syzbot


KCSAN: data-race in _copy_to_iter / memcpy_and_pad (2)

Status: moderation: reported on 2025/09/07 18:11
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+7a4ccac88a3cc49e3b8b@syzkaller.appspotmail.com
First crash: 21h54m, last: 8h49m
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in _copy_to_iter / memcpy_and_pad block 6 2 108d 110d 0/29 auto-obsoleted due to no activity on 2025/07/17 19:38

Sample crash report:
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
==================================================================
BUG: KCSAN: data-race in _copy_to_iter / memcpy_and_pad

read to 0xffff88810ffa5400 of 1024 bytes by task 8657 on cpu 1:
 instrument_copy_to_user include/linux/instrumented.h:113 [inline]
 copy_to_user_iter lib/iov_iter.c:24 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0x130/0xe70 lib/iov_iter.c:185
 copy_page_to_iter+0x18f/0x2d0 lib/iov_iter.c:362
 copy_folio_to_iter include/linux/uio.h:204 [inline]
 filemap_read+0x407/0xa00 mm/filemap.c:2763
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:849
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x27bc/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88810ffa55ef of 17 bytes by task 8744 on cpu 0:
 memcpy_and_pad+0x5a/0x80 lib/string_helpers.c:1008
 ext4_update_super+0x790/0xb70 fs/ext4/super.c:6171
 ext4_commit_super+0x40/0x280 fs/ext4/super.c:6199
 ext4_handle_error+0x451/0x550 fs/ext4/super.c:709
 __ext4_error_inode+0x1e3/0x3f0 fs/ext4/super.c:852
 __check_block_validity fs/ext4/inode.c:390 [inline]
 ext4_map_blocks+0xa14/0xd00 fs/ext4/inode.c:-1
 ext4_mpage_readpages+0x652/0xf10 fs/ext4/readpage.c:295
 ext4_read_folio+0xc0/0x190 fs/ext4/inode.c:3393
 filemap_read_folio+0x2b/0x110 mm/filemap.c:2413
 filemap_fault+0x56a/0xb40 mm/filemap.c:3537
 __do_fault+0xb9/0x200 mm/memory.c:5152
 do_read_fault mm/memory.c:5573 [inline]
 do_fault mm/memory.c:5707 [inline]
 do_pte_missing mm/memory.c:4234 [inline]
 handle_pte_fault mm/memory.c:6052 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0xf78/0x2c20 mm/memory.c:6364
 faultin_page mm/gup.c:1144 [inline]
 __get_user_pages+0x102e/0x1fa0 mm/gup.c:1446
 populate_vma_page_range mm/gup.c:1880 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:1983
 mm_populate include/linux/mm.h:3367 [inline]
 vm_mmap_pgoff+0x232/0x2e0 mm/util.c:585
 ksys_mmap_pgoff+0x268/0x310 mm/mmap.c:604
 x64_sys_call+0x14a3/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 8744 Comm: syz.4.1724 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)
EXT4-fs error (device loop4): ext4_map_blocks:778: inode #15: block 3: comm syz.4.1724: lblock 3 mapped to illegal pblock 3 (length 1)

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/08 07:16 upstream 76eeb9b8de98 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in _copy_to_iter / memcpy_and_pad
2025/09/07 18:10 upstream 6ab41fca2e80 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in _copy_to_iter / memcpy_and_pad
* Struck through repros no longer work on HEAD.