KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync (3)

Status: moderation: reported C repro on 2026/10/13 05:17
Labels: prio:low race:benign
[Documentation on labels]
Reported-by: syzbot+fcf9c67a6e09a80570cc@syzkaller.appspotmail.com
First crash: 4h51m, last: 4h51m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
1d266504 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync (3) 2026/10/13 06:13 2026/10/13 06:13 2026/10/13 06:38 745a967f
d13f5603 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync (3) 2026/10/13 05:36 2026/10/13 05:36 2026/10/13 06:38 745a967f
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync (2) race:benign prio:high exfat 6 1 68d 68d 0/29 auto-obsoleted due to no activity on 2026/09/30 23:59
upstream KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync prio:low exfat 6 1 156d 156d 0/29 auto-obsoleted due to no activity on 2026/07/05 02:31

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync

write to 0xffff888105e1c350 of 8 bytes by task 3644 on cpu 0:
 __remove_assoc_queue fs/buffer.c:473 [inline]
 mmb_sync+0x14d/0x5f0 fs/buffer.c:544
 fat_file_fsync+0xa0/0x100 fs/fat/file.c:197
 vfs_fsync_range fs/sync.c:186 [inline]
 vfs_fsync fs/sync.c:200 [inline]
 do_fsync fs/sync.c:211 [inline]
 __do_sys_fsync fs/sync.c:216 [inline]
 __se_sys_fsync fs/sync.c:214 [inline]
 __x64_sys_fsync+0xc3/0x120 fs/sync.c:214
 x64_sys_call+0x1d2b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:75
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888105e1c350 of 8 bytes by task 3643 on cpu 1:
 mmb_mark_buffer_dirty+0x2d/0x140 fs/buffer.c:625
 fat12_ent_put+0x118/0x180 fs/fat/fatent.c:173
 fat_ent_write+0x6c/0xe0 fs/fat/fatent.c:422
 fat_chain_add+0x170/0x4c0 fs/fat/misc.c:138
 fat_add_cluster fs/fat/inode.c:113 [inline]
 __fat_get_block fs/fat/inode.c:155 [inline]
 fat_get_block+0x468/0x5e0 fs/fat/inode.c:190
 __block_write_begin_int+0x400/0xf90 fs/buffer.c:2030
 block_write_begin fs/buffer.c:2144 [inline]
 cont_write_begin+0x5bf/0x920 fs/buffer.c:2506
 fat_write_begin+0x52/0xe0 fs/fat/inode.c:230
 generic_perform_write+0x186/0x490 mm/filemap.c:4374
 __generic_file_write_iter+0x9e/0x120 mm/filemap.c:4491
 generic_file_write_iter+0x77/0x1f0 mm/filemap.c:4517
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff8881181c8f18 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3643 Comm: syz-executor205 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/13 05:16 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24a19b953e2a a3c7249d .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in mmb_mark_buffer_dirty / mmb_sync
* Struck through repros no longer work on HEAD.