syzbot


KCSAN: data-race in mas_state_walk / mas_wmb_replace (3)

Status: moderation: reported on 2025/04/25 22:31
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+2b197cc5ae2316e142b4@syzkaller.appspotmail.com
First crash: 313d, last: 6h45m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
b8afd44d-571e-4e40-b97e-06786d629a3e assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in mas_state_walk / mas_wmb_replace (3) 2026/02/24 19:30 2026/02/24 19:30 2026/02/24 19:35 305c0ec5cd886e2d13738e28e1b2df9b0ec20fc9
afe73193-cd34-4a98-a1fa-9171a3d9650f assessment-kcsan 💥 KCSAN: data-race in mas_state_walk / mas_wmb_replace (3) 2026/01/10 00:59 2026/01/10 00:59 2026/01/10 00:59 7519916073b761ced56a7b15fdeeb4674e8dc125 Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. * Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0, Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.QuotaFailure violations:[map[quotaId:GenerateRequestsPerDayPerProjectPerModel quotaMetric:generativelanguage.googleapis.com/generate_requests_per_model_per_day]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. * Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0 [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0" details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "RM\nK\nEgenerativelanguage.googleapis.com/generate_requests_per_model_per_day\030\000\"\000" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } details { [type.googleapis.com/google.rpc.QuotaFailure] { violations { quota_metric: "generativelanguage.googleapis.com/generate_requests_per_model_per_day" quota_id: "GenerateRequestsPerDayPerProjectPerModel" } } } }]]
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace mm 6 1 1010d 1010d 0/29 auto-obsoleted due to no activity on 2023/07/03 09:03
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace (2) mm 6 199 785d 818d 0/29 auto-obsoleted due to no activity on 2024/02/06 14:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wmb_replace

write to 0xffff888104a16500 of 8 bytes by task 25967 on cpu 1:
 mte_set_node_dead lib/maple_tree.c:334 [inline]
 mas_put_in_tree lib/maple_tree.c:1565 [inline]
 mas_topiary_replace lib/maple_tree.c:2341 [inline]
 mas_wmb_replace+0x20d/0x1610 lib/maple_tree.c:2433
 mas_split lib/maple_tree.c:3052 [inline]
 mas_commit_b_node lib/maple_tree.c:3072 [inline]
 mas_wr_bnode lib/maple_tree.c:3739 [inline]
 mas_wr_store_entry+0x16b6/0x2ed0 lib/maple_tree.c:3771
 mas_store_prealloc+0x72e/0xa70 lib/maple_tree.c:5169
 vma_iter_store_overwrite mm/vma.h:607 [inline]
 vma_iter_store_new mm/vma.h:614 [inline]
 __mmap_new_vma mm/vma.c:2553 [inline]
 __mmap_region mm/vma.c:2759 [inline]
 mmap_region+0x1b3b/0x2050 mm/vma.c:2837
 do_mmap+0x9b2/0xbd0 mm/mmap.c:559
 vm_mmap_pgoff+0x183/0x2d0 mm/util.c:581
 ksys_mmap_pgoff+0xc1/0x310 mm/mmap.c:605
 x64_sys_call+0x14df/0x3020 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104a16500 of 8 bytes by task 25970 on cpu 0:
 ma_dead_node lib/maple_tree.c:572 [inline]
 mte_dead_node lib/maple_tree.c:587 [inline]
 mas_start lib/maple_tree.c:1207 [inline]
 mas_state_walk+0x119/0x650 lib/maple_tree.c:3291
 mas_walk+0x60/0x150 lib/maple_tree.c:4599
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:304
 do_user_addr_fault+0x232/0x1050 arch/x86/mm/fault.c:1325
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

value changed: 0xffff888107df1b41 -> 0xffff888104a16500

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 25970 Comm: syz.3.5703 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (361):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/04 18:50 upstream 0031c06807cf e6b6b96b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/04 01:38 upstream 0031c06807cf 4180d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/03 17:48 upstream af4e9ef3d784 4180d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/03 10:58 upstream af4e9ef3d784 28b83e23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/02 16:09 upstream 11439c4635ed b9dd6534 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/02 01:09 upstream 39c633261414 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/03/01 13:53 upstream eb71ab2bf722 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/28 10:58 upstream 4d349ee5c778 43249bac .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/27 22:16 upstream a75cb869a8cc 2cf092b8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/26 19:22 upstream f4d0ec0aa20d ffa54287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/26 05:56 upstream d9d32e5bd5a4 e0f78d93 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/24 19:15 upstream 7dff99b35460 96b1aa46 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/24 03:46 upstream 7dff99b35460 41d2fa6a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/23 14:58 upstream 6de23f81a5e0 6beca497 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/22 18:18 upstream 32a92f8c8932 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/22 03:00 upstream fa5c82f4d2bb 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/21 14:08 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/21 00:51 upstream a95f71ad3e2e 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/20 09:57 upstream 8bf22c33e7a1 17d780d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/19 23:38 upstream 2b7a25df823d c8d8c52d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/19 14:32 upstream 956b9cbd7f15 746545b8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/19 01:11 upstream 23b0f90ba871 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/18 18:34 upstream 2961f841b025 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/18 06:57 upstream 2961f841b025 39751c21 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/17 22:38 upstream d295082ea672 06ec4f7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/17 08:57 upstream 970296997869 e439b951 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/16 21:33 upstream 0f2acd3148e0 5d52cba5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/16 05:14 upstream 26a4cfaff82a 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/15 14:06 upstream ca4ee40bf13d 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/14 13:00 upstream 770aaedb461a 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/14 00:39 upstream cee73b1e840c 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/13 10:17 upstream 37a93dd5c49b 6a673c50 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/12 19:30 upstream 37a93dd5c49b 504cb1bf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/11 15:49 upstream 192c0159402e 75707236 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/11 06:49 upstream dc855b77719f 441e25b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/10 18:05 upstream 72c395024dac 91d776d3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/10 06:03 upstream 8a5203c630c6 4ab09a02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/09 17:15 upstream 05f7e89ab973 df949cd9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/07 20:38 upstream e7aa57247700 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/06 13:09 upstream b7ff7151e653 97745f52 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/05 23:46 upstream 8fdb05de0e2d f03c4191 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/05 21:31 upstream 8fdb05de0e2d 4936e85c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/02/05 15:22 upstream f14faaf3a1fb 4936e85c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/09 12:32 upstream 623fb9912f6a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/25 22:31 upstream 02ddfb981de8 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
* Struck through repros no longer work on HEAD.