syzbot


KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (4)

Status: moderation: reported on 2025/03/29 00:44
Subsystems: iomap
[Documentation on labels]
Reported-by: syzbot+77fc12ba43c71e3d4802@syzkaller.appspotmail.com
First crash: 26d, last: 24d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (2) mm 4 879d 924d 0/28 auto-obsoleted due to no activity on 2023/01/03 00:13
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (3) mm 75 318d 502d 0/28 auto-obsoleted due to no activity on 2024/07/14 21:23
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range iomap 5 1145d 1194d 0/28 auto-closed as invalid on 2022/04/09 14:24

Sample crash report:
EXT4-fs (loop7): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
==================================================================
BUG: KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range

read-write to 0xffff888104fb6ae0 of 8 bytes by task 18057 on cpu 1:
 page_cache_delete mm/filemap.c:146 [inline]
 __filemap_remove_folio+0x1c7/0x2c0 mm/filemap.c:224
 folio_unmap_invalidate+0x1d5/0x350 mm/truncate.c:569
 invalidate_inode_pages2_range+0x293/0x400 mm/truncate.c:644
 filemap_invalidate_pages+0x16f/0x1a0 mm/filemap.c:2828
 kiocb_invalidate_pages+0x6c/0x80 mm/filemap.c:2836
 __iomap_dio_rw+0x5d4/0x12a0 fs/iomap/direct-io.c:703
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:823
 ext4_dio_write_iter fs/ext4/file.c:575 [inline]
 ext4_file_write_iter+0xba9/0xf80 fs/ext4/file.c:716
 iter_file_splice_write+0x5f2/0x980 fs/splice.c:738
 do_splice_from fs/splice.c:935 [inline]
 direct_splice_actor+0x160/0x2c0 fs/splice.c:1158
 splice_direct_to_actor+0x305/0x680 fs/splice.c:1102
 do_splice_direct_actor fs/splice.c:1201 [inline]
 do_splice_direct+0xd9/0x150 fs/splice.c:1227
 do_sendfile+0x40a/0x690 fs/read_write.c:1368
 __do_sys_sendfile64 fs/read_write.c:1429 [inline]
 __se_sys_sendfile64 fs/read_write.c:1415 [inline]
 __x64_sys_sendfile64+0x113/0x160 fs/read_write.c:1415
 x64_sys_call+0xfc3/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104fb6ae0 of 8 bytes by task 18043 on cpu 0:
 mapping_needs_writeback mm/filemap.c:644 [inline]
 filemap_write_and_wait_range+0x5c/0x370 mm/filemap.c:693
 ext4_dio_write_iter fs/ext4/file.c:621 [inline]
 ext4_file_write_iter+0xe89/0xf80 fs/ext4/file.c:716
 iter_file_splice_write+0x5f2/0x980 fs/splice.c:738
 do_splice_from fs/splice.c:935 [inline]
 direct_splice_actor+0x160/0x2c0 fs/splice.c:1158
 splice_direct_to_actor+0x305/0x680 fs/splice.c:1102
 do_splice_direct_actor fs/splice.c:1201 [inline]
 do_splice_direct+0xd9/0x150 fs/splice.c:1227
 do_sendfile+0x40a/0x690 fs/read_write.c:1368
 __do_sys_sendfile64 fs/read_write.c:1429 [inline]
 __se_sys_sendfile64 fs/read_write.c:1415 [inline]
 __x64_sys_sendfile64+0x113/0x160 fs/read_write.c:1415
 x64_sys_call+0xfc3/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000001 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 18043 Comm: syz.7.4897 Not tainted 6.14.0-syzkaller-10764-gaa918db707fb #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/31 00:28 upstream aa918db707fb d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/03/29 22:18 upstream 7d06015d936c d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/03/29 00:43 upstream 15cb9a2b66fc 9a1a9e31 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
* Struck through repros no longer work on HEAD.