KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2)

Status: upstream: reported on 2026/04/17 09:12
Subsystems: mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+38a879f4a73497f2dfef@syzkaller.appspotmail.com
First crash: 157d, last: 5h18m
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
64180eef assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/06/01 03:33 2026/06/01 03:33 2026/06/01 04:43 6b4a8443
222f6517 assessment-security 💥 KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/05/15 10:13 2026/05/15 10:13 2026/05/15 10:14 9cd3beaa
a67ccdf7 assessment-kcsan Benign: ❌ Confident: ✅ KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/04/16 10:01 2026/04/16 10:01 2026/04/16 10:22 df15c5f3
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 7 (8) 2026/06/10 21:59
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_wr_store_entry / mtree_range_walk mm 6 172 516d 727d 0/29 auto-obsoleted due to no activity on 2025/06/10 11:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_wr_store_entry / mtree_range_walk

write to 0xffff88811b963308 of 8 bytes by task 12465 on cpu 0:
 mas_wr_slot_store lib/maple_tree.c:3307 [inline]
 mas_wr_store_entry+0x3370/0x5ac0 lib/maple_tree.c:3603
 mas_store_prealloc+0x421/0x670 lib/maple_tree.c:5031
 vma_iter_store_overwrite mm/vma.h:704 [inline]
 commit_merge+0x7b4/0x840 mm/vma.c:847
 vma_expand+0x2d4/0x440 mm/vma.c:1302
 vma_merge_new_range+0x285/0x2f0 mm/vma.c:1195
 __mmap_region mm/vma.c:2876 [inline]
 mmap_region+0x10f4/0x21e0 mm/vma.c:2966
 do_mmap+0xa20/0xc70 mm/mmap.c:573
 vm_mmap_pgoff+0x183/0x2d0 mm/util.c:581
 ksys_mmap_pgoff+0xc1/0x310 mm/mmap.c:619
 x64_sys_call+0x23b3/0x2550 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811b963308 of 8 bytes by task 12468 on cpu 1:
 mtree_range_walk+0x1aa/0x480 lib/maple_tree.c:2100
 mas_state_walk lib/maple_tree.c:3013 [inline]
 mas_walk+0x1ac/0x340 lib/maple_tree.c:4458
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:304
 do_user_addr_fault+0x239/0x1060 arch/x86/mm/fault.c:1334
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

value changed: 0x00007f3cba1f4fff -> 0x00007f3cba1d3fff

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12468 Comm: syz.9.2249 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (118):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/20 14:16 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/18 14:01 upstream 5dd1818b15d9 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/05 07:32 upstream bc35965f6940 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/31 11:38 upstream cee9395acd80 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/31 03:38 upstream a23cbb05744b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/29 15:30 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/26 11:12 upstream 73ae59e97596 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/21 08:14 upstream cf62c7084acf 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/19 19:04 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/18 22:57 upstream 0f23d56f17fd 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/17 22:16 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/13 03:03 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/11 04:43 upstream d58772d8520c 508909ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/08 08:53 upstream bcc44b6785f2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/06 20:37 upstream fcaeecb8b0cd c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/06 01:37 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/05 15:21 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/31 22:52 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/31 09:01 upstream 3708dd948844 aaffb173 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/27 04:48 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/25 23:18 upstream 0ce37745d4bf 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/23 03:53 upstream 4539944e5151 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/22 13:40 upstream 248951ddc14d 4a865b71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/22 10:19 upstream 248951ddc14d b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/21 22:21 upstream 248951ddc14d 7c5de9c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/21 07:15 upstream b95f03f04d47 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/20 18:58 upstream 1590cf032971 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/20 02:48 upstream 82a47586c0b9 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/19 07:22 upstream 1229e2e57a5c 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/17 00:43 upstream 37e2f878a7a6 71b49442 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/15 18:06 upstream 58717b2a1365 a4ed0f4f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/14 12:52 upstream 3b029c035b34 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/13 22:59 upstream a13c140cc289 cc4833d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/12 23:32 upstream f4fb100039e9 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/12 19:01 upstream 44696aa3a489 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/11 20:04 upstream dd3210c47e8d d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/11 14:35 upstream 61c03dfde854 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/10 07:01 upstream a635d6748234 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/09 23:49 upstream 2c7c88a412aa a0c310a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/09 11:27 upstream 0e35b9b6ec0f b9f1ceaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/08 15:43 upstream 0e35b9b6ec0f 88a4b44c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/08 03:11 upstream 0e35b9b6ec0f 76cdc0c0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/05 13:35 upstream 7404ce516372 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/04 22:53 upstream 1e9cdc2ea15a fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/04 09:01 upstream 71dfdfb0209b fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/03 15:15 upstream 51512e22efe8 58bf2096 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/06/28 17:04 upstream 8b69c0475871 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/06/27 14:25 upstream 5a66900afbd6 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/06/27 05:50 upstream 51cb1aa1250c fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/06/01 00:55 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/05/15 01:25 upstream 66182ca873a4 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/04/16 22:11 upstream 1d51b370a0f8 4743f87d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/04/16 10:01 upstream aec2f682d47c df15c5f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
* Struck through repros no longer work on HEAD.