syzbot


KCSAN: data-race in __follow_mount_rcu / d_set_mounted

Status: moderation: reported on 2025/12/03 12:52
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+ef7e2e63add8cfdc684f@syzkaller.appspotmail.com
First crash: 63d, last: 4d23h

Sample crash report:
batman_adv: batadv0: Interface activated: batadv_slave_1
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / d_set_mounted

read to 0xffff8881004403c0 of 4 bytes by task 5199 on cpu 0:
 __follow_mount_rcu+0x19a/0x2f0 fs/namei.c:1659
 handle_mounts fs/namei.c:1685 [inline]
 step_into_slowpath+0x30c/0x4c0 fs/namei.c:2051
 step_into fs/namei.c:2099 [inline]
 walk_component fs/namei.c:2235 [inline]
 link_path_walk+0x974/0xe30 fs/namei.c:2597
 path_openat+0x1bf/0x23c0 fs/namei.c:4792
 do_filp_open+0x15d/0x280 fs/namei.c:4823
 do_sys_openat2+0xa6/0x150 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1447
 x64_sys_call+0x2b07/0x3000 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff8881004403c0 of 4 bytes by task 9797 on cpu 1:
 d_set_mounted+0xff/0x160 fs/dcache.c:1487
 get_mountpoint+0x197/0x370 fs/namespace.c:903
 attach_recursive_mnt+0x115/0x15d0 fs/namespace.c:2579
 graft_tree+0xf0/0x100 fs/namespace.c:2816
 do_loopback+0x230/0x2b0 fs/namespace.c:2998
 path_mount+0x401/0xbc0 fs/namespace.c:4016
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9797 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/31 08:47 upstream 283073725700 c75a2f6e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/01/04 15:01 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/15 01:46 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/03 12:51 upstream d61f1cc5db79 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
* Struck through repros no longer work on HEAD.