syzbot


KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic (4)

Status: moderation: reported on 2026/06/19 06:18
Subsystems: mm
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+c1f41ee8f2d54c6194eb@syzkaller.appspotmail.com
First crash: 4d03h, last: 1d07h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
2928a602-6605-45d2-b49f-5c75e654d70c assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic (4) 2026/06/21 00:42 2026/06/21 00:42 2026/06/21 00:55 43bfcdb07c3552e4664e1029672054ac0924d543

			
		
f5d9d488-5248-4c30-a872-7b1c6cdcb539 assessment-kcsan Benign: ✅ KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic (4) 2026/06/19 06:18 2026/06/19 06:18 2026/06/19 06:42 d7ffd47b8f76bd5cf05ca432102140d6c277a065

			
		
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic (3) mm 6 2 113d 158d 0/29 auto-obsoleted due to no activity on 2026/04/27 02:12
upstream KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic (2) mm 6 5 228d 247d 0/29 auto-obsoleted due to no activity on 2026/01/02 09:15
upstream KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic mm 6 2 324d 376d 0/29 auto-obsoleted due to no activity on 2025/09/28 04:36

Sample crash report:
==================================================================
BUG: KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic

read to 0xffff8881244ac30c of 6 bytes by task 8695 on cpu 0:
 memcpy_to_iter lib/iov_iter.c:77 [inline]
 iterate_bvec include/linux/iov_iter.h:123 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:306 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0x605/0xea0 lib/iov_iter.c:197
 copy_page_to_iter+0x174/0x210 lib/iov_iter.c:374
 copy_folio_to_iter include/linux/uio.h:204 [inline]
 shmem_file_read_iter+0x29c/0x4b0 mm/shmem.c:3362
 copy_splice_read+0x47a/0x6b0 fs/splice.c:362
 do_splice_read fs/splice.c:979 [inline]
 splice_direct_to_actor+0x27c/0x680 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff8881244ac30c of 12 bytes by task 8694 on cpu 1:
 memcpy_from_iter lib/iov_iter.c:85 [inline]
 iterate_bvec include/linux/iov_iter.h:123 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:306 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 __copy_from_iter lib/iov_iter.c:261 [inline]
 copy_folio_from_iter_atomic+0x728/0x10a0 lib/iov_iter.c:491
 generic_perform_write+0x2c4/0x490 mm/filemap.c:4381
 shmem_file_write_iter+0xc5/0xf0 mm/shmem.c:3414
 iter_file_splice_write+0x6a0/0xa60 fs/splice.c:736
 do_splice_from fs/splice.c:936 [inline]
 direct_splice_actor+0x156/0x280 fs/splice.c:1159
 splice_direct_to_actor+0x2f9/0x680 fs/splice.c:1103
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8694 Comm: syz.4.1401 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/22 01:33 upstream 8cd8cf7a07e5 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic
2026/06/19 06:18 upstream 83f1454877cc a776b0d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in _copy_to_iter / copy_folio_from_iter_atomic
* Struck through repros no longer work on HEAD.