KCSAN: data-race in copy_mm / lru_gen_del_mm (3)

Status: upstream: reported on 2026/09/21 01:03
Subsystems: mm
Labels: prio:low race:harmful
[Documentation on labels]
Reported-by: syzbot+c6e1b1b32ff2fc3b7d60@syzkaller.appspotmail.com
First crash: 47d, last: 8d23h
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
a3553e76 repro-c Reproduced: ✅ ❓ KCSAN: data-race in copy_mm / lru_gen_del_mm (3) 2026/10/04 20:29 2026/10/04 20:30 2026/10/04 23:40 57bbd979
fa90a9de assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in copy_mm / lru_gen_del_mm (3) 2026/09/21 00:02 2026/09/21 00:02 2026/09/21 00:46 853b104b
ac24de7e assessment-kcsan Benign: ❌ ❓ KCSAN: data-race in copy_mm / lru_gen_del_mm (3) 2026/09/21 00:02 2026/09/21 00:02 2026/09/21 01:02 853b104b
5f05a71a assessment-kcsan 💥 KCSAN: data-race in copy_mm / lru_gen_del_mm (3) 2026/09/19 01:55 2026/09/19 01:55 2026/09/19 03:15 853b104b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in copy_mm / lru_gen_del_mm (3) 1 (2) 2026/09/21 05:44
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in copy_mm / lru_gen_del_mm mm 6 4 243d 290d 0/29 auto-obsoleted due to no activity on 2026/05/01 15:24
upstream KCSAN: data-race in copy_mm / lru_gen_del_mm (2) race:benign prio:low mm 6 1 109d 109d 0/29 auto-obsoleted due to no activity on 2026/09/12 18:50
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/10/05 00:03 32m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git a90ee4305c4a5df72c11b31dacfdc76e00fcf78a report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in copy_mm / lru_gen_del_mm

write to 0xffff88810abd1a98 of 8 bytes by task 29367 on cpu 0:
 __list_del include/linux/list.h:241 [inline]
 __list_del_entry include/linux/list.h:264 [inline]
 list_del_init include/linux/list.h:333 [inline]
 lru_gen_del_mm+0x299/0x3e0 mm/vmscan.c:3118
 __mmput+0x17a/0x1c0 kernel/fork.c:1201
 mmput+0x3b/0x50 kernel/fork.c:1214
 exit_mm+0x11b/0x1b0 kernel/exit.c:586
 do_exit+0x437/0x14f0 kernel/exit.c:967
 do_group_exit+0x138/0x140 kernel/exit.c:1123
 __do_sys_exit_group kernel/exit.c:1134 [inline]
 __se_sys_exit_group kernel/exit.c:1132 [inline]
 __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1132
 x64_sys_call+0x254f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810abd1440 of 1664 bytes by task 29368 on cpu 1:
 dup_mm kernel/fork.c:1535 [inline]
 copy_mm+0xd1/0x340 kernel/fork.c:1593
 copy_process+0x10e9/0x23f0 kernel/fork.c:2319
 kernel_clone+0x1c0/0x5f0 kernel/fork.c:2783
 __do_sys_clone kernel/fork.c:2925 [inline]
 __se_sys_clone kernel/fork.c:2909 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2909
 x64_sys_call+0x2479/0x2550 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 29368 Comm: dhcpcd-run-hook Tainted: G                   Y syzkaller #0 PREEMPT(lazy) 
Tainted: [Y]=FORCED_BIND
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/27 11:25 upstream d135ab453a74 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / lru_gen_del_mm
2026/10/12 15:56 upstream 24a19b953e2a 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / lru_gen_del_mm
2026/09/19 01:36 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_mm / lru_gen_del_mm
* Struck through repros no longer work on HEAD.