syzbot


KCSAN: data-race in xas_find_marked / xas_init_marks (6)

Status: moderation: reported on 2025/09/05 07:35
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+6dd7d6284327c0bf326f@syzkaller.appspotmail.com
First crash: 66d, last: 1d22h
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (3) ext4 6 1 443d 443d 0/29 auto-obsoleted due to no activity on 2024/09/27 13:38
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (2) ext4 6 820 475d 1623d 0/29 auto-obsoleted due to no activity on 2024/08/19 12:59
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (5) mm 6 7 129d 235d 0/29 auto-obsoleted due to no activity on 2025/08/29 12:06
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (4) ext4 exfat 6 5 367d 392d 0/29 auto-obsoleted due to no activity on 2025/01/03 11:34
upstream KCSAN: data-race in xas_find_marked / xas_init_marks ext4 6 11 1845d 1935d 0/29 auto-closed as invalid on 2020/11/26 04:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff888106bddfe0 of 8 bytes by task 6938 on cpu 0:
 instrument_read_write include/linux/instrumented.h:55 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x3cf/0xce0 lib/xarray.c:817
 page_cache_delete mm/filemap.c:141 [inline]
 __filemap_remove_folio+0x195/0x2a0 mm/filemap.c:227
 __remove_mapping+0x390/0x4c0 mm/vmscan.c:811
 remove_mapping+0x22/0x90 mm/vmscan.c:847
 mapping_evict_folio mm/truncate.c:314 [inline]
 mapping_try_invalidate+0x26a/0x3f0 mm/truncate.c:535
 generic_fadvise+0x3e5/0x430 mm/fadvise.c:158
 vfs_fadvise mm/fadvise.c:185 [inline]
 ksys_fadvise64_64 mm/fadvise.c:198 [inline]
 __do_sys_fadvise64 mm/fadvise.c:210 [inline]
 __se_sys_fadvise64 mm/fadvise.c:208 [inline]
 __x64_sys_fadvise64+0xcb/0x110 mm/fadvise.c:208
 x64_sys_call+0x29c5/0x3000 arch/x86/include/generated/asm/syscalls_64.h:222
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888106bddfe0 of 8 bytes by task 52 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x218/0x620 lib/xarray.c:1510
 find_get_entry+0x5d/0x380 mm/filemap.c:2070
 filemap_get_folios_tag+0x13b/0x210 mm/filemap.c:2338
 mpage_prepare_extent_to_map+0x320/0xc00 fs/ext4/inode.c:2637
 ext4_do_writepages+0x708/0x2750 fs/ext4/inode.c:2877
 ext4_writepages+0x176/0x300 fs/ext4/inode.c:3025
 do_writepages+0x1c6/0x310 mm/page-writeback.c:2604
 __writeback_single_inode+0x80/0x7c0 fs/fs-writeback.c:1719
 writeback_sb_inodes+0x48f/0xa30 fs/fs-writeback.c:2015
 wb_writeback+0x252/0x5c0 fs/fs-writeback.c:2195
 wb_do_writeback fs/fs-writeback.c:2342 [inline]
 wb_workfn+0x194/0x910 fs/fs-writeback.c:2382
 process_one_work kernel/workqueue.c:3263 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3346
 worker_thread+0x582/0x770 kernel/workqueue.c:3427
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x122/0x1b0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0xffffffffffffffff -> 0xffffffffffffffcf

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: writeback wb_workfn (flush-7:4)
==================================================================
Bluetooth: hci0: Frame reassembly failed (-84)

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/08 13:37 upstream e811c33b1f13 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/05 20:29 upstream 1c353dc8d962 a6c9c731 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/11 23:56 upstream 67029a49db6c ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/10 04:38 upstream 5472d60c129f ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/09 04:49 upstream cd5a0afbdf80 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/07 11:09 upstream c746c3b51698 8ef35d49 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:58 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:57 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/04 11:00 upstream cbf33b8e0b36 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/29 11:28 upstream e5f0a698b34e 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/05 07:34 upstream d69eb204c255 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
* Struck through repros no longer work on HEAD.