syzbot


KCSAN: data-race in __wb_writeout_add / writeout_period (6)

Status: moderation: reported on 2026/06/30 06:44
Subsystems: fs mm
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+44d48263a5bd8600f264@syzkaller.appspotmail.com
First crash: 8d10h, last: 8d10h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
4c56921e-6f35-4e52-9171-e4dbaf2bad9e assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ KCSAN: data-race in __wb_writeout_add / writeout_period (6) 2026/07/02 00:01 2026/07/02 00:01 2026/07/02 00:22 93f579545ae410f5bccfa141d2e7bf03178f036c

			
		
7a1d4587-964c-433a-8c57-c942218f3ec9 assessment-kcsan Benign: ✅ KCSAN: data-race in __wb_writeout_add / writeout_period (6) 2026/06/30 06:43 2026/06/30 06:43 2026/06/30 06:46 fff8d0a0e302881e84edbe2230016e3bec252ec6

			
		
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __wb_writeout_add / writeout_period (2) fs mm 6 2 1465d 1473d 0/29 auto-closed as invalid on 2022/08/08 01:40
upstream KCSAN: data-race in __wb_writeout_add / writeout_period fs mm 6 2 1521d 1547d 0/29 auto-closed as invalid on 2022/06/12 20:11
upstream KCSAN: data-race in __wb_writeout_add / writeout_period (4) fs mm 6 146 743d 943d 0/29 auto-obsoleted due to no activity on 2024/07/29 22:39
upstream KCSAN: data-race in __wb_writeout_add / writeout_period (3) fs mm 6 1 1422d 1422d 0/29 auto-closed as invalid on 2022/09/20 00:41
upstream KCSAN: data-race in __wb_writeout_add / writeout_period (5) fs mm 6 1 641d 641d 0/29 auto-obsoleted due to no activity on 2024/11/08 23:57

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __wb_writeout_add / writeout_period

write to 0xffffffff893e71f0 of 8 bytes by interrupt on cpu 0:
 writeout_period+0xa1/0xe0 mm/page-writeback.c:608
 call_timer_fn+0x3b/0x240 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x40c/0x5f0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0x45/0x70 kernel/time/timer.c:2406
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 console_flush_one_record arch/x86/include/asm/irqflags.h:-1 [inline]
 console_flush_all+0x513/0x6b0 kernel/printk/printk.c:3343
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0xa1/0x280 kernel/printk/printk.c:3413
 vprintk_emit+0x3e4/0x600 kernel/printk/printk.c:2479
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 bio_check_eod block/blk-core.c:609 [inline]
 submit_bio_noacct+0x85f/0x920 block/blk-core.c:843
 submit_bio+0x2a4/0x2c0 block/blk-core.c:962
 mpage_bio_submit_write fs/mpage.c:82 [inline]
 mpage_write_folio fs/mpage.c:593 [inline]
 __mpage_writepages+0x946/0x1370 fs/mpage.c:686
 mpage_writepages include/linux/mpage.h:27 [inline]
 fat_writepages+0x26/0x30 fs/fat/inode.c:200
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2571
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_fdatawrite_range mm/filemap.c:412 [inline]
 filemap_fdatawrite+0x100/0x140 mm/filemap.c:418
 writeback_inode fs/fat/inode.c:1888 [inline]
 fat_flush_inodes+0xcc/0x150 fs/fat/inode.c:1906
 fat_truncate_blocks+0x536/0x5b0 fs/fat/file.c:399
 fat_write_failed fs/fat/inode.c:219 [inline]
 fat_write_begin+0xc0/0xe0 fs/fat/inode.c:234
 generic_perform_write+0x186/0x490 mm/filemap.c:4358
 __generic_file_write_iter+0x9e/0x120 mm/filemap.c:4475
 generic_file_write_iter+0x77/0x1f0 mm/filemap.c:4501
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57d/0x990 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x27e1/0x3020 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893e71f0 of 8 bytes by task 40 on cpu 1:
 wb_domain_writeout_add mm/page-writeback.c:557 [inline]
 __wb_writeout_add+0x81/0x1b0 mm/page-writeback.c:578
 __folio_end_writeback+0x14b/0x360 mm/page-writeback.c:2976
 folio_end_writeback_no_dropbehind+0x6d/0x1d0 mm/filemap.c:1666
 folio_end_writeback+0x1c/0x70 mm/filemap.c:1692
 ext4_finish_bio+0x454/0x770 fs/ext4/page-io.c:144
 ext4_release_io_end+0x9f/0x1f0 fs/ext4/page-io.c:159
 ext4_end_io_end+0x18d/0x240 fs/ext4/page-io.c:210
 ext4_do_flush_completed_IO fs/ext4/page-io.c:290 [inline]
 ext4_end_io_rsv_work+0x15b/0x1f0 fs/ext4/page-io.c:305
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
 worker_thread+0x569/0x750 kernel/workqueue.c:3486
 kthread+0x221/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000ffffa020 -> 0x00000000ffffa14c

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/30 06:43 upstream dc59e4fea9d8 fff8d0a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_writeout_add / writeout_period
* Struck through repros no longer work on HEAD.