KCSAN: data-race in xas_find_marked / xas_init_marks (8)

Status: moderation: reported C repro on 2026/09/12 20:25
Subsystems: ext4
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+16f97d0a129419897e44@syzkaller.appspotmail.com
First crash: 25d, last: 5d23h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
c2cecee6 repro-c Reproduced: ✅ ❓ KCSAN: data-race in xas_find_marked / xas_init_marks (8) 2026/10/01 20:30 2026/10/01 20:30 2026/10/01 21:18 6d32eb1f
03bf7571 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in xas_find_marked / xas_init_marks (8) 2026/09/14 00:35 2026/09/14 00:35 2026/09/14 01:03 70a60e12
65e8c3e3 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in xas_find_marked / xas_init_marks (8) 2026/09/12 20:25 2026/09/12 20:25 2026/09/12 21:35 70a60e12
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (6) ext4 mm prio:high 6 19 173d 397d 0/29 auto-obsoleted due to no activity on 2026/06/12 21:01
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (3) ext4 6 1 775d 775d 0/29 auto-obsoleted due to no activity on 2024/09/27 13:38
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (2) ext4 6 820 807d 1954d 0/29 auto-obsoleted due to no activity on 2024/08/19 12:59
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (7) race:benign prio:low ext4 mm 6 2 96d 107d 0/29 auto-obsoleted due to no activity on 2026/08/28 21:13
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (5) mm 6 7 460d 566d 0/29 auto-obsoleted due to no activity on 2025/08/29 12:06
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (4) ext4 exfat 6 5 698d 723d 0/29 auto-obsoleted due to no activity on 2025/01/03 11:34
upstream KCSAN: data-race in xas_find_marked / xas_init_marks ext4 6 11 2176d 2267d 0/29 auto-closed as invalid on 2020/11/26 04:55
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/01 21:59 11m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git d24e8ac715de2e16a53c144005b1863660a5fbea report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff88811a03d6b0 of 8 bytes by task 3640 on cpu 1:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x243/0xce0 lib/xarray.c:817
 page_cache_delete_batch mm/filemap.c:314 [inline]
 delete_from_page_cache_batch+0x324/0x720 mm/filemap.c:336
 truncate_inode_pages_range+0x1f3/0x7d0 mm/truncate.c:405
 truncate_inode_pages mm/truncate.c:485 [inline]
 truncate_pagecache+0x53/0x70 mm/truncate.c:798
 ext4_setattr+0xb71/0x1170 fs/ext4/inode.c:6214
 notify_change+0x842/0x8c0 fs/attr.c:556
 do_truncate fs/open.c:68 [inline]
 do_ftruncate+0x346/0x420 fs/open.c:194
 ksys_ftruncate fs/open.c:206 [inline]
 __do_sys_ftruncate fs/open.c:211 [inline]
 __se_sys_ftruncate fs/open.c:209 [inline]
 __x64_sys_ftruncate+0x65/0xc0 fs/open.c:209
 x64_sys_call+0x99e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:78
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811a03d6b0 of 8 bytes by task 3639 on cpu 0:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1513
 find_get_entry mm/filemap.c:2087 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2353
 mpage_prepare_extent_to_map+0x32a/0xca0 fs/ext4/inode.c:2634
 ext4_do_writepages+0xa10/0x2870 fs/ext4/inode.c:2936
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffffffe000000000 -> 0xff80000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3639 Comm: syz-executor241 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff88811a05e228 of 8 bytes by task 3640 on cpu 1:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x243/0xce0 lib/xarray.c:817
 page_cache_delete_batch mm/filemap.c:314 [inline]
 delete_from_page_cache_batch+0x324/0x720 mm/filemap.c:336
 truncate_inode_pages_range+0x1f3/0x7d0 mm/truncate.c:405
 truncate_inode_pages mm/truncate.c:485 [inline]
 truncate_pagecache+0x53/0x70 mm/truncate.c:798
 ext4_setattr+0xb71/0x1170 fs/ext4/inode.c:6214
 notify_change+0x842/0x8c0 fs/attr.c:556
 do_truncate fs/open.c:68 [inline]
 do_ftruncate+0x346/0x420 fs/open.c:194
 ksys_ftruncate fs/open.c:206 [inline]
 __do_sys_ftruncate fs/open.c:211 [inline]
 __se_sys_ftruncate fs/open.c:209 [inline]
 __x64_sys_ftruncate+0x65/0xc0 fs/open.c:209
 x64_sys_call+0x99e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:78
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811a05e228 of 8 bytes by task 3639 on cpu 0:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1513
 find_get_entry mm/filemap.c:2087 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2353
 mpage_prepare_extent_to_map+0x32a/0xca0 fs/ext4/inode.c:2634
 ext4_do_writepages+0xa10/0x2870 fs/ext4/inode.c:2936
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff000000000000 -> 0xc000000000000000

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/01 22:10 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git d24e8ac715de 70a60e12 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2026/09/12 20:25 upstream 5225b8eec4c9 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
* Struck through repros no longer work on HEAD.