KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read

Status: moderation: reported on 2023/12/09 00:01
Subsystems: mm
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+706dde8a3e5ef992fcad@syzkaller.appspotmail.com
First crash: 1216d, last: 7h04m
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
fcc30f3c repro-c Reproduced: ✅ ❓ KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read 2026/10/11 10:25 2026/10/11 10:25 2026/10/11 10:56 4f92358f
b0384c36 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read 2026/05/21 02:41 2026/05/21 02:41 2026/05/21 03:22 cf874a1c
6bd39b22 repro 💥 KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read 2026/03/10 12:22 2026/03/10 12:22 2026/03/10 12:22 5c03941b
71db9653 assessment-kcsan Benign: ✅ Confident: ✅ ✅ KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read 2026/01/14 13:13 2026/01/14 13:13 2026/01/14 13:16 a9d6a792
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/11 11:25 11m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a5ebb76233b79db01e82e061173cb73c6d2b5c6b report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read

write to 0xffff88810ced42e0 of 8 bytes by task 7647 on cpu 1:
 shmem_file_splice_read+0x3eb/0x570 mm/shmem.c:3838
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x25d/0x680 fs/splice.c:1077
 do_splice_direct_actor fs/splice.c:1230 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1256
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x1015/0x2550 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88810ced42e0 of 8 bytes by task 7649 on cpu 0:
 shmem_file_splice_read+0x3eb/0x570 mm/shmem.c:3838
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x25d/0x680 fs/splice.c:1077
 do_splice_direct_actor fs/splice.c:1230 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1256
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x1015/0x2550 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000001b51 -> 0x0000000000001b59

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 7649 Comm: syz.0.980 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read

write to 0xffff88810ced42e0 of 8 bytes by task 7647 on cpu 1:
 shmem_file_splice_read+0x3eb/0x570 mm/shmem.c:3838
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x25d/0x680 fs/splice.c:1077
 do_splice_direct_actor fs/splice.c:1230 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1256
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x1015/0x2550 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88810ced42e0 of 8 bytes by task 7649 on cpu 0:
 shmem_file_splice_read+0x3eb/0x570 mm/shmem.c:3838
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x25d/0x680 fs/splice.c:1077
 do_splice_direct_actor fs/splice.c:1230 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1256
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x1015/0x2550 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000002ff25 -> 0x000000000002ff2a

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 7649 Comm: syz.0.980 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
==================================================================

Crashes (3316):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/08 10:50 upstream fa4ad798f6f6 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/07 21:13 upstream d164c7d754f0 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/07 02:12 upstream d48723711bae 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/06 12:56 upstream f66469d9905b 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/05 23:43 upstream d68ce4e71248 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/05 20:51 upstream 05441d697f7f 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/05 07:24 upstream 05441d697f7f 2ee8459f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/04 15:52 upstream 05441d697f7f 73438ed0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/04 03:42 upstream 05441d697f7f 5af5b6c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/03 20:37 upstream 05441d697f7f e2d35131 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/03 12:58 upstream 6628e7d4c6b2 e2d35131 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/02 10:57 upstream 6628e7d4c6b2 6969b601 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/02 05:22 upstream 6628e7d4c6b2 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/01 16:20 upstream cbbddb6b08cc 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/11/01 02:47 upstream e9954f3fbddd 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/31 23:33 upstream e9954f3fbddd 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/31 09:47 upstream 36aad21d50d1 2041d3f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/30 19:20 upstream bd5c762ac051 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/30 17:39 upstream d89e1d186ec9 0ec395f8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/30 09:47 upstream d89e1d186ec9 b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/29 20:21 upstream 4dd16e31135e b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/29 18:29 upstream c339f4010dea b498adee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/29 03:54 upstream c339f4010dea b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/29 01:03 upstream c339f4010dea 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/28 11:04 upstream 65ba8f34ec88 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/28 09:07 upstream 65ba8f34ec88 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/27 19:19 upstream 62c457528529 96923c60 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/27 03:37 upstream d135ab453a74 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/26 14:44 upstream 6b4b543fa187 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/26 04:29 upstream 390febb5805d 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/25 15:23 upstream 21a7f44fd076 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/25 02:13 upstream 6fba331225f5 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/24 09:21 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/23 19:35 upstream 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/23 05:11 upstream a1c2b1da93f5 d566bfda .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/23 01:24 upstream a1c2b1da93f5 b55fad29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/22 10:30 upstream 7be4bc52fd9e 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/21 20:38 upstream a804c5742bff 4ba27f85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/21 06:15 upstream 4cbdd58dfa7a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/20 11:44 upstream f47d223627f8 df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/20 10:06 upstream f47d223627f8 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/19 15:06 upstream c03c1a14507d 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/19 10:09 upstream c03c1a14507d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/18 20:19 upstream a0ff06b3a7bd 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/18 07:12 upstream 32c52ec87d62 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/17 16:02 upstream 58161ead29e5 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/17 02:42 upstream 70dd4ee72eb2 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/16 12:13 upstream 2f2f7eeef8b0 4c840a2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/15 21:08 upstream 9aa622dbaab8 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/15 16:38 upstream 9aa622dbaab8 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/15 04:00 upstream 0fcb05b72344 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/10/11 02:18 upstream a5ebb76233b7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/05/20 18:08 upstream df685633c3db 62fb93a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/03/10 03:44 upstream 1f318b96cc84 6972f302 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2026/01/14 08:34 upstream c537e12daeec d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2023/12/08 12:55 upstream 5e3f5b81de80 28b24332 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
2023/11/23 22:26 upstream d3fa86b1a7b4 5b429f39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_file_splice_read / shmem_file_splice_read
* Struck through repros no longer work on HEAD.