==================================================================
BUG: KCSAN: data-race in __delete_from_swap_cache / folio_mapping

write to 0xffffea00047cf5a8 of 8 bytes by task 23251 on cpu 0:
 __delete_from_swap_cache+0x1e8/0x280 mm/swap_state.c:161
 delete_from_swap_cache+0x73/0xe0 mm/swap_state.c:180
 shmem_swapin_folio+0xe9b/0xf50 mm/shmem.c:2401
 shmem_get_folio_gfp+0x26c/0xd60 mm/shmem.c:2469
 shmem_fault+0xf6/0x250 mm/shmem.c:2737
 __do_fault+0xb9/0x200 mm/memory.c:5169
 do_read_fault mm/memory.c:5590 [inline]
 do_fault mm/memory.c:5724 [inline]
 do_pte_missing mm/memory.c:4251 [inline]
 handle_pte_fault mm/memory.c:6069 [inline]
 __handle_mm_fault mm/memory.c:6212 [inline]
 handle_mm_fault+0xf78/0x2be0 mm/memory.c:6381
 do_user_addr_fault+0x3fe/0x1090 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 fault_in_readable+0xad/0x170 mm/gup.c:-1
 fault_in_iov_iter_readable+0x129/0x210 lib/iov_iter.c:94
 generic_perform_write+0x3cf/0x490 mm/filemap.c:4161
 shmem_file_write_iter+0xc5/0xf0 mm/shmem.c:3467
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x49d/0x8e0 fs/read_write.c:686
 ksys_write+0xda/0x1a0 fs/read_write.c:738
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:746
 x64_sys_call+0x2cdd/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffea00047cf5a8 of 8 bytes by task 23257 on cpu 1:
 folio_mapping+0xdd/0x120 mm/util.c:699
 folio_evictable mm/internal.h:478 [inline]
 lru_add+0x80/0x430 mm/swap.c:136
 folio_batch_move_lru+0x177/0x230 mm/swap.c:168
 lru_add_drain_cpu+0x77/0x250 mm/swap.c:642
 lru_add_drain+0x25/0x70 mm/swap.c:730
 swap_cluster_readahead+0x35a/0x3e0 mm/swap_state.c:629
 shmem_swapin_cluster mm/shmem.c:1706 [inline]
 shmem_swapin_folio+0x821/0xf50 mm/shmem.c:2325
 shmem_get_folio_gfp+0x26c/0xd60 mm/shmem.c:2469
 shmem_fault+0xf6/0x250 mm/shmem.c:2737
 __do_fault+0xb9/0x200 mm/memory.c:5169
 do_read_fault mm/memory.c:5590 [inline]
 do_fault mm/memory.c:5724 [inline]
 do_pte_missing mm/memory.c:4251 [inline]
 handle_pte_fault mm/memory.c:6069 [inline]
 __handle_mm_fault mm/memory.c:6212 [inline]
 handle_mm_fault+0xf78/0x2be0 mm/memory.c:6381
 do_user_addr_fault+0x3fe/0x1090 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:68
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:141 [inline]
 copy_from_user_iter lib/iov_iter.c:55 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:300 [inline]
 iterate_and_advance include/linux/iov_iter.h:328 [inline]
 __copy_from_iter lib/iov_iter.c:249 [inline]
 _copy_from_iter+0x141/0xe40 lib/iov_iter.c:260
 copy_from_iter include/linux/uio.h:228 [inline]
 copy_from_iter_full include/linux/uio.h:245 [inline]
 skb_do_copy_data_nocache include/net/sock.h:2243 [inline]
 skb_copy_to_page_nocache include/net/sock.h:2269 [inline]
 tcp_sendmsg_locked+0x1905/0x2c10 net/ipv4/tcp.c:1254
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1396
 inet_sendmsg+0x76/0xd0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x102/0x180 net/socket.c:727
 __sys_sendto+0x268/0x330 net/socket.c:2180
 __do_sys_sendto net/socket.c:2187 [inline]
 __se_sys_sendto net/socket.c:2183 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2183
 x64_sys_call+0x2eb6/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000031d9 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 23257 Comm: syz.0.4845 Tainted: G        W           6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================