KCSAN: data-race in compaction_alloc / compaction_alloc (2)

Status: moderation: reported on 2026/08/21 23:27
Subsystems: mm
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+18d15018b6d46e76d3c8@syzkaller.appspotmail.com
First crash: 4d21h, last: 4d21h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
e32f1d65 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ✅ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ✅ KCSAN: data-race in compaction_alloc / compaction_alloc (2) 2026/08/23 01:03 2026/08/23 01:03 2026/08/23 01:04 1e72964b
61f2ce0d assessment-kcsan Benign: ✅ KCSAN: data-race in compaction_alloc / compaction_alloc (2) 2026/08/21 23:27 2026/08/21 23:27 2026/08/22 00:00 1e72964b
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in compaction_alloc / compaction_alloc mm 6 78 1960d 2088d 0/29 auto-closed as invalid on 2021/05/19 13:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in compaction_alloc / compaction_alloc

read to 0xffff88823fffab88 of 8 bytes by task 4148 on cpu 1:
 update_pageblock_skip mm/compaction.c:467 [inline]
 isolate_freepages mm/compaction.c:1802 [inline]
 compaction_alloc_noprof mm/compaction.c:1864 [inline]
 compaction_alloc+0x13b3/0x1b80 mm/compaction.c:1894
 migrate_folio_unmap mm/migrate.c:1226 [inline]
 migrate_pages_batch+0x371/0x1c20 mm/migrate.c:1919
 migrate_pages+0x11b4/0x1890 mm/migrate.c:2140
 compact_zone+0x1c99/0x2790 mm/compaction.c:2698
 compact_zone_order mm/compaction.c:2820 [inline]
 try_to_compact_pages+0x349/0x930 mm/compaction.c:2865
 __alloc_pages_direct_compact+0xa2/0x400 mm/page_alloc.c:4185
 __alloc_pages_slowpath+0x286/0x650 mm/page_alloc.c:4946
 __alloc_frozen_pages_noprof+0x31d/0x400 mm/page_alloc.c:5449
 alloc_pages_mpol+0xaf/0x1d0 mm/mempolicy.c:2495
 alloc_frozen_pages_noprof mm/mempolicy.c:2566 [inline]
 alloc_pages_noprof+0x94/0x140 mm/mempolicy.c:2586
 io_mem_alloc_compound io_uring/memmap.c:42 [inline]
 io_region_allocate_pages+0x12d/0x3b0 io_uring/memmap.c:188
 io_create_region+0x2b0/0x330 io_uring/memmap.c:243
 io_allocate_scq_urings+0x114/0x3d0 io_uring/io_uring.c:2736
 io_uring_create+0x2ec/0x4f0 io_uring/io_uring.c:3041
 io_uring_setup io_uring/io_uring.c:3111 [inline]
 __do_sys_io_uring_setup io_uring/io_uring.c:3145 [inline]
 __se_sys_io_uring_setup+0x1cb/0x1e0 io_uring/io_uring.c:3136
 __x64_sys_io_uring_setup+0x31/0x40 io_uring/io_uring.c:3136
 x64_sys_call+0x1fbf/0x2550 arch/x86/include/generated/asm/syscalls_64.h:426
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88823fffab88 of 8 bytes by task 4140 on cpu 0:
 update_pageblock_skip mm/compaction.c:468 [inline]
 isolate_freepages mm/compaction.c:1802 [inline]
 compaction_alloc_noprof mm/compaction.c:1864 [inline]
 compaction_alloc+0x13e9/0x1b80 mm/compaction.c:1894
 migrate_folio_unmap mm/migrate.c:1226 [inline]
 migrate_pages_batch+0x371/0x1c20 mm/migrate.c:1919
 migrate_pages+0x11b4/0x1890 mm/migrate.c:2140
 compact_zone+0x1c99/0x2790 mm/compaction.c:2698
 compact_zone_order mm/compaction.c:2820 [inline]
 try_to_compact_pages+0x349/0x930 mm/compaction.c:2865
 __alloc_pages_direct_compact+0xa2/0x400 mm/page_alloc.c:4185
 __alloc_pages_slowpath+0x286/0x650 mm/page_alloc.c:4946
 __alloc_frozen_pages_noprof+0x31d/0x400 mm/page_alloc.c:5449
 alloc_buddy_frozen_folio mm/hugetlb.c:1798 [inline]
 only_alloc_fresh_hugetlb_folio+0xcc/0x1e0 mm/hugetlb.c:1839
 alloc_pool_huge_folio+0x2ad/0x310 mm/hugetlb.c:1897
 set_max_huge_pages mm/hugetlb.c:3859 [inline]
 __nr_hugepages_store_common+0x594/0xeb0 mm/hugetlb.c:4109
 hugetlb_sysctl_handler_common mm/hugetlb_sysctl.c:47 [inline]
 hugetlb_sysctl_handler+0x111/0x150 mm/hugetlb_sysctl.c:57
 proc_sys_call_handler+0x2ec/0x4a0 fs/proc/proc_sysctl.c:600
 proc_sys_write+0x22/0x30 fs/proc/proc_sysctl.c:626
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_pwrite64 fs/read_write.c:794 [inline]
 __do_sys_pwrite64 fs/read_write.c:802 [inline]
 __se_sys_pwrite64 fs/read_write.c:799 [inline]
 __x64_sys_pwrite64+0xfd/0x150 fs/read_write.c:799
 x64_sys_call+0x23be/0x2550 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000147e00 -> 0x0000000000147200

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4140 Comm: syz.0.184 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/21 23:27 upstream 818bebeb63dd 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in compaction_alloc / compaction_alloc
* Struck through repros no longer work on HEAD.