KCSAN: data-race in xas_clear_mark / xas_find_marked (2)

Status: moderation: reported on 2019/12/10 21:55
Subsystems: mm fs
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+6b653cb0a28eee8c400a@syzkaller.appspotmail.com
First crash: 2484d, last: 20h00m
✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
17d15640 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/05/18 06:10 2026/05/18 06:10 2026/05/18 06:48 de5aae85
7d0095a6 repro KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/03/08 10:38 2026/03/08 10:38 2026/03/08 10:41 31e9c887
f45266b7 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/02/24 23:23 2026/02/24 23:23 2026/02/24 23:26 305c0ec5
20dbd26a assessment-kcsan 💥 KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/01/10 06:45 2026/01/10 06:45 2026/01/10 07:03 75199160
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_clear_mark / xas_find_marked mm 6 3 2489d 2495d 0/29 closed as invalid on 2019/10/18 14:11

Sample crash report:
FAT-fs (loop4): error, invalid access to FAT (entry 0x00000001)
FAT-fs (loop4): Filesystem has been set read-only
==================================================================
BUG: KCSAN: data-race in xas_clear_mark / xas_find_marked

read-write to 0xffff888107becfe8 of 8 bytes by task 3515 on cpu 1:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark+0x91/0x180 lib/xarray.c:922
 __folio_start_writeback+0x257/0x350 mm/page-writeback.c:3034
 __block_write_full_folio+0x526/0x8d0 fs/buffer.c:1905
 block_write_full_folio+0x2c1/0x2e0 fs/buffer.c:-1
 blkdev_writepages+0x88/0x100 block/fops.c:485
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_fdatawrite_range mm/filemap.c:412 [inline]
 filemap_fdatawrite+0x100/0x140 mm/filemap.c:418
 sync_bdevs+0x1a2/0x260 block/bdev.c:1309
 ksys_sync fs/sync.c:105 [inline]
 __ia32_sys_sync+0x81/0xb0 fs/sync.c:111
 x64_sys_call+0x2f3a/0x3020 arch/x86/include/generated/asm/syscalls_64.h:163
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888107becfe8 of 8 bytes by task 3297 on cpu 0:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1510
 find_get_entry mm/filemap.c:2087 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2354
 writeback_get_folio mm/page-writeback.c:2428 [inline]
 writeback_iter+0x48f/0x7c0 mm/page-writeback.c:2529
 blkdev_writepages+0x69/0x100 block/fops.c:484
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_fdatawrite_range mm/filemap.c:412 [inline]
 filemap_write_and_wait_range+0x166/0x370 mm/filemap.c:684
 filemap_write_and_wait include/linux/pagemap.h:65 [inline]
 sync_blockdev+0x35/0x50 block/bdev.c:276
 kill_block_super+0x3c/0x70 fs/super.c:1673
 deactivate_locked_super+0x75/0x1c0 fs/super.c:477
 deactivate_super+0x97/0xa0 fs/super.c:510
 cleanup_mnt+0x2c3/0x340 fs/namespace.c:1317
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1324
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1e4/0x8c0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x23c/0x3c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000001 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3297 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4161):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/10 17:30 upstream db2ddb871435 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/07/27 04:04 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/29 02:30 upstream dc59e4fea9d8 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/22 11:56 upstream ef0c9f75a195 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/11 11:57 upstream 9716c086c8e8 b754d2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/08 01:52 upstream 33d8d8ec31b5 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/06 14:52 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/01 21:17 upstream e43ffb69e043 1095583b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/31 00:09 upstream 9d87d0fc8c8e 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/20 00:13 upstream 27fa82620cba 0909d65f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/13 09:42 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/12 18:35 upstream c21b90f77687 07aeade5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/10 23:20 upstream 5d6919055dec 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/09 22:52 upstream e92b2872d0b1 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/07 17:28 upstream 8ab992f815d6 cbf9e0fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/06 13:20 upstream 74fe02ce122a 1dddfd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/05 23:19 upstream 9207d47f966b 26da2c66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 22:08 upstream c7e4e4d5f7dc a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 18:36 upstream 6d35786de281 85f1bcf2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 07:26 upstream 6d35786de281 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/03 18:07 upstream f377d0025eb0 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/03 10:31 upstream 66edb901bf87 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/01 19:47 upstream 6fe0be6dc7fa 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/01 11:22 upstream 26fd6bff2c05 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/30 05:05 upstream 57b8e2d666a3 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/27 20:50 upstream 254f49634ee1 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/19 11:11 upstream faeab166167f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/12 13:41 upstream f5459048c38a 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/10 12:10 upstream 9a9c8ce300cd 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/09 17:49 upstream 8b02520ec5f7 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/09 04:40 upstream 7f87a5ea75f0 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/05 01:55 upstream 7ca6d1cfec80 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/29 02:41 upstream cbfffcca2bf0 b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/28 06:15 upstream 7df48e363130 356bdfc9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/28 00:02 upstream 7df48e363130 74a13a23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/26 04:03 upstream d2a43e7f89da c6143aac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/17 05:11 upstream 2d1373e4246d 0737c18f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/08 10:26 upstream c23719abc330 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/02 06:55 upstream 39c633261414 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/26 16:45 upstream f4d0ec0aa20d ffa54287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/21 12:02 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/21 04:45 upstream a95f71ad3e2e 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/20 21:12 upstream 8bf22c33e7a1 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/10 04:43 upstream 8a5203c630c6 4ab09a02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/01 02:20 upstream ad9a728a3388 6b8752f2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/01/03 15:10 upstream 805f9a061372 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2021/01/17 10:22 upstream 0da0a8a0a0e1 813be542 .config console log report info ci2-upstream-kcsan-gce
2019/10/22 14:09 https://github.com/google/ktsan.git kcsan 05f2236801fe 4ee855e7 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.