syzbot


KCSAN: data-race in invalidate_inode_pages2_range / xas_store (3)

Status: moderation: reported on 2025/09/20 14:52
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+ae2cac47a9c553713274@syzkaller.appspotmail.com
First crash: 12h06m, last: 12h06m
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in invalidate_inode_pages2_range / xas_store iomap 6 1 1040d 1040d 0/29 auto-obsoleted due to no activity on 2023/01/02 21:09
upstream KCSAN: data-race in invalidate_inode_pages2_range / xas_store (2) mm 6 1 693d 693d 0/29 auto-obsoleted due to no activity on 2023/12/02 09:12

Sample crash report:
EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode
EXT4-fs (loop6): 1 truncate cleaned up
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
==================================================================
BUG: KCSAN: data-race in invalidate_inode_pages2_range / xas_store

write to 0xffff8881098f76b0 of 8 bytes by task 8457 on cpu 1:
 xas_delete_node lib/xarray.c:506 [inline]
 update_node lib/xarray.c:767 [inline]
 xas_store+0xc77/0xce0 lib/xarray.c:852
 page_cache_delete mm/filemap.c:141 [inline]
 __filemap_remove_folio+0x195/0x2a0 mm/filemap.c:224
 __remove_mapping+0x338/0x460 mm/vmscan.c:813
 remove_mapping+0x22/0x90 mm/vmscan.c:846
 mapping_evict_folio mm/truncate.c:314 [inline]
 mapping_try_invalidate+0x26a/0x3f0 mm/truncate.c:535
 invalidate_mapping_pages+0x27/0x40 mm/truncate.c:577
 ext4_dio_write_iter fs/ext4/file.c:629 [inline]
 ext4_file_write_iter+0xe70/0xf00 fs/ext4/file.c:721
 iter_file_splice_write+0x666/0xa60 fs/splice.c:738
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1161
 splice_direct_to_actor+0x312/0x680 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0xda/0x150 fs/splice.c:1230
 do_sendfile+0x380/0x650 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64 fs/read_write.c:1417 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1417
 x64_sys_call+0x2bb0/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881098f76b0 of 8 bytes by task 8449 on cpu 0:
 xa_empty include/linux/xarray.h:411 [inline]
 mapping_empty include/linux/pagemap.h:145 [inline]
 invalidate_inode_pages2_range+0x43/0x3d0 mm/truncate.c:658
 filemap_invalidate_pages+0x16d/0x1a0 mm/filemap.c:2827
 kiocb_invalidate_pages+0x6e/0x80 mm/filemap.c:2835
 __iomap_dio_rw+0x5d4/0x1250 fs/iomap/direct-io.c:698
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:818
 ext4_dio_write_iter fs/ext4/file.c:580 [inline]
 ext4_file_write_iter+0xad9/0xf00 fs/ext4/file.c:721
 iter_file_splice_write+0x666/0xa60 fs/splice.c:738
 do_splice_from fs/splice.c:938 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1161
 splice_direct_to_actor+0x312/0x680 fs/splice.c:1105
 do_splice_direct_actor fs/splice.c:1204 [inline]
 do_splice_direct+0xda/0x150 fs/splice.c:1230
 do_sendfile+0x380/0x650 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64 fs/read_write.c:1417 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1417
 x64_sys_call+0x2bb0/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810049e492 -> 0xffff8881099f5daa

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 8449 Comm: syz.6.1556 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/20 14:52 upstream cd89d487374c 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in invalidate_inode_pages2_range / xas_store
* Struck through repros no longer work on HEAD.