/09/02 08:10 upstream 89a312991dc6 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/08/29 18:29 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/08/27 19:39 upstream 73e3f0710014 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/08/25 08:27 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/08/17 06:13 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/07/13 15:30 upstream a13c140cc289 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/07/03 11:51 upstream 51512e22efe8 58bf2096 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/23 08:02 upstream 502d801f0ab0 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/20 02:19 upstream 5e2e14749c3d 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/06 14:06 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/01 10:23 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/23 14:47 upstream 79bd2dded182 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/18 10:18 upstream 5200f5f493f7 55156e84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/12 13:32 upstream 50897c955902 07aeade5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/08 04:50 upstream fcee7d82f27d 5633175a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/04/22 05:29 upstream 4ee64205ffaa 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/03/11 18:36 upstream b29fb8829bff 2d88ab01 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/02/07 03:36 upstream 2687c848e578 f20fc9f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/01/31 08:47 upstream 283073725700 c75a2f6e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/01/04 15:01 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/15 01:46 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/03 12:51 upstream d61f1cc5db79 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
* Struck through repros no longer work on HEAD.