KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (10)

Status: moderation: reported C repro on 2026/08/25 03:54
Subsystems: ext4
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+7528a49543144ca596b7@syzkaller.appspotmail.com
First crash: 46d, last: 5d14h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
2c6c288e repro-c Reproduced: ✅ ❓ KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (10) 2026/09/27 11:12 2026/09/27 11:12 2026/09/27 11:57 a3c7249d
9ca60458 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (10) 2026/08/27 01:11 2026/08/27 01:11 2026/08/27 01:25 a2b77b9e
e83f8aa9 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (10) 2026/08/25 03:54 2026/08/25 03:54 2026/08/25 04:26 23caa175
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (4) ext4 6 80 894d 1038d 0/29 auto-obsoleted due to no activity on 2024/06/03 21:44
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (8) ext4 6 9 311d 482d 0/29 auto-obsoleted due to no activity on 2026/01/28 21:28
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (3) fs 6 1 1330d 1330d 0/29 auto-obsoleted due to no activity on 2023/04/01 03:15
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (5) ext4 6 13 720d 837d 0/29 auto-obsoleted due to no activity on 2024/11/24 11:50
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru fs 6 14 2439d 2505d 0/29 auto-closed as invalid on 2020/04/15 20:03
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (2) ext4 exfat 6 213 1375d 1835d 0/29 auto-obsoleted due to no activity on 2023/02/08 20:39
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (6) ext4 6 1 682d 682d 0/29 auto-obsoleted due to no activity on 2025/01/22 20:51
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (7) ext4 6 6 544d 617d 0/29 auto-obsoleted due to no activity on 2025/06/09 21:46
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (9) prio:high ext4 6 6 122d 240d 0/29 auto-obsoleted due to no activity on 2026/08/05 13:03
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/27 12:08 10m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fddfc3ec31799a932bb92f1b8a84cb3d1f963be9 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru

write to 0xffff888237c277e0 of 8 bytes by task 3638 on cpu 0:
 __invalidate_bh_lrus fs/buffer.c:1414 [inline]
 invalidate_bh_lru+0x8a/0xf0 fs/buffer.c:1426
 csd_do_func kernel/smp.c:143 [inline]
 smp_call_function_many_cond+0x72e/0xbc0 kernel/smp.c:983
 on_each_cpu_cond_mask+0x35/0x50 kernel/smp.c:1169
 on_each_cpu_cond include/linux/smp.h:105 [inline]
 invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1445
 invalidate_bdev+0x42/0x70 block/bdev.c:99
 __ext4_fill_super fs/ext4/super.c:5830 [inline]
 ext4_fill_super+0x2ccb/0x37b0 fs/ext4/super.c:5855
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1872
 get_tree_bdev+0x1f/0x30 fs/super.c:1895
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5887
 vfs_get_tree+0x57/0x1d0 fs/super.c:1932
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3772 [inline]
 do_new_mount+0x288/0x8d0 fs/namespace.c:3848
 path_mount+0x4ad/0xb90 fs/namespace.c:4168
 do_mount fs/namespace.c:4181 [inline]
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4374
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4374
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c277e0 of 8 bytes by task 3639 on cpu 1:
 has_bh_in_lru+0x35/0x1f0 fs/buffer.c:1436
 cpu_needs_drain mm/folio.c:768 [inline]
 __lru_add_drain_all+0x2c1/0x520 mm/folio.c:860
 lru_cache_disable+0x1f/0x30 mm/folio.c:960
 do_mbind mm/mempolicy.c:1534 [inline]
 kernel_mbind mm/mempolicy.c:1760 [inline]
 __do_sys_mbind mm/mempolicy.c:1834 [inline]
 __se_sys_mbind+0x6cd/0xdd0 mm/mempolicy.c:1830
 __x64_sys_mbind+0x78/0x90 mm/mempolicy.c:1830
 x64_sys_call+0x1d78/0x2550 arch/x86/include/generated/asm/syscalls_64.h:238
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810593bea0 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3639 Comm: syz-executor636 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/27 12:19 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fddfc3ec3179 a3c7249d .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2026/10/05 09:10 upstream a90ee4305c4a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2026/09/26 23:05 upstream fddfc3ec3179 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2026/09/18 18:24 upstream 5dd1818b15d9 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2026/08/25 03:54 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
* Struck through repros no longer work on HEAD.