syzbot


KCSAN: data-race in __follow_mount_rcu / d_set_mounted

Status: moderation: reported on 2025/12/03 12:52
Subsystems: fs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+ef7e2e63add8cfdc684f@syzkaller.appspotmail.com
First crash: 203d, last: 1d12h
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision Error
491bab2e-6983-4fef-aad6-d5029a82b555 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/05/21 13:18 2026/05/21 13:18 2026/05/21 13:54 cf874a1cf36318c06202027159ddac14acf00db7

			
		
f0a08668-4c6e-499a-995f-9e3f13a248a7 repro KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/03/10 13:46 2026/03/11 05:32 2026/03/11 05:51 86914af9098a80da53c3c5d46be980c572ee29f8

			
		
d159bd20-41f8-4754-9066-0bfa9c90dd2a assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in __follow_mount_rcu / d_set_mounted 2026/01/14 19:10 2026/01/14 19:11 2026/01/14 19:35 a9d6a79219801d2130df3b1a792c57f0e5428e9f

			
		

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __follow_mount_rcu / d_set_mounted

read to 0xffff8881006b9a80 of 4 bytes by task 2986 on cpu 1:
 __follow_mount_rcu+0x156/0x2a0 fs/namei.c:1714
 handle_mounts fs/namei.c:1740 [inline]
 step_into_slowpath+0x30c/0x4c0 fs/namei.c:2104
 step_into fs/namei.c:2152 [inline]
 walk_component fs/namei.c:2288 [inline]
 link_path_walk+0x947/0xdd0 fs/namei.c:-1
 path_lookupat+0x53/0x4c0 fs/namei.c:2812
 filename_lookup+0x18f/0x390 fs/namei.c:2842
 do_readlinkat+0x74/0x2f0 fs/stat.c:571
 __do_sys_readlink fs/stat.c:605 [inline]
 __se_sys_readlink fs/stat.c:602 [inline]
 __x64_sys_readlink+0x47/0x60 fs/stat.c:602
 x64_sys_call+0x2b51/0x3020 arch/x86/include/generated/asm/syscalls_64.h:90
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff8881006b9a80 of 4 bytes by task 3304 on cpu 0:
 d_set_mounted+0xff/0x160 fs/dcache.c:1605
 get_mountpoint+0x197/0x370 fs/namespace.c:898
 attach_recursive_mnt+0x11a/0x1700 fs/namespace.c:2588
 graft_tree+0xf0/0x100 fs/namespace.c:2845
 do_loopback+0x247/0x480 fs/namespace.c:3028
 path_mount+0x3ea/0xb90 fs/namespace.c:4155
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4367
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4367
 x64_sys_call+0x2d61/0x3020 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3304 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/23 08:02 upstream 502d801f0ab0 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/20 02:19 upstream 5e2e14749c3d 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/06 14:06 upstream c10130c234c8 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/06/01 10:23 upstream e43ffb69e043 8d8eeb3a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/23 14:47 upstream 79bd2dded182 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/18 10:18 upstream 5200f5f493f7 55156e84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/12 13:32 upstream 50897c955902 07aeade5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/05/08 04:50 upstream fcee7d82f27d 5633175a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/04/22 05:29 upstream 4ee64205ffaa 0b6ab7ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/03/11 18:36 upstream b29fb8829bff 2d88ab01 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/02/07 03:36 upstream 2687c848e578 f20fc9f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/01/31 08:47 upstream 283073725700 c75a2f6e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2026/01/04 15:01 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/15 01:46 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
2025/12/03 12:51 upstream d61f1cc5db79 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __follow_mount_rcu / d_set_mounted
* Struck through repros no longer work on HEAD.