KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath

Status: moderation: reported on 2026/01/19 04:38
Subsystems: kernfs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+f5e0ba366db50663c2e2@syzkaller.appspotmail.com
First crash: 273d, last: 3d14h
▶ ▼ ✨ AI Jobs (6)
ID Workflow Result Correct Bug Created Started Finished Revision
dfabef63 repro-c 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/10/14 08:11 2026/10/14 08:12 2026/10/14 09:32 7321cd29
9f11f59c repro-c 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/10/12 16:26 2026/10/12 16:26 2026/10/12 18:15 745a967f
6d6c3987 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/06/02 03:27 2026/06/02 03:27 2026/06/02 04:22 386cc6da
acc7cc4b assessment-security 💥 KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/05/21 12:06 2026/05/21 12:06 2026/05/21 12:45 cf874a1c
ee12a410 repro ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/03/10 13:38 2026/03/11 03:47 2026/03/11 03:57 86914af9
e2847366 assessment-kcsan Benign: ✅ Confident: ✅ ❓ KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath 2026/01/19 04:37 2026/01/19 04:37 2026/01/19 04:41 a9d6a792

Sample crash report:
infiniband syz1: Couldn't open port 1
RDS/IB: syz1: added
smc: adding ib device syz1 with port count 1
smc:    ib device syz1 port 1 has no pnetid
==================================================================
BUG: KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath

write to 0xffffc9001179f098 of 1 bytes by task 3954 on cpu 1:
 rwsem_try_write_lock kernel/locking/rwsem.c:676 [inline]
 rwsem_down_write_slowpath+0x3eb/0xab0 kernel/locking/rwsem.c:1189
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write+0xad/0xc0 kernel/locking/rwsem.c:1632
 kernfs_add_one+0x5a/0x350 fs/kernfs/dir.c:825
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1079
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:316
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x43e/0x9e0 fs/sysfs/group.c:189
 internal_create_groups fs/sysfs/group.c:229 [inline]
 sysfs_create_groups+0x3f/0xf0 fs/sysfs/group.c:255
 setup_port drivers/infiniband/core/sysfs.c:1202 [inline]
 ib_setup_port_attrs+0xa2c/0x1480 drivers/infiniband/core/sysfs.c:1388
 add_one_compat_dev+0x297/0x390 drivers/infiniband/core/device.c:1002
 rdma_dev_init_net+0x1b9/0x240 drivers/infiniband/core/device.c:1227
 ops_init+0x22a/0x2e0 net/core/net_namespace.c:137
 setup_net+0x9f/0x230 net/core/net_namespace.c:443
 copy_net_ns+0x333/0x490 net/core/net_namespace.c:582
 create_new_namespaces+0x1f6/0x420 kernel/nsproxy.c:132
 unshare_nsproxy_namespaces+0x115/0x150 kernel/nsproxy.c:234
 ksys_unshare+0x3fd/0x6f0 kernel/fork.c:3297
 __do_sys_unshare kernel/fork.c:3365 [inline]
 __se_sys_unshare kernel/fork.c:3363 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3363
 x64_sys_call+0x1e33/0x2550 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffc9001179f098 of 1 bytes by task 3929 on cpu 0:
 rwsem_down_write_slowpath+0x462/0xab0 kernel/locking/rwsem.c:1207
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write+0xad/0xc0 kernel/locking/rwsem.c:1632
 kernfs_add_one+0x5a/0x350 fs/kernfs/dir.c:825
 __kernfs_create_file+0x145/0x180 fs/kernfs/file.c:1079
 sysfs_add_file_mode_ns+0x132/0x1b0 fs/sysfs/file.c:316
 create_files fs/sysfs/group.c:82 [inline]
 internal_create_group+0x43e/0x9e0 fs/sysfs/group.c:189
 internal_create_groups fs/sysfs/group.c:229 [inline]
 sysfs_create_groups+0x3f/0xf0 fs/sysfs/group.c:255
 setup_port drivers/infiniband/core/sysfs.c:1202 [inline]
 ib_setup_port_attrs+0xa2c/0x1480 drivers/infiniband/core/sysfs.c:1388
 add_one_compat_dev+0x297/0x390 drivers/infiniband/core/device.c:1002
 add_compat_devs drivers/infiniband/core/device.c:1060 [inline]
 enable_device_and_get+0x1cd/0x260 drivers/infiniband/core/device.c:1381
 ib_register_device+0x906/0xa80 drivers/infiniband/core/device.c:1503
 rxe_register_device+0x175/0x190 drivers/infiniband/sw/rxe/rxe_verbs.c:1549
 rxe_add+0x8e2/0x900 drivers/infiniband/sw/rxe/rxe.c:217
 rxe_net_add+0x62/0xb0 drivers/infiniband/sw/rxe/rxe_net.c:625
 rxe_newlink+0xdd/0x1a0 drivers/infiniband/sw/rxe/rxe.c:243
 nldev_newlink+0x3a8/0x430 drivers/infiniband/core/nldev.c:1858
 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
 rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
 rdma_nl_rcv+0x439/0x570 drivers/infiniband/core/netlink.c:259
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x5a9/0x680 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x5be/0x6f0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x532/0x580 net/socket.c:2713
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2767
 __sys_sendmsg net/socket.c:2799 [inline]
 __do_sys_sendmsg net/socket.c:2804 [inline]
 __se_sys_sendmsg net/socket.c:2802 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2802
 x64_sys_call+0x22ab/0x2550 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3929 Comm: syz.0.133 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
syz.0.133 (3929) used greatest stack depth: 9032 bytes left

Crashes (105):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/15 17:51 upstream 9aa622dbaab8 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/26 14:15 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/22 21:16 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/21 13:23 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/20 22:51 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/19 05:11 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/16 07:44 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/15 20:37 upstream f6e7b42bf05b 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/11 06:11 upstream 08df884136f1 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/09 13:38 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/09 01:06 upstream 893e11787f78 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/04 17:22 upstream bc35965f6940 f65209a4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/04 06:18 upstream 8ab1afb2eb24 801f0966 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/09/03 10:33 upstream 940de590b839 6a988719 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/26 21:20 upstream 73ae59e97596 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/16 06:05 upstream 3eb40771c00a 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/10 11:01 upstream db2ddb871435 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/09 01:15 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/04 03:23 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/08/02 09:49 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/28 11:23 upstream 62cc90241548 45ae1df4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/27 12:10 upstream f5098b6bae76 aae9036b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/26 06:18 upstream 0ce37745d4bf 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/25 07:20 upstream e2a936998ab2 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/15 01:01 upstream 3b029c035b34 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/12 02:31 upstream dd3210c47e8d d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/10 12:31 upstream a635d6748234 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/08 17:10 upstream 0e35b9b6ec0f 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/02 23:17 upstream 4a50a141f05a 2b70b115 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/07/02 02:04 upstream 4a50a141f05a 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/29 12:27 upstream dc59e4fea9d8 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/29 05:01 upstream dc59e4fea9d8 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/24 22:03 upstream 840ef6c78e6a 302586aa .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/23 01:49 upstream 1dc18801be29 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/21 16:16 upstream 390d73adf896 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/14 17:28 upstream 8cd9520d35a6 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/13 17:22 upstream 062871f1371b 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/12 12:19 upstream 2b414a95b8f7 e93da63e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/12 01:07 upstream 2b414a95b8f7 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/11 16:54 upstream 9716c086c8e8 d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/02 12:15 upstream 6f3ed7fec72f 62fe1528 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/06/01 17:19 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/31 03:04 upstream 9d87d0fc8c8e 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/29 23:59 upstream 9215e74f228f 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/28 10:29 upstream eb3f4b7426cf 4c36e7e5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/23 19:48 upstream eed108edc117 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/23 07:59 upstream 79bd2dded182 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/05/17 13:27 upstream 6916d5703ddf de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/03/09 23:45 upstream 1f318b96cc84 176bead5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
2026/01/19 04:37 upstream e84d960149e7 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rwsem_down_write_slowpath / rwsem_down_write_slowpath
* Struck through repros no longer work on HEAD.