syzbot


KCSAN: data-race in xas_find_marked / xas_init_marks (7)

Status: moderation: reported on 2026/06/22 03:30
Subsystems: ext4
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+20c072318ddd5ab4b481@syzkaller.appspotmail.com
First crash: 2d09h, last: 2d09h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
b4b94d82-797a-433a-8f02-c0c95ab2a80e assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in xas_find_marked / xas_init_marks (7) 2026/06/24 00:02 2026/06/24 00:02 2026/06/24 00:44 e30e5c89d137d970da183ffdc275130a55fdd832

			
		
0fbb1a3e-48a8-4a2f-897c-bb32c39e8a51 assessment-kcsan Benign: ✅ KCSAN: data-race in xas_find_marked / xas_init_marks (7) 2026/06/22 03:32 2026/06/22 03:32 2026/06/22 04:14 43bfcdb07c3552e4664e1029672054ac0924d543

			
		
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (6) ext4 mm prio:high 6 19 67d 292d 0/29 auto-obsoleted due to no activity on 2026/06/12 21:01
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (3) ext4 6 1 669d 669d 0/29 auto-obsoleted due to no activity on 2024/09/27 13:38
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (2) ext4 6 820 702d 1849d 0/29 auto-obsoleted due to no activity on 2024/08/19 12:59
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (5) mm 6 7 355d 461d 0/29 auto-obsoleted due to no activity on 2025/08/29 12:06
upstream KCSAN: data-race in xas_find_marked / xas_init_marks (4) ext4 exfat 6 5 593d 618d 0/29 auto-obsoleted due to no activity on 2025/01/03 11:34
upstream KCSAN: data-race in xas_find_marked / xas_init_marks ext4 6 11 2071d 2161d 0/29 auto-closed as invalid on 2020/11/26 04:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff88811f10dfe0 of 8 bytes by task 14572 on cpu 0:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 xas_init_marks+0x18a/0x320 lib/xarray.c:955
 xas_store+0x243/0xce0 lib/xarray.c:817
 page_cache_delete_batch mm/filemap.c:315 [inline]
 delete_from_page_cache_batch+0x324/0x720 mm/filemap.c:337
 truncate_inode_pages_range+0x1f3/0x7d0 mm/truncate.c:405
 truncate_inode_pages mm/truncate.c:485 [inline]
 truncate_pagecache+0x53/0x70 mm/truncate.c:798
 ext4_setattr+0xb71/0x1140 fs/ext4/inode.c:6139
 notify_change+0x842/0x8c0 fs/attr.c:556
 do_truncate fs/open.c:68 [inline]
 do_ftruncate+0x344/0x410 fs/open.c:194
 ksys_ftruncate fs/open.c:206 [inline]
 __do_sys_ftruncate fs/open.c:211 [inline]
 __se_sys_ftruncate fs/open.c:209 [inline]
 __x64_sys_ftruncate+0x65/0xc0 fs/open.c:209
 x64_sys_call+0x2beb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:78
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811f10dfe0 of 8 bytes by task 5934 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1510
 find_get_entry mm/filemap.c:2082 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2349
 mpage_prepare_extent_to_map+0x2f8/0xc00 fs/ext4/inode.c:2656
 ext4_do_writepages+0x9e5/0x2720 fs/ext4/inode.c:2947
 ext4_writepages+0x18f/0x300 fs/ext4/inode.c:3043
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2571
 __writeback_single_inode+0x7b/0x660 fs/fs-writeback.c:1787
 writeback_sb_inodes+0x4d9/0xaa0 fs/fs-writeback.c:2079
 wb_writeback+0x20c/0x510 fs/fs-writeback.c:2264
 wb_do_writeback fs/fs-writeback.c:2432 [inline]
 wb_workfn+0x1a4/0xa50 fs/fs-writeback.c:2477
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
 worker_thread+0x569/0x750 kernel/workqueue.c:3486
 kthread+0x221/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0xffffffffffffffff -> 0xffffffff80000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 5934 Comm: kworker/u8:10 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: writeback wb_workfn (flush-7:2)
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/22 03:30 upstream 8cd8cf7a07e5 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_find_marked / xas_init_marks
* Struck through repros no longer work on HEAD.