KCSAN: data-race in __xa_clear_mark / xas_find_marked (2)

Status: moderation: reported on 2021/06/26 18:58
Subsystems: mm fs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+03743c59b799c7b55cd4@syzkaller.appspotmail.com
First crash: 1872d, last: 4h08m
✨ AI Jobs (5)
ID Workflow Result Correct Bug Created Started Finished Revision Error
5ddf1a8e-9d92-436f-9ac9-b27d549c610d assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ KCSAN: data-race in __xa_clear_mark / xas_find_marked (2) 2026/05/31 20:53 2026/05/31 20:53 2026/05/31 21:09 6b4a844333e83556da95d61d7f207e7ef5cd4bc6

			
		
72fecced-8864-4f9f-aa9a-8feff775cf9c assessment-security 💥 KCSAN: data-race in __xa_clear_mark / xas_find_marked (2) 2026/05/15 06:56 2026/05/15 06:56 2026/05/15 06:57 6ccb967e465e832a7bfd7a116ad00d52a0923a5d
failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 128
From /app/workdir/repo/linux
 * branch                HEAD       -> FETCH_HEAD
Updating files:  ...
truncated to first 200 bytes; open job for full error
a0741bf4-ef63-405e-93ee-97475b6df3b8 repro KCSAN: data-race in __xa_clear_mark / xas_find_marked (2) 2026/03/07 06:26 2026/03/07 06:26 2026/03/07 06:28 31e9c887f7dc24e04b3ca70d0d54fc34141844b0

			
		
be28beee-490e-4e38-957e-44e33e42eab1 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in __xa_clear_mark / xas_find_marked (2) 2026/02/24 18:46 2026/02/24 18:46 2026/02/24 18:48 305c0ec5cd886e2d13738e28e1b2df9b0ec20fc9

			
		
f2b43e1e-7b62-4577-8484-accbf9317c08 assessment-kcsan 💥 KCSAN: data-race in __xa_clear_mark / xas_find_marked (2) 2026/01/09 22:47 2026/01/09 22:47 2026/01/09 23:06 7519916073b761ced56a7b15fdeeb4674e8dc125
Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To moni...
truncated to first 200 bytes; open job for full error
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __xa_clear_mark / xas_find_marked fs mm 6 558 1872d 2173d 0/29 closed as invalid on 2021/06/07 13:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked

read-write to 0xffff88811ae25228 of 8 bytes by interrupt on cpu 1:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 __xa_clear_mark+0xf5/0x1e0 lib/xarray.c:2100
 __folio_end_writeback+0xf4/0x360 mm/page-writeback.c:2971
 folio_end_writeback_no_dropbehind+0x6d/0x1d0 mm/filemap.c:1666
 folio_end_writeback+0x1c/0x70 mm/filemap.c:1692
 mpage_write_end_io+0x245/0x4c0 fs/mpage.c:64
 bio_endio+0x35b/0x3f0 block/bio.c:1819
 blk_update_request+0x338/0x710 block/blk-mq.c:1016
 blk_mq_end_request+0x26/0x50 block/blk-mq.c:1147
 lo_complete_rq+0x98/0x130 drivers/block/loop.c:314
 blk_complete_reqs block/blk-mq.c:1222 [inline]
 blk_done_softirq+0x77/0xb0 block/blk-mq.c:1227
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:1076
 smpboot_thread_fn+0x32a/0x510 kernel/smpboot.c:160
 kthread+0x221/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff88811ae25228 of 8 bytes by task 6644 on cpu 0:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1510
 find_get_entry mm/filemap.c:2081 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2348
 __filemap_fdatawait_range mm/filemap.c:523 [inline]
 filemap_write_and_wait_range+0x1f5/0x370 mm/filemap.c:692
 direct_write_fallback+0x73/0x100 fs/libfs.c:2099
 __generic_file_write_iter+0xfd/0x120 mm/filemap.c:4471
 generic_file_write_iter+0x77/0x1f0 mm/filemap.c:4501
 do_iter_readv_writev+0x4f6/0x5a0 fs/read_write.c:-1
 vfs_writev+0x2d1/0x8b0 fs/read_write.c:1058
 do_pwritev fs/read_write.c:1154 [inline]
 __do_sys_pwritev2 fs/read_write.c:1212 [inline]
 __se_sys_pwritev2+0xfc/0x1c0 fs/read_write.c:1203
 __x64_sys_pwritev2+0x67/0x80 fs/read_write.c:1203
 x64_sys_call+0xe07/0x3020 arch/x86/include/generated/asm/syscalls_64.h:329
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xfffff80000000000 -> 0xffe0000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6644 Comm: syz.3.1094 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
==================================================================

Crashes (5454):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/24 00:54 upstream d326f83e819c 544adce9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/23 22:47 upstream d326f83e819c 71a13572 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/23 13:41 upstream 4539944e5151 71a13572 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/23 04:13 upstream 4539944e5151 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/22 11:19 upstream 248951ddc14d 4a865b71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/21 22:42 upstream 248951ddc14d b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/21 19:27 upstream 248951ddc14d 7c5de9c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/21 07:46 upstream b95f03f04d47 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/20 11:24 upstream 1590cf032971 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/19 21:29 upstream 82a47586c0b9 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/18 20:50 upstream 1229e2e57a5c 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/18 09:31 upstream 94515f3a7d42 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/17 17:45 upstream 111e7b23e5b0 8aaff637 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/17 16:43 upstream fce2dfa773ce 8aaff637 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/16 12:55 upstream 37e2f878a7a6 71b49442 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/16 06:32 upstream 37e2f878a7a6 27a8bd60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/15 23:28 upstream 58717b2a1365 27a8bd60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/14 01:33 upstream 3b029c035b34 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/13 13:25 upstream a13c140cc289 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/13 10:04 upstream a13c140cc289 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/13 03:49 upstream f4fb100039e9 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/12 09:01 upstream 44696aa3a489 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/11 20:03 upstream dd3210c47e8d d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/10 18:14 upstream d96fcfe1b7f9 99e64375 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/10 02:56 upstream a635d6748234 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/09 21:15 upstream 2c7c88a412aa a0c310a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/09 13:21 upstream 0e35b9b6ec0f a0c310a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/08 10:52 upstream 0e35b9b6ec0f 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/07 17:34 upstream 0e35b9b6ec0f 76cdc0c0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/07 05:41 upstream 0e35b9b6ec0f 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/07 00:15 upstream 8cdeaa50eae8 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/06 16:17 upstream 8cdeaa50eae8 88b240e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/06 07:14 upstream 8cdeaa50eae8 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/05 17:03 upstream f105f3631d51 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/05 00:11 upstream 7404ce516372 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/04 10:49 upstream 1e9cdc2ea15a fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/03 19:51 upstream 71dfdfb0209b 58bf2096 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/03 06:53 upstream 51512e22efe8 58bf2096 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/02 19:27 upstream 4a50a141f05a 2b70b115 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/02 01:21 upstream 4a50a141f05a 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/01 17:26 upstream 665159e24674 27192279 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/07/01 05:38 upstream 665159e24674 00a5cf1c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/06/30 17:58 upstream dc59e4fea9d8 00e8b0fd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/06/30 01:57 upstream dc59e4fea9d8 fff8d0a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/05/31 13:28 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/05/14 17:50 upstream 66182ca873a4 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/03/07 00:29 upstream 651690480a96 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/02/24 10:41 upstream 7dff99b35460 96b1aa46 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2026/01/09 20:12 upstream 372800cb95a3 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2021/06/26 05:21 upstream b7050b242430 9d2ab5df .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2021/06/22 18:45 upstream 0c18f29aae7c aba2b2fb .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
2021/06/07 18:41 upstream 614124bea77e b718257f .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __xa_clear_mark / xas_find_marked
* Struck through repros no longer work on HEAD.