KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2)

Status: upstream: reported C repro on 2026/04/17 09:12
Subsystems: mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+38a879f4a73497f2dfef@syzkaller.appspotmail.com
First crash: 194d, last: 12h22m
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
3dcbb22f repro-c Reproduced: ✅ ❓ KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/09/30 11:15 2026/09/30 11:15 2026/09/30 11:31 7808aef4
64180eef assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/06/01 03:33 2026/06/01 03:33 2026/06/01 04:43 6b4a8443
222f6517 assessment-security 💥 KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/05/15 10:13 2026/05/15 10:13 2026/05/15 10:14 9cd3beaa
a67ccdf7 assessment-kcsan Benign: ❌ Confident: ✅ ❓ KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 2026/04/16 10:01 2026/04/16 10:01 2026/04/16 10:22 df15c5f3
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in mas_wr_store_entry / mtree_range_walk (2) 7 (9) 2026/09/30 11:51
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_wr_store_entry / mtree_range_walk mm 6 172 553d 764d 0/29 auto-obsoleted due to no activity on 2025/06/10 11:41
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/30 11:41 9m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f40809618230001baccf219193e22fc5a report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_wr_store_entry / mtree_range_walk

write to 0xffff8881105bc000 of 8 bytes by task 3634 on cpu 1:
 mte_set_node_dead lib/maple_tree.c:305 [inline]
 mas_put_in_tree lib/maple_tree.c:1652 [inline]
 mas_replace_node lib/maple_tree.c:1667 [inline]
 mas_wr_node_store lib/maple_tree.c:3276 [inline]
 mas_wr_store_entry+0x3c1f/0x5ac0 lib/maple_tree.c:3606
 mas_store_prealloc+0x421/0x670 lib/maple_tree.c:5031
 vma_iter_store_overwrite mm/vma.h:704 [inline]
 commit_merge+0x7b4/0x840 mm/vma.c:847
 vma_merge_existing_range mm/vma.c:1070 [inline]
 vma_modify+0x9eb/0xd50 mm/vma.c:1756
 vma_modify_flags+0x1be/0x250 mm/vma.c:1799
 mprotect_fixup+0x382/0x660 mm/mprotect.c:824
 do_mprotect_pkey+0x69f/0x950 mm/mprotect.c:1002
 __do_sys_mprotect mm/mprotect.c:1023 [inline]
 __se_sys_mprotect mm/mprotect.c:1020 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:1020
 x64_sys_call+0xd54/0x2550 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881105bc000 of 8 bytes by task 3640 on cpu 0:
 ma_dead_node lib/maple_tree.c:505 [inline]
 mtree_range_walk+0x35a/0x480 lib/maple_tree.c:2119
 mas_state_walk lib/maple_tree.c:3013 [inline]
 mas_walk+0x1ac/0x340 lib/maple_tree.c:4458
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:304
 do_user_addr_fault+0x239/0x1060 arch/x86/mm/fault.c:1334
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

value changed: 0xffff8881058c0526 -> 0xffff8881105bc000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3640 Comm: syz-executor108 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (135):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/30 11:51 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 551c722f4080 7bf4ea23 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/27 15:35 upstream d135ab453a74 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/24 03:41 upstream 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/22 20:31 upstream 7be4bc52fd9e b55fad29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/19 23:08 upstream c03c1a14507d 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/16 19:38 upstream 2f2f7eeef8b0 4c840a2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/16 05:43 upstream 9aa622dbaab8 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/14 22:32 upstream 4056b3c9d3c9 1a71827b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/13 04:57 upstream 24a19b953e2a 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/12 04:14 upstream b88c841d1164 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/04 06:40 upstream a74306e2e676 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/10/02 15:28 upstream ce1e0223d8ad 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/29 13:12 upstream 72d3fcf802c4 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/26 21:43 upstream fddfc3ec3179 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/26 15:35 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/25 14:04 upstream f49a343b305c f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/23 01:51 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/20 14:16 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/18 14:01 upstream 5dd1818b15d9 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/09/05 07:32 upstream bc35965f6940 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/31 11:38 upstream cee9395acd80 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/31 03:38 upstream a23cbb05744b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/29 15:30 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/26 11:12 upstream 73ae59e97596 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/21 08:14 upstream cf62c7084acf 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/19 19:04 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/18 22:57 upstream 0f23d56f17fd 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/17 22:16 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/13 03:03 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/11 04:43 upstream d58772d8520c 508909ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/08 08:53 upstream bcc44b6785f2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/06 20:37 upstream fcaeecb8b0cd c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/06 01:37 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/08/05 15:21 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/31 22:52 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/31 09:01 upstream 3708dd948844 aaffb173 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/27 04:48 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/25 23:18 upstream 0ce37745d4bf 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/23 03:53 upstream 4539944e5151 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/22 13:40 upstream 248951ddc14d 4a865b71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/22 10:19 upstream 248951ddc14d b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/21 22:21 upstream 248951ddc14d 7c5de9c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/21 07:15 upstream b95f03f04d47 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/20 18:58 upstream 1590cf032971 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/20 02:48 upstream 82a47586c0b9 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/19 07:22 upstream 1229e2e57a5c 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/17 00:43 upstream 37e2f878a7a6 71b49442 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/07/15 18:06 upstream 58717b2a1365 a4ed0f4f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/06/01 00:55 upstream 174914ea5513 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/05/15 01:25 upstream 66182ca873a4 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/04/16 22:11 upstream 1d51b370a0f8 4743f87d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
2026/04/16 10:01 upstream aec2f682d47c df15c5f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wr_store_entry / mtree_range_walk
* Struck through repros no longer work on HEAD.