KCSAN: data-race in copy_mm / copy_page_range (3)

Status: moderation: reported on 2025/11/07 06:03
Subsystems: mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+5171c42274384b4a4dab@syzkaller.appspotmail.com
First crash: 278d, last: 30d
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
6f1bc408 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in copy_mm / copy_page_range (3) 2026/05/20 08:09 2026/05/20 08:09 2026/05/20 08:50 0909d65f
98e1cfd7 repro 💥 KCSAN: data-race in copy_mm / copy_page_range (3) 2026/03/10 12:17 2026/03/10 12:17 2026/03/10 12:17 5c03941b
0d9fc11b assessment-kcsan Benign: ✅ KCSAN: data-race in copy_mm / copy_page_range (3) 2026/01/12 18:00 2026/01/12 18:00 2026/01/12 18:21 dc57dbf3
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in copy_mm / copy_page_range mm 6 3 416d 471d 0/29 auto-obsoleted due to no activity on 2025/08/17 07:05
upstream KCSAN: data-race in copy_mm / copy_page_range (2) mm 6 1 339d 339d 0/29 auto-obsoleted due to no activity on 2025/11/03 02:56

Sample crash report:
==================================================================
BUG: KCSAN: data-race in copy_mm / copy_page_range

write to 0xffff888104c0b9f8 of 8 bytes by task 3969 on cpu 1:
 __list_add include/linux/list.h:161 [inline]
 list_add include/linux/list.h:177 [inline]
 copy_nonpresent_pte mm/memory.c:960 [inline]
 copy_pte_range mm/memory.c:1296 [inline]
 copy_pmd_range mm/memory.c:1408 [inline]
 copy_pud_range mm/memory.c:1445 [inline]
 copy_p4d_range mm/memory.c:1469 [inline]
 copy_page_range+0x25e4/0x3400 mm/memory.c:1555
 dup_mmap+0x870/0x10b0 mm/mmap.c:1840
 dup_mm kernel/fork.c:1543 [inline]
 copy_mm+0xfa/0x340 kernel/fork.c:1595
 copy_process+0x108c/0x2310 kernel/fork.c:2289
 kernel_clone+0x1c0/0x5f0 kernel/fork.c:2748
 __do_sys_clone kernel/fork.c:2889 [inline]
 __se_sys_clone kernel/fork.c:2873 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2873
 x64_sys_call+0x1222/0x3020 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104c0b800 of 1728 bytes by task 3962 on cpu 0:
 dup_mm kernel/fork.c:1537 [inline]
 copy_mm+0xd6/0x340 kernel/fork.c:1595
 copy_process+0x108c/0x2310 kernel/fork.c:2289
 kernel_clone+0x1c0/0x5f0 kernel/fork.c:2748
 __do_sys_clone kernel/fork.c:2889 [inline]
 __se_sys_clone kernel/fork.c:2873 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2873
 x64_sys_call+0x1222/0x3020 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3962 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/13 09:30 upstream a13c140cc289 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2026/05/21 17:08 upstream 758c807bb943 e195359d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2026/04/18 07:03 upstream 8541d8f725c6 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2026/03/12 14:27 upstream 80234b5ab240 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2026/01/17 05:27 upstream b62ce2547fe8 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2025/11/30 15:17 upstream 6bda50f4333f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2025/11/20 06:49 upstream 23cb64fb7625 26ee5237 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2025/11/19 03:31 upstream 5bebe8de1926 ef766cd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2025/11/18 09:34 upstream e7c375b18160 ef766cd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
2025/11/07 06:02 upstream c2c2ccfd4ba7 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / copy_page_range
* Struck through repros no longer work on HEAD.