syzbot

map[ReproOpts:threaded=true collide=true repeat=true procs=8 ReproSyz:r0 = syz_mount_image(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000220)='/dev/loop1\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='/dev/loop2\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000260)='/dev/loop3\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop4\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002a0)='/dev/loop5\x00', 0x0, 0x0)
read(r1, &(0x7f0000001000), 0x2000)
read(r2, &(0x7f0000001000), 0x2000)
read(r3, &(0x7f0000001000), 0x2000)
read(r4, &(0x7f0000001000), 0x2000)
read(r5, &(0x7f0000001000), 0x2000)
read(r6, &(0x7f0000001000), 0x2000)
umount2(&(0x7f0000000100)='./mnt\x00', 0x0)
 SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

map[DescriptionFiles:[acpi_thermal_rel.txt aio.txt auto.txt binfmt.txt bpf.txt bpf_prog.txt bpf_trace.txt cgroup.txt damon.txt dev_ashmem.txt dev_bifrost.txt dev_binder.txt dev_binderfs.txt dev_block.txt dev_bsg.txt dev_bus_usb.txt dev_camx.txt dev_cdrom.txt dev_cec.txt dev_char_usb.txt dev_comedi.txt dev_dma_heap.txt dev_dri.txt dev_dsp.txt dev_dvb_demux.txt dev_dvb_dvr.txt dev_dvb_frontend.txt dev_fb.txt dev_floppy.txt dev_hidraw.txt dev_i2c.txt dev_i915.txt dev_img_rogue.txt dev_infiniband_rdma.txt dev_infiniband_rdma_cm.txt dev_input.txt dev_iommu.txt dev_kvm.txt dev_kvm_amd64.txt dev_kvm_arm64.txt dev_kvm_extra.txt dev_kvm_riscv64.txt dev_loop.txt dev_mali.txt dev_media.txt dev_msm.txt dev_msr.txt dev_nbd.txt dev_net_tun.txt dev_panthor.txt dev_ppp.txt dev_ptmx.txt dev_ptp.txt dev_qat_adf_ctl.txt dev_qrtr_tun.txt dev_random.txt dev_rfkill.txt dev_rtc.txt dev_sequencer.txt dev_sg.txt dev_snapshot.txt dev_snd_control.txt dev_snd_hw.txt dev_snd_midi.txt dev_snd_pcm.txt dev_snd_seq.txt dev_snd_timer.txt dev_sr.txt dev_sw_sync.txt dev_tlk_device.txt dev_trusty.txt dev_udmabuf.txt dev_uhid.txt dev_uinput.txt dev_usb_hiddev.txt dev_usbmon.txt dev_userio.txt dev_vfio.txt dev_vga_arbiter.txt dev_vhci.txt dev_video4linux.txt dev_video4linux_vim2m.txt dev_virtual_nci.txt dev_vtpm.txt fanotify.txt filesystem.txt fs_9p.txt fs_fuse.txt fs_incfs.txt fs_ioctl.txt fs_ioctl_autofs.txt fs_ioctl_btrfs.txt fs_ioctl_ext4.txt fs_ioctl_f2fs.txt fs_ioctl_fat.txt fs_ioctl_fscrypt.txt fs_ioctl_fsverity.txt fs_ioctl_xfs.txt futex.txt hafnium.txt inotify.txt io_uring.txt ipc.txt key.txt kfuzztest.txt l2cap.txt landlock.txt lsm.txt namespaces.txt net_80211.txt netfilter.txt netfilter_arp.txt netfilter_bridge.txt netfilter_ipv4.txt netfilter_ipv6.txt netfilter_ipvs.txt netfilter_targets.txt pagemap_ioctl.txt perf.txt prctl.txt quotactl.txt seccomp.txt security_apparmor.txt security_selinux.txt security_smack.txt socket.txt socket_alg.txt socket_ax25.txt socket_bluetooth.txt socket_caif.txt socket_can.txt socket_ieee802154.txt socket_inet.txt socket_inet6.txt socket_inet_dccp.txt socket_inet_icmp.txt socket_inet_igmp.txt socket_inet_l2tp.txt socket_inet_sctp.txt socket_inet_tcp.txt socket_inet_udp.txt socket_ip_tunnel.txt socket_isdn.txt socket_kcm.txt socket_key.txt socket_llc.txt socket_netlink.txt socket_netlink_audit.txt socket_netlink_crypto.txt socket_netlink_generic.txt socket_netlink_generic_80211.txt socket_netlink_generic_batadv.txt socket_netlink_generic_devlink.txt socket_netlink_generic_ethtool.txt socket_netlink_generic_fou.txt socket_netlink_generic_gtp.txt socket_netlink_generic_mptcp.txt socket_netlink_generic_net_dm.txt socket_netlink_generic_netlabel.txt socket_netlink_generic_nfc.txt socket_netlink_generic_seg6.txt socket_netlink_generic_smc.txt socket_netlink_generic_team.txt socket_netlink_generic_wireguard.txt socket_netlink_netfilter.txt socket_netlink_netfilter_acct.txt socket_netlink_netfilter_conntrack.txt socket_netlink_netfilter_conntrack_exp.txt socket_netlink_netfilter_conntrack_helper.txt socket_netlink_netfilter_ipset.txt socket_netlink_netfilter_log.txt socket_netlink_netfilter_nft_compat.txt socket_netlink_netfilter_nftables.txt socket_netlink_netfilter_osf.txt socket_netlink_netfilter_queue.txt socket_netlink_netfilter_timeout.txt socket_netlink_rdma.txt socket_netlink_route.txt socket_netlink_route_sched.txt socket_netlink_route_sched_retired.txt socket_netlink_sock_diag.txt socket_netlink_xfrm.txt socket_netrom.txt socket_nfc.txt socket_nvme_of_tcp.txt socket_packet.txt socket_phonet.txt socket_pppox.txt socket_qipcrtr.txt socket_rds.txt socket_rose.txt socket_rxrpc.txt socket_tipc.txt socket_tipc_netlink.txt socket_unix.txt socket_vnet.txt socket_x25.txt socket_xdp.txt sys.txt uffd.txt usbip.txt vmw_vmci.txt vnet.txt vnet_mptcp.txt vusb.txt watch_queue.txt xattr.txt] SyzkallerCommit:31e9c887f7dc24e04b3ca70d0d54fc34141844b0]

map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/1611f38748b640e9e5b4c46f9ea592ea92d42cb4]

map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/99a0ac09919cc1982b58e96465b94513ea773a44]

gemini-3-pro-preview

map[ReproOpts:threaded=true collide=true repeat=true procs=8]

You are an expert in linux kernel fuzzing. Your goal is to write a syzkaller program to trigger a specific bug.
Print only the syz program that could be executed directly, without backticks.




Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Bug Title: KCSAN: data-race in __filemap_add_folio / filemap_write_and_wait_range

Original Crash Report:
==================================================================
BUG: KCSAN: data-race in __filemap_add_folio / filemap_write_and_wait_range

read-write to 0xffff8881005f1838 of 8 bytes by task 3634 on cpu 1:
 __filemap_add_folio+0x671/0x8b0 mm/filemap.c:919
 filemap_add_folio+0x1d3/0x350 mm/filemap.c:966
 page_cache_ra_unbounded+0x20e/0x450 mm/readahead.c:282
 do_page_cache_ra mm/readahead.c:334 [inline]
 force_page_cache_ra+0x18d/0x1d0 mm/readahead.c:364
 page_cache_sync_ra+0x110/0x560 mm/readahead.c:582
 filemap_get_pages+0x30a/0x1280 mm/filemap.c:2695
 filemap_read+0x231/0xa10 mm/filemap.c:2805
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:855
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x6c0/0x7f0 fs/read_write.c:574
 ksys_read+0xdc/0x1a0 fs/read_write.c:717
 __do_sys_read fs/read_write.c:726 [inline]
 __se_sys_read fs/read_write.c:724 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:724
 x64_sys_call+0x2886/0x3020 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881005f1838 of 8 bytes by task 3320 on cpu 0:
 mapping_needs_writeback mm/filemap.c:634 [inline]
 filemap_write_and_wait_range+0x59/0x370 mm/filemap.c:683
 filemap_write_and_wait include/linux/pagemap.h:65 [inline]
 sync_blockdev+0x35/0x50 block/bdev.c:276
 kill_block_super+0x3c/0x70 fs/super.c:1727
 deactivate_locked_super+0x75/0x1c0 fs/super.c:476
 deactivate_super+0x97/0xa0 fs/super.c:509
 cleanup_mnt+0x2bb/0x330 fs/namespace.c:1312
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1319
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0x1f4/0x6f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x249/0x370 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000003 -> 0x0000000000000004

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3320 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================


The list of existing description files:
acpi_thermal_rel.txt
aio.txt
auto.txt
binfmt.txt
bpf.txt
bpf_prog.txt
bpf_trace.txt
cgroup.txt
damon.txt
dev_ashmem.txt
dev_bifrost.txt
dev_binder.txt
dev_binderfs.txt
dev_block.txt
dev_bsg.txt
dev_bus_usb.txt
dev_camx.txt
dev_cdrom.txt
dev_cec.txt
dev_char_usb.txt
dev_comedi.txt
dev_dma_heap.txt
dev_dri.txt
dev_dsp.txt
dev_dvb_demux.txt
dev_dvb_dvr.txt
dev_dvb_frontend.txt
dev_fb.txt
dev_floppy.txt
dev_hidraw.txt
dev_i2c.txt
dev_i915.txt
dev_img_rogue.txt
dev_infiniband_rdma.txt
dev_infiniband_rdma_cm.txt
dev_input.txt
dev_iommu.txt
dev_kvm.txt
dev_kvm_amd64.txt
dev_kvm_arm64.txt
dev_kvm_extra.txt
dev_kvm_riscv64.txt
dev_loop.txt
dev_mali.txt
dev_media.txt
dev_msm.txt
dev_msr.txt
dev_nbd.txt
dev_net_tun.txt
dev_panthor.txt
dev_ppp.txt
dev_ptmx.txt
dev_ptp.txt
dev_qat_adf_ctl.txt
dev_qrtr_tun.txt
dev_random.txt
dev_rfkill.txt
dev_rtc.txt
dev_sequencer.txt
dev_sg.txt
dev_snapshot.txt
dev_snd_control.txt
dev_snd_hw.txt
dev_snd_midi.txt
dev_snd_pcm.txt
dev_snd_seq.txt
dev_snd_timer.txt
dev_sr.txt
dev_sw_sync.txt
dev_tlk_device.txt
dev_trusty.txt
dev_udmabuf.txt
dev_uhid.txt
dev_uinput.txt
dev_usb_hiddev.txt
dev_usbmon.txt
dev_userio.txt
dev_vfio.txt
dev_vga_arbiter.txt
dev_vhci.txt
dev_video4linux.txt
dev_video4linux_vim2m.txt
dev_virtual_nci.txt
dev_vtpm.txt
fanotify.txt
filesystem.txt
fs_9p.txt
fs_fuse.txt
fs_incfs.txt
fs_ioctl.txt
fs_ioctl_autofs.txt
fs_ioctl_btrfs.txt
fs_ioctl_ext4.txt
fs_ioctl_f2fs.txt
fs_ioctl_fat.txt
fs_ioctl_fscrypt.txt
fs_ioctl_fsverity.txt
fs_ioctl_xfs.txt
futex.txt
hafnium.txt
inotify.txt
io_uring.txt
ipc.txt
key.txt
kfuzztest.txt
l2cap.txt
landlock.txt
lsm.txt
namespaces.txt
net_80211.txt
netfilter.txt
netfilter_arp.txt
netfilter_bridge.txt
netfilter_ipv4.txt
netfilter_ipv6.txt
netfilter_ipvs.txt
netfilter_targets.txt
pagemap_ioctl.txt
perf.txt
prctl.txt
quotactl.txt
seccomp.txt
security_apparmor.txt
security_selinux.txt
security_smack.txt
socket.txt
socket_alg.txt
socket_ax25.txt
socket_bluetooth.txt
socket_caif.txt
socket_can.txt
socket_ieee802154.txt
socket_inet.txt
socket_inet6.txt
socket_inet_dccp.txt
socket_inet_icmp.txt
socket_inet_igmp.txt
socket_inet_l2tp.txt
socket_inet_sctp.txt
socket_inet_tcp.txt
socket_inet_udp.txt
socket_ip_tunnel.txt
socket_isdn.txt
socket_kcm.txt
socket_key.txt
socket_llc.txt
socket_netlink.txt
socket_netlink_audit.txt
socket_netlink_crypto.txt
socket_netlink_generic.txt
socket_netlink_generic_80211.txt
socket_netlink_generic_batadv.txt
socket_netlink_generic_devlink.txt
socket_netlink_generic_ethtool.txt
socket_netlink_generic_fou.txt
socket_netlink_generic_gtp.txt
socket_netlink_generic_mptcp.txt
socket_netlink_generic_net_dm.txt
socket_netlink_generic_netlabel.txt
socket_netlink_generic_nfc.txt
socket_netlink_generic_seg6.txt
socket_netlink_generic_smc.txt
socket_netlink_generic_team.txt
socket_netlink_generic_wireguard.txt
socket_netlink_netfilter.txt
socket_netlink_netfilter_acct.txt
socket_netlink_netfilter_conntrack.txt
socket_netlink_netfilter_conntrack_exp.txt
socket_netlink_netfilter_conntrack_helper.txt
socket_netlink_netfilter_ipset.txt
socket_netlink_netfilter_log.txt
socket_netlink_netfilter_nft_compat.txt
socket_netlink_netfilter_nftables.txt
socket_netlink_netfilter_osf.txt
socket_netlink_netfilter_queue.txt
socket_netlink_netfilter_timeout.txt
socket_netlink_rdma.txt
socket_netlink_route.txt
socket_netlink_route_sched.txt
socket_netlink_route_sched_retired.txt
socket_netlink_sock_diag.txt
socket_netlink_xfrm.txt
socket_netrom.txt
socket_nfc.txt
socket_nvme_of_tcp.txt
socket_packet.txt
socket_phonet.txt
socket_pppox.txt
socket_qipcrtr.txt
socket_rds.txt
socket_rose.txt
socket_rxrpc.txt
socket_tipc.txt
socket_tipc_netlink.txt
socket_unix.txt
socket_vnet.txt
socket_x25.txt
socket_xdp.txt
sys.txt
uffd.txt
usbip.txt
vmw_vmci.txt
vnet.txt
vnet_mptcp.txt
vusb.txt
watch_queue.txt
xattr.txt

r0 = syz_mount_image(&(0x7f0000000000)='ext4\x00', &(0x7f0000000100)='./mnt\x00', 0x0, 0x0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop0\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000220)='/dev/loop1\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000240)='/dev/loop2\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000260)='/dev/loop3\x00', 0x0, 0x0)
r5 = openat(0xffffffffffffff9c, &(0x7f0000000280)='/dev/loop4\x00', 0x0, 0x0)
r6 = openat(0xffffffffffffff9c, &(0x7f00000002a0)='/dev/loop5\x00', 0x0, 0x0)
read(r1, &(0x7f0000001000), 0x2000)
read(r2, &(0x7f0000001000), 0x2000)
read(r3, &(0x7f0000001000), 0x2000)
read(r4, &(0x7f0000001000), 0x2000)
read(r5, &(0x7f0000001000), 0x2000)
read(r6, &(0x7f0000001000), 0x2000)
umount2(&(0x7f0000000100)='./mnt\x00', 0x0)

gemini-3-pro-preview

							input: 3153
							output: 30
							thoughts: 13132
						

**Analysis and Reproduction Plan for KCSAN Data-Race in `__filemap_add_folio` / `filemap_write_and_wait_range`**

Okay, I've got a handle on this KCSAN data-race. It boils down to a conflict between reading from a block device and unmounting the filesystem *on* that device. Thread 1, the read side, is calling `__filemap_add_folio` which eventually leads to a `read()` syscall. This means it is reading data from a file on a filesystem which is *backed by* a block device, and that read operation is triggering folio additions/updates in the page cache. Thread 2, on the other hand, is deep inside the `cleanup_mnt` path, called from `task_work_run`, related to unmounting or cleaning up a mount point of a filesystem *mounted* on a block device. The critical part is that `sync_blockdev` is called which in turn calls `filemap_write_and_wait_range`, which will be checking `mapping_needs_writeback`, which conflicts with the read process of `__filemap_add_folio` in Thread 1.

The stack traces suggest a race between a `read()` on a block device and an `umount` operation.  The `cleanup_mnt` call, handled in `task_work_run` on a return to user mode strongly implies an implicit unmount due to a namespace or process exit or a lazy umount. Since the trace shows a namespace cleanup, a delayed `umount` is strongly indicated. I need to make sure I am doing both concurrently, with the `umount` operation using task work.

Therefore, the ideal reproduction scenario requires two concurrent activities: reading from a block device (or a file *on* a block device) and unmounting the filesystem on that same device. The use of `blkdev_read_iter` is a critical hint, suggesting I'm dealing with the block device itself, or at least a file on a block device.

My plan is, therefore, to set up a loop device, mount a filesystem (ext4) on it (to trigger `kill_block_super` in the unmount path), and then attempt to read *from* the loop device's block special file, `/dev/loopX`, *concurrently* with an unmount operation. I'm going to leverage `syz_mount_image` to create and mount a filesystem on a loop device, as this is a standard and convenient method for reproducing these types of issues. Then, I will focus on hitting all the loop devices to make sure that the read hits the proper mapped block device.

I will use `syz_mount_image` to set up the loop device and the filesystem. Then I will manually open the loop device and read from it in multiple calls, while concurrently triggering the unmount of the mounted filesystem. Since `syz_mount_image` returns 0, I'll need to open `/dev/loop0`...`/dev/loop5` to increase chances of reading from the correct loop device, since `syz_mount_image` selects it dynamically, or simply reads from all of them. The program is going to rely on syzkaller's concurrency model (thread and collision options) to force a race on those reads during the `umount` call. The crucial point is the block device's inode/mapping is shared.

The syz program will consist of these steps: First, the pseudo-call `syz_mount_image` will mount a filesystem (ext4) on a loop device. Then, I'll try to open all of `/dev/loop0` through `/dev/loop5`. Then I will read from *all* the loop devices. Finally, I will trigger the `umount` and rely on the executor to make the reads concurrent with the unmount. The unmount call triggers the `sync_blockdev` and should cause a race.

The program should have `threaded=true`, `collide=true`, `repeat=true`, and `procs=8` or more options set. I'm confident this will trigger the race.

map[ReproOpts:threaded=true collide=true repeat=true procs=8]

map[ReproOpts:threaded=true collide=true repeat=true procs=8]

gemini-3-pro-preview

							input: 17237
							output: 595
							thoughts: 0