syzbot


KCSAN: data-race in file_update_time / inode_update_timestamps (5)

Status: moderation: reported on 2025/09/11 17:52
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+af364d8777377f6b54bd@syzkaller.appspotmail.com
First crash: 16h00m, last: 16h00m
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in file_update_time / inode_update_timestamps (4) fs 6 1 98d 98d 0/29 auto-obsoleted due to no activity on 2025/08/01 08:04
upstream KCSAN: data-race in file_update_time / inode_update_timestamps (3) fs 6 1 156d 156d 0/29 auto-obsoleted due to no activity on 2025/06/03 16:36
upstream KCSAN: data-race in file_update_time / inode_update_timestamps (2) ext4 6 12 220d 340d 0/29 auto-obsoleted due to no activity on 2025/04/01 04:05
upstream KCSAN: data-race in file_update_time / inode_update_timestamps ext4 6 34 389d 587d 0/29 auto-obsoleted due to no activity on 2024/09/23 06:59

Sample crash report:
==================================================================
BUG: KCSAN: data-race in file_update_time / inode_update_timestamps

read to 0xffff8881198ae444 of 4 bytes by task 10549 on cpu 1:
 inode_get_mtime_nsec include/linux/fs.h:1708 [inline]
 inode_get_mtime include/linux/fs.h:1714 [inline]
 inode_needs_update_time fs/inode.c:2283 [inline]
 file_update_time+0x87/0x2b0 fs/inode.c:2330
 ext4_page_mkwrite+0x18c/0xb90 fs/ext4/inode.c:6704
 do_page_mkwrite mm/memory.c:3361 [inline]
 wp_page_shared mm/memory.c:3762 [inline]
 do_wp_page+0xddb/0x24e0 mm/memory.c:3981
 handle_pte_fault mm/memory.c:6068 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x77d/0x2c20 mm/memory.c:6364
 fixup_user_fault+0x24c/0x560 mm/gup.c:1608
 fault_in_user_writeable+0x5d/0xd0 kernel/futex/core.c:790
 futex_lock_pi+0x597/0x780 kernel/futex/pi.c:1109
 do_futex+0x21f/0x380 kernel/futex/syscalls.c:-1
 __do_sys_futex kernel/futex/syscalls.c:179 [inline]
 __se_sys_futex+0x2ed/0x360 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:160
 x64_sys_call+0x2e39/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:203
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff8881198ae444 of 4 bytes by task 10573 on cpu 0:
 inode_set_mtime_to_ts include/linux/fs.h:1722 [inline]
 inode_update_timestamps+0x147/0x270 fs/inode.c:2021
 generic_update_time fs/inode.c:2056 [inline]
 inode_update_time fs/inode.c:2076 [inline]
 __file_update_time fs/inode.c:2304 [inline]
 file_modified_flags+0x2aa/0x350 fs/inode.c:2375
 file_modified+0x17/0x20 fs/inode.c:2391
 ext4_fallocate+0x18c/0x2f0 fs/ext4/extents.c:4800
 vfs_fallocate+0x3b6/0x400 fs/open.c:342
 madvise_remove mm/madvise.c:1049 [inline]
 madvise_vma_behavior+0x192d/0x1cf0 mm/madvise.c:1346
 madvise_walk_vmas mm/madvise.c:1669 [inline]
 madvise_do_behavior+0x5b7/0x970 mm/madvise.c:1885
 do_madvise+0x10e/0x190 mm/madvise.c:1978
 __do_sys_madvise mm/madvise.c:1987 [inline]
 __se_sys_madvise mm/madvise.c:1985 [inline]
 __x64_sys_madvise+0x64/0x80 mm/madvise.c:1985
 x64_sys_call+0x1f1a/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:29
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x148d5e9e -> 0x179256ca

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10573 Comm: syz.0.2254 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/11 17:52 upstream 02ffd6f89c50 fdeaa69b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in file_update_time / inode_update_timestamps
* Struck through repros no longer work on HEAD.