syzbot


KCSAN: data-race in copy_mm / vma_complete (3)

Status: moderation: reported on 2025/12/25 21:31
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+066a77caae64cfbe489b@syzkaller.appspotmail.com
First crash: 74d, last: 13d
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision Error
81d1daae-a237-45cc-ad52-b2a7ac6c48ac repro KCSAN: data-race in copy_mm / vma_complete (3) 2026/03/06 08:06 2026/03/06 08:06 2026/03/06 08:12 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
6c447e44-8586-4489-b7dc-9046e40fd420 assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in copy_mm / vma_complete (3) 2026/02/24 16:28 2026/02/24 16:28 2026/02/24 16:38 305c0ec5cd886e2d13738e28e1b2df9b0ec20fc9
0347f06f-74f8-4358-96a7-943e446d3a39 assessment-kcsan 💥 KCSAN: data-race in copy_mm / vma_complete (3) 2026/01/09 14:37 2026/01/09 14:37 2026/01/09 14:44 9ee25c60da3366005e31dedd1574732f63338151 failed to load compile commands: open /usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/7ffad2d1b4c012e183a43a3b7f53967af1807613/compile_commands.json: no such file or directory
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in copy_mm / vma_complete mm 6 1 242d 242d 0/29 auto-obsoleted due to no activity on 2025/09/04 07:42
upstream KCSAN: data-race in copy_mm / vma_complete (2) mm 6 2 130d 146d 0/29 auto-obsoleted due to no activity on 2025/12/25 08:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in copy_mm / vma_complete

read-write to 0xffff88810acf0f08 of 4 bytes by task 8842 on cpu 0:
 vma_complete+0x3e1/0x850 mm/vma.c:357
 __split_vma+0x5db/0x640 mm/vma.c:566
 split_vma mm/vma.c:596 [inline]
 vma_modify+0xbc9/0xd00 mm/vma.c:1680
 vma_modify_flags+0x182/0x210 mm/vma.c:1700
 mprotect_fixup+0x312/0x5d0 mm/mprotect.c:756
 do_mprotect_pkey+0x67b/0x920 mm/mprotect.c:930
 __do_sys_mprotect mm/mprotect.c:951 [inline]
 __se_sys_mprotect mm/mprotect.c:948 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:948
 x64_sys_call+0x2768/0x3020 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810acf0d80 of 1664 bytes by task 8845 on cpu 1:
 dup_mm kernel/fork.c:1524 [inline]
 copy_mm+0xe1/0x370 kernel/fork.c:1582
 copy_process+0xe22/0x20d0 kernel/fork.c:2223
 kernel_clone+0x16b/0x5d0 kernel/fork.c:2654
 __do_sys_clone kernel/fork.c:2795 [inline]
 __se_sys_clone kernel/fork.c:2779 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2779
 x64_sys_call+0x1222/0x3020 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8845 Comm: syz.4.1621 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/25 05:30 upstream 7dff99b35460 787dfb7c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / vma_complete
2026/01/18 01:45 upstream d3eeb99bbc99 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / vma_complete
2026/01/09 16:27 upstream 623fb9912f6a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / vma_complete
2025/12/25 21:30 upstream ccd1cdca5cd4 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / vma_complete
* Struck through repros no longer work on HEAD.