syzbot


KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (4)

Status: moderation: reported on 2025/03/29 00:44
Subsystems: iomap mm
[Documentation on labels]
Reported-by: syzbot+77fc12ba43c71e3d4802@syzkaller.appspotmail.com
First crash: 48d, last: 2d04h
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (2) mm 4 901d 946d 0/28 auto-obsoleted due to no activity on 2023/01/03 00:13
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range (3) mm 75 340d 524d 0/28 auto-obsoleted due to no activity on 2024/07/14 21:23
upstream KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range iomap 5 1167d 1216d 0/28 auto-closed as invalid on 2022/04/09 14:24

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range

read-write to 0xffff888105740760 of 8 bytes by task 12133 on cpu 1:
 page_cache_delete mm/filemap.c:146 [inline]
 __filemap_remove_folio+0x1bc/0x2a0 mm/filemap.c:224
 folio_unmap_invalidate+0x1dd/0x360 mm/truncate.c:618
 invalidate_inode_pages2_range+0x27c/0x3d0 mm/truncate.c:693
 filemap_invalidate_pages+0x16d/0x1a0 mm/filemap.c:2817
 kiocb_invalidate_pages+0x6e/0x80 mm/filemap.c:2825
 __iomap_dio_rw+0x5d4/0x1250 fs/iomap/direct-io.c:703
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:823
 ext4_dio_write_iter fs/ext4/file.c:575 [inline]
 ext4_file_write_iter+0xad9/0xf00 fs/ext4/file.c:716
 iter_file_splice_write+0x5ef/0x970 fs/splice.c:738
 do_splice_from fs/splice.c:935 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1158
 splice_direct_to_actor+0x312/0x680 fs/splice.c:1102
 do_splice_direct_actor fs/splice.c:1201 [inline]
 do_splice_direct+0xda/0x150 fs/splice.c:1227
 do_sendfile+0x380/0x640 fs/read_write.c:1368
 __do_sys_sendfile64 fs/read_write.c:1429 [inline]
 __se_sys_sendfile64 fs/read_write.c:1415 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1415
 x64_sys_call+0xb39/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888105740760 of 8 bytes by task 12147 on cpu 0:
 mapping_needs_writeback mm/filemap.c:641 [inline]
 filemap_write_and_wait_range+0x59/0x340 mm/filemap.c:690
 ext4_dio_write_iter fs/ext4/file.c:621 [inline]
 ext4_file_write_iter+0xe04/0xf00 fs/ext4/file.c:716
 iter_file_splice_write+0x5ef/0x970 fs/splice.c:738
 do_splice_from fs/splice.c:935 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1158
 splice_direct_to_actor+0x312/0x680 fs/splice.c:1102
 do_splice_direct_actor fs/splice.c:1201 [inline]
 do_splice_direct+0xda/0x150 fs/splice.c:1227
 do_sendfile+0x380/0x640 fs/read_write.c:1368
 __do_sys_sendfile64 fs/read_write.c:1429 [inline]
 __se_sys_sendfile64 fs/read_write.c:1415 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1415
 x64_sys_call+0xb39/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000001 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 12147 Comm: syz.4.23563 Not tainted 6.15.0-rc6-syzkaller-00051-g405e6c37c89e #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/13 22:07 upstream 405e6c37c89e 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/05/13 21:50 upstream 405e6c37c89e 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/03/31 00:28 upstream aa918db707fb d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/03/29 22:18 upstream 7d06015d936c d3999433 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
2025/03/29 00:43 upstream 15cb9a2b66fc 9a1a9e31 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / filemap_write_and_wait_range
* Struck through repros no longer work on HEAD.