KCSAN: data-race in xas_clear_mark / xas_find_marked (2)

Status: moderation: reported C repro on 2019/12/10 21:55
Subsystems: fs mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+6b653cb0a28eee8c400a@syzkaller.appspotmail.com
First crash: 2550d, last: 8d08h
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
17d15640 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/05/18 06:10 2026/05/18 06:10 2026/05/18 06:48 de5aae85
7d0095a6 repro ❓ KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/03/08 10:38 2026/03/08 10:38 2026/03/08 10:41 31e9c887
f45266b7 assessment-kcsan Benign: ✅ Confident: ✅ ❓ KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/02/24 23:23 2026/02/24 23:23 2026/02/24 23:26 305c0ec5
20dbd26a assessment-kcsan 💥 KCSAN: data-race in xas_clear_mark / xas_find_marked (2) 2026/01/10 06:45 2026/01/10 06:45 2026/01/10 07:03 75199160
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_clear_mark / xas_find_marked mm 6 3 2555d 2561d 0/29 closed as invalid on 2019/10/18 14:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in xas_clear_mark / xas_find_marked

read-write to 0xffff88810b89e228 of 8 bytes by task 3641 on cpu 0:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark+0x91/0x180 lib/xarray.c:922
 __folio_start_writeback+0x23f/0x370 mm/page-writeback.c:3026
 ext4_bio_write_folio+0x5a2/0xa10 fs/ext4/page-io.c:541
 mpage_submit_folio fs/ext4/inode.c:2094 [inline]
 mpage_process_page_bufs+0x484/0x5e0 fs/ext4/inode.c:2201
 mpage_prepare_extent_to_map+0x83e/0xca0 fs/ext4/inode.c:2743
 ext4_do_writepages+0x70f/0x2870 fs/ext4/inode.c:2884
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810b89e228 of 8 bytes by task 3639 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1513
 find_get_entry mm/filemap.c:2087 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2353
 mpage_prepare_extent_to_map+0x32a/0xca0 fs/ext4/inode.c:2634
 ext4_do_writepages+0x70f/0x2870 fs/ext4/inode.c:2884
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xfffffffff0000000 -> 0xfffffff800000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3639 Comm: syz-executor399 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in xas_clear_mark / xas_find_marked

read-write to 0xffff88810b89e228 of 8 bytes by task 3641 on cpu 0:
 instrument_read_write include/linux/instrumented.h:56 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark+0x91/0x180 lib/xarray.c:922
 __folio_start_writeback+0x23f/0x370 mm/page-writeback.c:3026
 ext4_bio_write_folio+0x5a2/0xa10 fs/ext4/page-io.c:541
 mpage_submit_folio fs/ext4/inode.c:2094 [inline]
 mpage_process_page_bufs+0x484/0x5e0 fs/ext4/inode.c:2201
 mpage_prepare_extent_to_map+0x83e/0xca0 fs/ext4/inode.c:2743
 ext4_do_writepages+0x70f/0x2870 fs/ext4/inode.c:2884
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810b89e228 of 8 bytes by task 3639 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1752 [inline]
 xas_find_marked+0x211/0x650 lib/xarray.c:1513
 find_get_entry mm/filemap.c:2087 [inline]
 filemap_get_folios_tag+0xf7/0x400 mm/filemap.c:2353
 mpage_prepare_extent_to_map+0x32a/0xca0 fs/ext4/inode.c:2634
 ext4_do_writepages+0x70f/0x2870 fs/ext4/inode.c:2884
 ext4_writepages+0x191/0x300 fs/ext4/inode.c:3032
 do_writepages+0x1b9/0x300 mm/page-writeback.c:2560
 filemap_writeback mm/filemap.c:387 [inline]
 filemap_flush_range+0x105/0x140 mm/filemap.c:436
 sync_file_range+0x1c2/0x240 fs/sync.c:286
 ksys_sync_file_range fs/sync.c:356 [inline]
 __do_sys_sync_file_range fs/sync.c:362 [inline]
 __se_sys_sync_file_range fs/sync.c:359 [inline]
 __x64_sys_sync_file_range+0x7b/0xd0 fs/sync.c:359
 x64_sys_call+0xda6/0x2550 arch/x86/include/generated/asm/syscalls_64.h:278
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffffffffff000000 -> 0xfffffffffc000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3639 Comm: syz-executor399 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4176):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 06:09 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 72d3fcf802c4 7bf4ea23 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/10/07 14:50 upstream 602042bf29f6 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/10/03 23:06 upstream a74306e2e676 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/10/01 15:43 upstream 551c722f4080 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/30 12:21 upstream 551c722f4080 7808aef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/26 13:52 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/25 11:13 upstream f49a343b305c f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/19 16:59 upstream 40288c9206c1 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/15 21:25 upstream f6e7b42bf05b 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/15 13:38 upstream 587858367581 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/14 15:49 upstream 704340f1cd0d 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/13 20:48 upstream d681d7ef617e 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/13 08:00 upstream 2f0c1cf72f46 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/09/10 13:53 upstream 50d05c7c76c9 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/08/28 09:23 upstream 1b78070aaef6 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/08/10 17:30 upstream db2ddb871435 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/07/27 04:04 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/29 02:30 upstream dc59e4fea9d8 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/22 11:56 upstream ef0c9f75a195 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/11 11:57 upstream 9716c086c8e8 b754d2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/08 01:52 upstream 33d8d8ec31b5 cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/06 14:52 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/06/01 21:17 upstream e43ffb69e043 1095583b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/31 00:09 upstream 9d87d0fc8c8e 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/20 00:13 upstream 27fa82620cba 0909d65f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/13 09:42 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/12 18:35 upstream c21b90f77687 07aeade5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/10 23:20 upstream 5d6919055dec 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/09 22:52 upstream e92b2872d0b1 29233ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/07 17:28 upstream 8ab992f815d6 cbf9e0fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/06 13:20 upstream 74fe02ce122a 1dddfd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/05 23:19 upstream 9207d47f966b 26da2c66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 22:08 upstream c7e4e4d5f7dc a898ba9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 18:36 upstream 6d35786de281 85f1bcf2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/04 07:26 upstream 6d35786de281 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/03 18:07 upstream f377d0025eb0 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/03 10:31 upstream 66edb901bf87 a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/01 19:47 upstream 6fe0be6dc7fa 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/05/01 11:22 upstream 26fd6bff2c05 753c55b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/30 05:05 upstream 57b8e2d666a3 005438fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/27 20:50 upstream 254f49634ee1 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/19 11:11 upstream faeab166167f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/12 13:41 upstream f5459048c38a 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/10 12:10 upstream 9a9c8ce300cd 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/09 17:49 upstream 8b02520ec5f7 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/09 04:40 upstream 7f87a5ea75f0 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/04/05 01:55 upstream 7ca6d1cfec80 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/29 02:41 upstream cbfffcca2bf0 b5ceaad2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/03/08 10:26 upstream c23719abc330 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/02/21 12:02 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2026/01/03 15:10 upstream 805f9a061372 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in xas_clear_mark / xas_find_marked
2021/01/17 10:22 upstream 0da0a8a0a0e1 813be542 .config console log report info ci2-upstream-kcsan-gce
2019/10/22 14:09 https://github.com/google/ktsan.git kcsan 05f2236801fe 4ee855e7 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.