KCSAN: data-race in mas_wmb_replace / mtree_range_walk (2)

Status: moderation: reported C repro on 2026/04/16 07:19
Subsystems: mm
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+7265211618d78be5c8e2@syzkaller.appspotmail.com
First crash: 200d, last: 4d16h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
2ef9e8fe assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in mas_wmb_replace / mtree_range_walk (2) 2026/05/25 22:38 2026/05/25 22:38 2026/05/25 23:31 c69befb3
ed78a0ab assessment-kcsan Benign: ✅ Confident: ✅ ❓ KCSAN: data-race in mas_wmb_replace / mtree_range_walk (2) 2026/04/16 07:18 2026/04/16 07:18 2026/04/16 07:41 df15c5f3
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_wmb_replace / mtree_range_walk mm 6 566 557d 1027d 0/29 auto-obsoleted due to no activity on 2025/06/12 01:09

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_wmb_replace / mtree_range_walk

write to 0xffff888107756600 of 8 bytes by task 3639 on cpu 0:
 mte_set_node_dead lib/maple_tree.c:305 [inline]
 mas_put_in_tree lib/maple_tree.c:1652 [inline]
 mas_topiary_replace lib/maple_tree.c:1896 [inline]
 mas_wmb_replace+0x242/0x1870 lib/maple_tree.c:2151
 mas_wr_store_entry+0x54d7/0x5ac0 lib/maple_tree.c:-1
 mas_store_prealloc+0x421/0x670 lib/maple_tree.c:5031
 vma_iter_store_overwrite mm/vma.h:704 [inline]
 vma_iter_store_new mm/vma.h:711 [inline]
 vma_complete+0x3b7/0x830 mm/vma.c:403
 __split_vma+0x6be/0x720 mm/vma.c:613
 split_vma mm/vma.c:643 [inline]
 vma_modify+0xc98/0xd50 mm/vma.c:1779
 vma_modify_flags+0x1be/0x250 mm/vma.c:1799
 mprotect_fixup+0x382/0x660 mm/mprotect.c:824
 do_mprotect_pkey+0x69f/0x950 mm/mprotect.c:1002
 __do_sys_mprotect mm/mprotect.c:1023 [inline]
 __se_sys_mprotect mm/mprotect.c:1020 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:1020
 x64_sys_call+0xd54/0x2550 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888107756600 of 8 bytes by task 3655 on cpu 1:
 ma_dead_node lib/maple_tree.c:505 [inline]
 mtree_range_walk+0x35a/0x480 lib/maple_tree.c:2119
 mas_state_walk lib/maple_tree.c:3013 [inline]
 mas_walk+0x1ac/0x340 lib/maple_tree.c:4458
 lock_vma_under_rcu+0xc9/0x210 mm/mmap_lock.c:304
 do_user_addr_fault+0x239/0x1060 arch/x86/mm/fault.c:1334
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

value changed: 0xffff8881044cd141 -> 0xffff888107756600

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3655 Comm: syz-executor310 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (95):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/02 21:55 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 5e0f8396d480 38f7f0d1 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/28 22:21 upstream 65ba8f34ec88 858db2ec .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/24 01:29 upstream 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/17 21:35 upstream 58161ead29e5 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/16 22:57 upstream 2f2f7eeef8b0 4c840a2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/16 03:14 upstream 9aa622dbaab8 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/15 19:37 upstream 9aa622dbaab8 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/14 10:31 upstream ca3e345926b0 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/10 07:40 upstream fc1c25014ff8 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/10/03 15:06 upstream e767a4ea70a3 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/27 12:07 upstream fddfc3ec3179 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/25 13:53 upstream f49a343b305c f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/25 01:33 upstream f49a343b305c 3c3cdf19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/21 01:29 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/13 16:44 upstream 2f0c1cf72f46 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/09 08:57 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/09/06 01:01 upstream 0d9ff90a5422 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/25 17:21 upstream 66498c75b4f8 a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/23 04:32 upstream 66fb95a52111 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/18 12:04 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/17 02:16 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/14 07:30 upstream 3aa1dcaa4f6f b13552fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/12 09:08 upstream f5bbbfec59b4 f8d35649 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/09 15:15 upstream 06cf61899d64 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/08 06:30 upstream bcc44b6785f2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/08/01 08:47 upstream 0131b508c0e2 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/30 06:39 upstream fc46aed51f62 6ef5c1e2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/25 22:24 upstream 0ce37745d4bf 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/22 09:32 upstream 248951ddc14d b561ce9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/21 08:09 upstream b95f03f04d47 de6a700d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/20 06:55 upstream 82a47586c0b9 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/19 06:05 upstream 1229e2e57a5c 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/15 18:03 upstream 58717b2a1365 a4ed0f4f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/15 01:19 upstream 3b029c035b34 2130f682 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/13 04:07 upstream f4fb100039e9 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/11 14:48 upstream 61c03dfde854 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/08 03:06 upstream 0e35b9b6ec0f 76cdc0c0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/05 20:53 upstream f105f3631d51 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/04 18:28 upstream 1e9cdc2ea15a fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/03 21:18 upstream 71dfdfb0209b fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/03 18:08 upstream 51512e22efe8 58bf2096 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/07/02 22:31 upstream 4a50a141f05a 2b70b115 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/06/28 20:15 upstream 8b69c0475871 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/06/27 23:29 upstream 780d569e6c4b fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/06/27 12:15 upstream 5a66900afbd6 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/06/27 03:16 upstream 51cb1aa1250c fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/06/22 22:20 upstream 1dc18801be29 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/05/24 19:40 upstream 4cbfe4502e3d c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/24 10:01 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/23 14:51 upstream 2e6803928193 4c3406dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/22 18:41 upstream 6596a02b2078 4595e353 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/20 01:45 upstream c1f49dea2b8f 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/19 05:12 upstream eb5249b12507 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/18 09:29 upstream 8541d8f725c6 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
2026/04/16 07:18 upstream aec2f682d47c df15c5f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_wmb_replace / mtree_range_walk
* Struck through repros no longer work on HEAD.