KCSAN: data-race in fat12_ent_put / fat_mirror_bhs (2)

Status: upstream: reported on 2026/09/12 14:38
Subsystems: exfat
Labels: race:harmful prio:high
[Documentation on labels]
Reported-by: syzbot+ff8bd63dc02136db5a1a@syzkaller.appspotmail.com
First crash: 45d, last: 17d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
31e68675 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in fat12_ent_put / fat_mirror_bhs (2) 2026/09/14 01:25 2026/09/14 01:25 2026/09/14 01:28 70a60e12
2b378d84 assessment-kcsan Benign: ❌ ❓ KCSAN: data-race in fat12_ent_put / fat_mirror_bhs (2) 2026/09/12 13:54 2026/09/12 13:54 2026/09/12 14:37 70a60e12
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [exfat?] KCSAN: data-race in fat12_ent_put / fat_mirror_bhs (2) 0 (1) 2026/09/12 14:38
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in fat12_ent_put / fat_mirror_bhs prio:low exfat 6 68 120d 263d 0/29 auto-obsoleted due to no activity on 2026/08/24 11:30

Sample crash report:
==================================================================
BUG: KCSAN: data-race in fat12_ent_put / fat_mirror_bhs

write to 0xffff888123a4081e of 1 bytes by task 12727 on cpu 0:
 fat12_ent_put+0x74/0x180 fs/fat/fatent.c:168
 fat_free_clusters+0x2cc/0x8b0 fs/fat/fatent.c:602
 fat_free fs/fat/file.c:379 [inline]
 fat_truncate_blocks+0x524/0x5b0 fs/fat/file.c:397
 fat_write_failed fs/fat/inode.c:219 [inline]
 fat_write_end+0xba/0x160 fs/fat/inode.c:247
 generic_perform_write+0x314/0x490 mm/filemap.c:4395
 __generic_file_write_iter+0x9e/0x120 mm/filemap.c:4491
 generic_file_write_iter+0x77/0x1f0 mm/filemap.c:4517
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_pwrite64 fs/read_write.c:794 [inline]
 __do_sys_pwrite64 fs/read_write.c:802 [inline]
 __se_sys_pwrite64 fs/read_write.c:799 [inline]
 __x64_sys_pwrite64+0xfd/0x150 fs/read_write.c:799
 x64_sys_call+0x23be/0x2550 arch/x86/include/generated/asm/syscalls_64.h:19
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888123a40800 of 2048 bytes by task 12737 on cpu 1:
 fat_mirror_bhs+0x1df/0x330 fs/fat/fatent.c:399
 fat_ent_write+0xd0/0xe0 fs/fat/fatent.c:428
 fat_chain_add+0x170/0x4c0 fs/fat/misc.c:138
 fat_add_cluster fs/fat/inode.c:113 [inline]
 __fat_get_block fs/fat/inode.c:155 [inline]
 fat_get_block+0x468/0x5e0 fs/fat/inode.c:190
 __block_write_begin_int+0x400/0xf90 fs/buffer.c:2030
 block_write_begin fs/buffer.c:2144 [inline]
 cont_write_begin+0x5bf/0x920 fs/buffer.c:2506
 fat_write_begin+0x52/0xe0 fs/fat/inode.c:230
 cont_expand_zero fs/buffer.c:2434 [inline]
 cont_write_begin+0x18d/0x920 fs/buffer.c:2496
 fat_write_begin+0x52/0xe0 fs/fat/inode.c:230
 generic_cont_expand_simple+0xb0/0x150 fs/buffer.c:2397
 fat_cont_expand+0x3e/0x170 fs/fat/file.c:226
 fat_fallocate+0x177/0x1c0 fs/fat/file.c:304
 vfs_fallocate+0x3ac/0x400 fs/open.c:338
 ksys_fallocate fs/open.c:362 [inline]
 __do_sys_fallocate fs/open.c:367 [inline]
 __se_sys_fallocate fs/open.c:365 [inline]
 __x64_sys_fallocate+0x7a/0xd0 fs/open.c:365
 x64_sys_call+0x1e1d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:286
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12737 Comm: syz.5.2170 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/10 11:42 upstream fc1c25014ff8 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in fat12_ent_put / fat_mirror_bhs
2026/09/15 05:48 upstream 587858367581 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in fat12_ent_put / fat_mirror_bhs
2026/09/12 20:55 upstream 5225b8eec4c9 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in fat12_ent_put / fat_mirror_bhs
2026/09/12 13:54 upstream 3026c6e4f223 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in fat12_ent_put / fat_mirror_bhs
* Struck through repros no longer work on HEAD.