syzbot


KCSAN: data-race in mas_state_walk / mas_wmb_replace (3)

Status: moderation: reported on 2025/04/25 22:31
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+2b197cc5ae2316e142b4@syzkaller.appspotmail.com
First crash: 279d, last: 6h53m
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace mm 6 1 977d 977d 0/29 auto-obsoleted due to no activity on 2023/07/03 09:03
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace (2) mm 6 199 751d 784d 0/29 auto-obsoleted due to no activity on 2024/02/06 14:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wmb_replace

write to 0xffff888104cb8b00 of 8 bytes by task 6573 on cpu 0:
 mte_set_node_dead lib/maple_tree.c:334 [inline]
 mas_put_in_tree lib/maple_tree.c:1565 [inline]
 mas_topiary_replace lib/maple_tree.c:2341 [inline]
 mas_wmb_replace+0x20d/0x1610 lib/maple_tree.c:2433
 mas_split lib/maple_tree.c:3052 [inline]
 mas_commit_b_node lib/maple_tree.c:3072 [inline]
 mas_wr_bnode lib/maple_tree.c:3739 [inline]
 mas_wr_store_entry+0x16b6/0x2e70 lib/maple_tree.c:3771
 mas_store_prealloc+0x72e/0xa60 lib/maple_tree.c:5169
 vma_iter_store_overwrite mm/vma.h:544 [inline]
 vma_iter_store_new mm/vma.h:551 [inline]
 vma_complete+0x3f7/0x820 mm/vma.c:353
 __split_vma+0x5e3/0x660 mm/vma.c:566
 split_vma mm/vma.c:596 [inline]
 vma_modify+0xbcb/0xd30 mm/vma.c:1674
 vma_modify_flags+0x182/0x210 mm/vma.c:1694
 mprotect_fixup+0x30e/0x5e0 mm/mprotect.c:756
 do_mprotect_pkey+0x67b/0x920 mm/mprotect.c:930
 __do_sys_mprotect mm/mprotect.c:951 [inline]
 __se_sys_mprotect mm/mprotect.c:948 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:948
 x64_sys_call+0x2c3b/0x3000 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104cb8b00 of 8 bytes by task 6576 on cpu 1:
 ma_dead_node lib/maple_tree.c:572 [inline]
 mte_dead_node lib/maple_tree.c:587 [inline]
 mas_start lib/maple_tree.c:1207 [inline]
 mas_state_walk+0x119/0x650 lib/maple_tree.c:3291
 mas_walk+0x60/0x150 lib/maple_tree.c:4599
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:253
 do_user_addr_fault+0x232/0x1050 arch/x86/mm/fault.c:1325
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618

value changed: 0xffff88810a729b41 -> 0xffff888104cb8b00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6576 Comm: syz.6.968 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (306):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/30 03:18 upstream 4d310797262f bfa73b7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/29 15:31 upstream 8dfce8991b95 aeb6fdd5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/28 17:24 upstream 1f97d9dcf536 004c195c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/27 23:56 upstream 1f97d9dcf536 3029c699 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/27 12:16 upstream fcb70a56f4d8 9a514c2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/27 03:46 upstream fcb70a56f4d8 efb3e894 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/26 14:21 upstream 63804fed149a a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/25 16:37 upstream d91a46d6805a 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/25 05:10 upstream 5dbeeb268b63 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/24 16:00 upstream 62085877ae65 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/24 01:14 upstream 5bde837031a3 4f25b9b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/23 11:12 upstream c072629f05d7 e2b1b6e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/23 08:25 upstream c072629f05d7 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/22 18:36 upstream a66191c590b3 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/22 07:59 upstream a66191c590b3 a16aed1d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/21 09:08 upstream 6c790212c588 6f1aa2f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/20 20:58 upstream c03e9c42ae8f 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/20 11:51 upstream 24d479d26b25 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/20 00:33 upstream 24d479d26b25 572effc1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/19 12:08 upstream 24d479d26b25 a9fc5226 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/18 19:25 upstream e84d960149e7 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/17 13:52 upstream d3eeb99bbc99 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/17 07:00 upstream b62ce2547fe8 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/16 17:39 upstream 983d014aafb1 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/16 04:38 upstream 603c05a1639f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/15 20:14 upstream 944aacb68baf d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/14 16:22 upstream c537e12daeec d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/13 23:46 upstream b54345928fa1 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/13 08:37 upstream b71e635feefc d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/12 22:43 upstream 0f61b1860cc3 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/12 09:42 upstream 9c7ef209cd0f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/11 18:45 upstream 755bc1335e3b d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/11 02:28 upstream 97313d6113ab d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/10 12:58 upstream b6151c4e60e5 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/10 08:22 upstream 372800cb95a3 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/09 12:32 upstream 623fb9912f6a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/08 20:49 upstream 79b95d74470d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/06 22:50 upstream f0b9d8eb98df d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/06 05:56 upstream 7f98ab9da046 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/05 09:58 upstream 3609fa95fb0f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/04 04:18 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/03 03:14 upstream 9b0436804460 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/01 21:22 upstream b69053dd3ffb d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2026/01/01 03:16 upstream 349bd28a86f2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/12/31 03:51 upstream dbf8fe85a16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/12/30 08:23 upstream 8640b74557fc d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/12/28 11:48 upstream d26143bb38e2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/25 22:31 upstream 02ddfb981de8 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
* Struck through repros no longer work on HEAD.