[moderation] [fs?] KCSAN: data-race in ___d_drop / __d_lookup (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e771677c937d Merge tag 'for-linus-iommufd' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=169c4aae580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6c4d4fc570c1ffb8
dashboard link: https://syzkaller.appspot.com/bug?extid=e2c16893db4f7b42a4fc
compiler: Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6
CC: [linux-...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bae7327b084e/disk-e771677c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fd84da38906d/vmlinux-e771677c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/69d31641743b/bzImage-e771677c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e2c168...@syzkaller.appspotmail.com

8021q: adding VLAN 0 to HW filter on device eth2
==================================================================
BUG: KCSAN: data-race in ___d_drop / __d_lookup

write to 0xffff8881069249d0 of 8 bytes by task 2159 on cpu 1:
__hlist_bl_del include/linux/list_bl.h:128 [inline]
___d_drop+0xa8/0x190 fs/dcache.c:570
__d_drop fs/dcache.c:577 [inline]
d_invalidate+0x53/0x1f0 fs/dcache.c:1863
proc_invalidate_siblings_dcache+0x1c8/0x2b0 fs/proc/inode.c:142
proc_sys_invalidate_dcache fs/proc/proc_sysctl.c:289 [inline]
start_unregistering fs/proc/proc_sysctl.c:316 [inline]
drop_sysctl_table+0xbd/0x270 fs/proc/proc_sysctl.c:1516
drop_sysctl_table+0x1be/0x270 fs/proc/proc_sysctl.c:1523
unregister_sysctl_table+0x30/0x50 fs/proc/proc_sysctl.c:1541
unregister_net_sysctl_table+0x15/0x20 net/sysctl_net.c:177
xfrm6_net_sysctl_exit net/ipv6/xfrm6_policy.c:236 [inline]
xfrm6_net_exit+0x3e/0x90 net/ipv6/xfrm6_policy.c:270
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x285/0x420 net/core/net_namespace.c:252
cleanup_net+0x37c/0x5b0 net/core/net_namespace.c:702
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
worker_thread+0x569/0x750 kernel/workqueue.c:3486
kthread+0x221/0x270 kernel/kthread.c:436
ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff8881069249d0 of 8 bytes by task 3023 on cpu 0:
hlist_bl_unhashed include/linux/list_bl.h:54 [inline]
d_unhashed include/linux/dcache.h:396 [inline]
__d_lookup+0xf8/0x340 fs/dcache.c:2620
lookup_fast+0x5e/0x320 fs/namei.c:1878
walk_component fs/namei.c:2278 [inline]
link_path_walk+0x523/0xdd0 fs/namei.c:2656
path_openat+0x1ac/0x2000 fs/namei.c:4855
do_file_open+0x16c/0x290 fs/namei.c:4888
do_sys_openat2+0xa0/0x130 fs/open.c:1395
do_sys_open fs/open.c:1401 [inline]
__do_sys_openat fs/open.c:1417 [inline]
__se_sys_openat fs/open.c:1412 [inline]
__x64_sys_openat+0xf2/0x120 fs/open.c:1412
x64_sys_call+0x1e39/0x3020 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff8881069243c8 -> 0xffff888107e79308

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3023 Comm: dhcpcd Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================
8021q: adding VLAN 0 to HW filter on device eth3
8021q: adding VLAN 0 to HW filter on device eth4
8021q: adding VLAN 0 to HW filter on device eth5
8021q: adding VLAN 0 to HW filter on device eth6
8021q: adding VLAN 0 to HW filter on device eth8
8021q: adding VLAN 0 to HW filter on device eth7
8021q: adding VLAN 0 to HW filter on device eth9
8021q: adding VLAN 0 to HW filter on device eth10
8021q: adding VLAN 0 to HW filter on device eth11
8021q: adding VLAN 0 to HW filter on device eth12
8021q: adding VLAN 0 to HW filter on device eth13
8021q: adding VLAN 0 to HW filter on device eth14
8021q: adding VLAN 0 to HW filter on device eth15
8021q: adding VLAN 0 to HW filter on device eth16
8021q: adding VLAN 0 to HW filter on device eth17
8021q: adding VLAN 0 to HW filter on device eth18
8021q: adding VLAN 0 to HW filter on device eth20
8021q: adding VLAN 0 to HW filter on device eth19
8021q: adding VLAN 0 to HW filter on device eth21
8021q: adding VLAN 0 to HW filter on device eth22
8021q: adding VLAN 0 to HW filter on device eth23
8021q: adding VLAN 0 to HW filter on device eth24


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup