KCSAN: data-race in __d_instantiate / path_openat (4)

Status: moderation: reported C repro on 2026/09/14 10:14
Subsystems: fs
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+4ec755d8cb8bfc26439c@syzkaller.appspotmail.com
First crash: 45d, last: 22d
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
41f9af1d repro-c Reproduced: ✅ ❓ KCSAN: data-race in __d_instantiate / path_openat (4) 2026/10/06 20:52 2026/10/06 20:52 2026/10/06 21:42 f7710056
19e6b050 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in __d_instantiate / path_openat (4) 2026/09/16 00:02 2026/09/16 00:02 2026/09/16 00:35 2daa4bb5
2446a18b assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __d_instantiate / path_openat (4) 2026/09/14 10:14 2026/09/14 10:14 2026/09/14 10:57 70a60e12
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __d_instantiate / path_openat (3) prio:low fs 6 2 182d 197d 0/29 auto-obsoleted due to no activity on 2026/06/25 07:42
upstream KCSAN: data-race in __d_instantiate / path_openat fs 6 1 514d 514d 0/29 auto-obsoleted due to no activity on 2025/07/28 17:11
upstream KCSAN: data-race in __d_instantiate / path_openat (2) fs 6 2 321d 362d 0/29 auto-obsoleted due to no activity on 2026/02/06 09:23
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/06 21:49 10m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 69f80fef3153299d9c72c53d1d71eef6354b6926 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __d_instantiate / path_openat

write to 0xffff8881079600f0 of 8 bytes by task 3639 on cpu 1:
 __d_set_inode_and_type fs/dcache.c:407 [inline]
 __d_instantiate+0x1db/0x390 fs/dcache.c:2156
 d_make_persistent+0x72/0x110 fs/dcache.c:2982
 shmem_mknod+0x15f/0x170 mm/shmem.c:3854
 vfs_mknod+0x337/0x460 fs/namei.c:5269
 filename_mknodat+0x279/0x450 fs/namei.c:-1
 __do_sys_mknodat fs/namei.c:5350 [inline]
 __se_sys_mknodat+0x38/0xf0 fs/namei.c:5346
 __x64_sys_mknodat+0x55/0x70 fs/namei.c:5346
 x64_sys_call+0x2182/0x2550 arch/x86/include/generated/asm/syscalls_64.h:260
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881079600f0 of 8 bytes by task 3644 on cpu 0:
 step_into fs/namei.c:2141 [inline]
 open_last_lookups fs/namei.c:4780 [inline]
 path_openat+0x5bc/0x10d0 fs/namei.c:4997
 do_file_open+0x16c/0x290 fs/namei.c:5029
 do_sys_openat2+0xa0/0x130 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1434
 x64_sys_call+0x1f72/0x2550 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xffff8881159b90d0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3644 Comm: syz-executor272 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in __d_instantiate / path_openat

read-write to 0xffff888107957d80 of 4 bytes by task 3639 on cpu 0:
 fsnotify_update_flags include/linux/fsnotify_backend.h:-1 [inline]
 __d_instantiate+0x2a8/0x390 fs/dcache.c:2158
 d_make_persistent+0x72/0x110 fs/dcache.c:2982
 shmem_mknod+0x15f/0x170 mm/shmem.c:3854
 vfs_mknod+0x337/0x460 fs/namei.c:5269
 filename_mknodat+0x279/0x450 fs/namei.c:-1
 __do_sys_mknodat fs/namei.c:5350 [inline]
 __se_sys_mknodat+0x38/0xf0 fs/namei.c:5346
 __x64_sys_mknodat+0x55/0x70 fs/namei.c:5346
 x64_sys_call+0x2182/0x2550 arch/x86/include/generated/asm/syscalls_64.h:260
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888107957d80 of 4 bytes by task 3644 on cpu 1:
 d_managed include/linux/dcache.h:433 [inline]
 step_into fs/namei.c:2140 [inline]
 open_last_lookups fs/namei.c:4780 [inline]
 path_openat+0x572/0x10d0 fs/namei.c:4997
 do_file_open+0x16c/0x290 fs/namei.c:5029
 do_sys_openat2+0xa0/0x130 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1434
 x64_sys_call+0x1f72/0x2550 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000080 -> 0x08280080

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3644 Comm: syz-executor272 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in d_make_discardable / lookup_fast

write to 0xffff8881079970c0 of 4 bytes by task 3639 on cpu 1:
 d_make_discardable+0x4f/0x90 fs/dcache.c:1050
 simple_unlink+0x68/0x80 fs/libfs.c:808
 shmem_unlink+0x12d/0x140 mm/shmem.c:3954
 vfs_unlink+0x1c3/0x490 fs/namei.c:5649
 filename_unlinkat+0x1dc/0x410 fs/namei.c:5719
 __do_sys_unlink fs/namei.c:5754 [inline]
 __se_sys_unlink+0x2b/0xe0 fs/namei.c:5751
 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5751
 x64_sys_call+0x18ee/0x2550 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881079970c0 of 4 bytes by task 3644 on cpu 0:
 d_revalidate fs/namei.c:1034 [inline]
 lookup_fast+0xf1/0x320 fs/namei.c:1868
 lookup_fast_for_open fs/namei.c:4719 [inline]
 open_last_lookups fs/namei.c:4750 [inline]
 path_openat+0x312/0x10d0 fs/namei.c:4997
 do_file_open+0x16c/0x290 fs/namei.c:5029
 do_sys_openat2+0xa0/0x130 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1434
 x64_sys_call+0x1f72/0x2550 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x08280080 -> 0x00280180

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3644 Comm: syz-executor272 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/06 22:00 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 69f80fef3153 70a60e12 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in __d_instantiate / path_openat
2026/09/14 10:14 upstream 704340f1cd0d 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __d_instantiate / path_openat
* Struck through repros no longer work on HEAD.