syzbot


KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (8)

Status: moderation: reported on 2025/04/27 19:20
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+c0029a42ecaf45327127@syzkaller.appspotmail.com
First crash: 52d, last: 6d20h
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (7) mm 10 303d 285d 0/29 auto-obsoleted due to no activity on 2024/09/23 07:15
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (5) mm 8 626d 722d 0/29 auto-obsoleted due to no activity on 2023/11/06 01:09
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (3) fs mm 3 820d 837d 0/29 auto-obsoleted due to no activity on 2023/04/29 19:41
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead fs 7 1240d 1314d 0/29 auto-closed as invalid on 2022/03/01 21:22
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (2) fs 1 1025d 1025d 0/29 auto-closed as invalid on 2022/10/02 20:33
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (6) fs mm 5 441d 536d 0/29 auto-obsoleted due to no activity on 2024/05/08 09:54
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (4) fs 1 779d 779d 0/29 auto-obsoleted due to no activity on 2023/06/06 03:32

Sample crash report:
EXT4-fs: Ignoring removed nobh option
EXT4-fs: Ignoring removed bh option
EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
==================================================================
BUG: KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead

write to 0xffff888115b092d0 of 8 bytes by task 7082 on cpu 1:
 do_sync_mmap_readahead+0x204/0x280 mm/filemap.c:3267
 filemap_fault+0x311/0xb40 mm/filemap.c:3412
 __do_fault+0xb9/0x200 mm/memory.c:5189
 do_read_fault mm/memory.c:5610 [inline]
 do_fault mm/memory.c:5744 [inline]
 do_pte_missing mm/memory.c:4251 [inline]
 handle_pte_fault mm/memory.c:6089 [inline]
 __handle_mm_fault mm/memory.c:6232 [inline]
 handle_mm_fault+0xf78/0x2be0 mm/memory.c:6401
 faultin_page mm/gup.c:1186 [inline]
 __get_user_pages+0x1036/0x1fb0 mm/gup.c:1488
 populate_vma_page_range mm/gup.c:1926 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:2029
 mm_populate include/linux/mm.h:3348 [inline]
 do_mremap mm/mremap.c:1733 [inline]
 __do_sys_mremap mm/mremap.c:1782 [inline]
 __se_sys_mremap+0x640/0x6f0 mm/mremap.c:1750
 __x64_sys_mremap+0x67/0x80 mm/mremap.c:1750
 x64_sys_call+0x2ba9/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:26
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888115b092d0 of 8 bytes by task 7076 on cpu 0:
 do_sync_mmap_readahead+0x204/0x280 mm/filemap.c:3267
 filemap_fault+0x311/0xb40 mm/filemap.c:3412
 __do_fault+0xb9/0x200 mm/memory.c:5189
 do_read_fault mm/memory.c:5610 [inline]
 do_fault mm/memory.c:5744 [inline]
 do_pte_missing mm/memory.c:4251 [inline]
 handle_pte_fault mm/memory.c:6089 [inline]
 __handle_mm_fault mm/memory.c:6232 [inline]
 handle_mm_fault+0xf78/0x2be0 mm/memory.c:6401
 faultin_page mm/gup.c:1186 [inline]
 __get_user_pages+0x1036/0x1fb0 mm/gup.c:1488
 populate_vma_page_range mm/gup.c:1926 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:2029
 mm_populate include/linux/mm.h:3348 [inline]
 vm_mmap_pgoff+0x232/0x2e0 mm/util.c:584
 ksys_mmap_pgoff+0x268/0x310 mm/mmap.c:607
 x64_sys_call+0x1602/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000208 -> 0x0000000000000209

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 7076 Comm: syz.2.1452 Not tainted 6.16.0-rc1-syzkaller-00010-g2c4a1f3fe03e #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/12 10:44 upstream 2c4a1f3fe03e 98683f8f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2025/04/27 19:20 upstream 5bc1018675ec c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
* Struck through repros no longer work on HEAD.