syzbot


KCSAN: data-race in xas_find_marked / xas_init_marks (6)

Status: moderation: reported on 2025/09/05 07:35
Subsystems: ext4 mm
[Documentation on labels]
Reported-by: syzbot+6dd7d6284327c0bf326f@syzkaller.appspotmail.com
First crash: 95d, last: 27d
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (3) ext4 6 1 473d 473d 0/29 auto-obsoleted due to no activity on 2024/09/27 13:38
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (2) ext4 6 820 505d 1652d 0/29 auto-obsoleted due to no activity on 2024/08/19 12:59
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (5) mm 6 7 158d 264d 0/29 auto-obsoleted due to no activity on 2025/08/29 12:06
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (4) ext4 exfat 6 5 396d 421d 0/29 auto-obsoleted due to no activity on 2025/01/03 11:34
upstream KCSAN: data-race in xas_find_marked / xas_init_marks ext4 6 11 1874d 1965d 0/29 auto-closed as invalid on 2020/11/26 04:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff888109b04910 of 8 bytes by task 8837 on cpu 0:
 instrument_read_write include/linux/instrumented.h:55 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x3cf/0xce0 lib/xarray.c:817
 page_cache_delete_batch mm/filemap.c:313 [inline]
 delete_from_page_cache_batch+0x30a/0x6f0 mm/filemap.c:335
 truncate_inode_pages_range+0x1ba/0x780 mm/truncate.c:405
 truncate_inode_pages mm/truncate.c:485 [inline]
 truncate_pagecache+0x53/0x70 mm/truncate.c:794
 ext4_setattr+0xa2e/0xfd0 fs/ext4/inode.c:6017
 notify_change+0x872/0x8f0 fs/attr.c:546
 do_truncate+0x13b/0x180 fs/open.c:68
 handle_truncate fs/namei.c:3596 [inline]
 do_open fs/namei.c:3979 [inline]
 path_openat+0x1d8c/0x2170 fs/namei.c:4134
 do_filp_open+0x109/0x230 fs/namei.c:4161
 do_sys_openat2+0xa6/0x110 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_creat fs/open.c:1530 [inline]
 __se_sys_creat fs/open.c:1524 [inline]
 __x64_sys_creat+0x65/0x90 fs/open.c:1524
 x64_sys_call+0x2da3/0x3000 arch/x86/include/generated/asm/syscalls_64.h:86
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888109b04910 of 8 bytes by task 7849 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x218/0x620 lib/xarray.c:1510
 find_get_entry+0x5d/0x380 mm/filemap.c:2070
 filemap_get_folios_tag+0x13b/0x210 mm/filemap.c:2338
 mpage_prepare_extent_to_map+0x320/0xc00 fs/ext4/inode.c:2637
 ext4_do_writepages+0x708/0x2750 fs/ext4/inode.c:2877
 ext4_writepages+0x176/0x300 fs/ext4/inode.c:3025
 do_writepages+0x1c6/0x310 mm/page-writeback.c:2604
 __writeback_single_inode+0x80/0x7c0 fs/fs-writeback.c:1719
 writeback_sb_inodes+0x48f/0xa30 fs/fs-writeback.c:2015
 wb_writeback+0x252/0x5c0 fs/fs-writeback.c:2195
 wb_do_writeback fs/fs-writeback.c:2342 [inline]
 wb_workfn+0x194/0x910 fs/fs-writeback.c:2382
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3346
 worker_thread+0x582/0x770 kernel/workqueue.c:3427
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x122/0x1b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0xffffffffe0000000 -> 0xf000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7849 Comm: kworker/u8:21 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: writeback wb_workfn (flush-7:0)
==================================================================

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/11 23:53 upstream 24172e0d7990 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/08 13:37 upstream e811c33b1f13 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/05 20:29 upstream 1c353dc8d962 a6c9c731 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/11 23:56 upstream 67029a49db6c ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/10 04:38 upstream 5472d60c129f ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/09 04:49 upstream cd5a0afbdf80 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/07 11:09 upstream c746c3b51698 8ef35d49 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:58 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:57 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/04 11:00 upstream cbf33b8e0b36 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/29 11:28 upstream e5f0a698b34e 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/05 07:34 upstream d69eb204c255 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
* Struck through repros no longer work on HEAD.