KCSAN: data-race in __dev_open / is_eth_port_of_netdev_filter

Status: moderation: reported C repro on 2026/10/04 18:32
Labels: prio:low race:benign
[Documentation on labels]
Reported-by: syzbot+d74535df2e7569594384@syzkaller.appspotmail.com
First crash: 1d02h, last: 1d02h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
f5ee92ee assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __dev_open / is_eth_port_of_netdev_filter 2026/10/04 18:32 2026/10/04 18:32 2026/10/04 19:01 57bbd979
a2675338 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __dev_open / is_eth_port_of_netdev_filter 2026/10/04 18:32 2026/10/04 18:32 2026/10/04 19:33 57bbd979

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __dev_open / is_eth_port_of_netdev_filter

read-write to 0xffff8881178020b0 of 4 bytes by task 3644 on cpu 0:
 netif_set_up net/core/dev.h:-1 [inline]
 __dev_open+0x354/0x550 net/core/dev.c:1731
 __dev_change_flags+0x1c8/0x490 net/core/dev.c:9855
 rtnl_configure_link+0x171/0x2a0 net/core/rtnetlink.c:3725
 rtnl_newlink_create+0x219/0x4a0 net/core/rtnetlink.c:3982
 __rtnl_newlink net/core/rtnetlink.c:4103 [inline]
 rtnl_newlink+0x1255/0x1510 net/core/rtnetlink.c:4220
 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:7137
 netlink_rcv_skb+0x11e/0x220 net/netlink/af_netlink.c:2575
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7164
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x5a9/0x680 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x5be/0x6f0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x411/0x470 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2284
 x64_sys_call+0x200c/0x2550 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881178020b0 of 4 bytes by task 12 on cpu 1:
 netif_is_bond_master include/linux/netdevice.h:5592 [inline]
 is_eth_active_slave_of_bonding_rcu drivers/infiniband/core/roce_gid_mgmt.c:132 [inline]
 is_eth_port_of_netdev_filter+0x8c/0x1b0 drivers/infiniband/core/roce_gid_mgmt.c:162
 ib_enum_roce_netdev+0x117/0x1d0 drivers/infiniband/core/device.c:2574
 ib_enum_all_roce_netdevs+0x89/0x100 drivers/infiniband/core/device.c:2601
 netdevice_event_work_handler+0x253/0x3d0 drivers/infiniband/core/roce_gid_mgmt.c:648
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00001002 -> 0x00001103

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: gid-cache-wq netdevice_event_work_handler
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 18:31 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 6addb4f38557 a3c7249d .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in __dev_open / is_eth_port_of_netdev_filter
* Struck through repros no longer work on HEAD.