syzbot


KCSAN: data-race in xas_find_marked / xas_init_marks (6)

Status: moderation: reported on 2025/09/05 07:35
Subsystems: ext4 mm
[Documentation on labels]
Reported-by: syzbot+6dd7d6284327c0bf326f@syzkaller.appspotmail.com
First crash: 113d, last: 14d
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (3) ext4 6 1 490d 490d 0/29 auto-obsoleted due to no activity on 2024/09/27 13:38
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (2) ext4 6 820 522d 1670d 0/29 auto-obsoleted due to no activity on 2024/08/19 12:59
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (5) mm 6 7 175d 282d 0/29 auto-obsoleted due to no activity on 2025/08/29 12:06
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (4) ext4 exfat 6 5 413d 439d 0/29 auto-obsoleted due to no activity on 2025/01/03 11:34
upstream KCSAN: data-race in xas_find_marked / xas_init_marks ext4 6 11 1892d 1982d 0/29 auto-closed as invalid on 2020/11/26 04:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff888109e45d98 of 8 bytes by task 5311 on cpu 1:
 instrument_read_write include/linux/instrumented.h:55 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x3cf/0xce0 lib/xarray.c:817
 page_cache_delete mm/filemap.c:142 [inline]
 __filemap_remove_folio+0x195/0x2a0 mm/filemap.c:228
 __remove_mapping+0x390/0x4c0 mm/vmscan.c:788
 remove_mapping+0x22/0x90 mm/vmscan.c:824
 mapping_evict_folio mm/truncate.c:339 [inline]
 mapping_try_invalidate+0x26a/0x3f0 mm/truncate.c:560
 generic_fadvise+0x3e5/0x430 mm/fadvise.c:157
 vfs_fadvise mm/fadvise.c:184 [inline]
 ksys_fadvise64_64 mm/fadvise.c:197 [inline]
 __do_sys_fadvise64 mm/fadvise.c:209 [inline]
 __se_sys_fadvise64 mm/fadvise.c:207 [inline]
 __x64_sys_fadvise64+0xcb/0x110 mm/fadvise.c:207
 x64_sys_call+0x29f4/0x3000 arch/x86/include/generated/asm/syscalls_64.h:222
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888109e45d98 of 8 bytes by task 3484 on cpu 0:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x218/0x620 lib/xarray.c:1510
 find_get_entry+0x5d/0x380 mm/filemap.c:2064
 filemap_get_folios_tag+0x13b/0x210 mm/filemap.c:2332
 mpage_prepare_extent_to_map+0x308/0xc20 fs/ext4/inode.c:2639
 ext4_do_writepages+0x6fe/0x27e0 fs/ext4/inode.c:2878
 ext4_writepages+0x179/0x300 fs/ext4/inode.c:3026
 do_writepages+0x1c6/0x310 mm/page-writeback.c:2598
 __writeback_single_inode+0x80/0x7c0 fs/fs-writeback.c:1737
 writeback_sb_inodes+0x4b0/0xb20 fs/fs-writeback.c:2030
 wb_writeback+0x252/0x5c0 fs/fs-writeback.c:2216
 wb_do_writeback fs/fs-writeback.c:2363 [inline]
 wb_workfn+0x194/0x910 fs/fs-writeback.c:2403
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0xffffffffffffffff -> 0xfffffffffffffe3f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3484 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: writeback wb_workfn (flush-7:3)
==================================================================
EXT4-fs (loop3): Delayed block allocation failed for inode 15 at logical offset 2017 with max blocks 1 with error 28
EXT4-fs (loop3): This should not happen!! Data will be lost

EXT4-fs (loop3): Total free blocks count 0
EXT4-fs (loop3): Free/Dirty block details
EXT4-fs (loop3): free_blocks=0
EXT4-fs (loop3): dirty_blocks=16
EXT4-fs (loop3): Block reservation details
EXT4-fs (loop3): i_reserved_data_blocks=1

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/12 11:07 upstream 187d0801404f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/11 23:53 upstream 24172e0d7990 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/08 13:37 upstream e811c33b1f13 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/11/05 20:29 upstream 1c353dc8d962 a6c9c731 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/11 23:56 upstream 67029a49db6c ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/10 04:38 upstream 5472d60c129f ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/09 04:49 upstream cd5a0afbdf80 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/07 11:09 upstream c746c3b51698 8ef35d49 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:58 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/05 16:57 upstream 6093a688a07d 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/10/04 11:00 upstream cbf33b8e0b36 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/29 11:28 upstream e5f0a698b34e 86341da6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
2025/09/05 07:34 upstream d69eb204c255 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
* Struck through repros no longer work on HEAD.