[moderation] [exfat?] KCSAN: data-race in xas_find_marked / xas_init_marks (6)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d69eb204c255 Merge tag 'net-6.17-rc5' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13487162580000
kernel config: https://syzkaller.appspot.com/x/.config?x=52ae2e92d7a28724
dashboard link: https://syzkaller.appspot.com/bug?extid=6dd7d6284327c0bf326f
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
CC: [hiro...@mail.parknet.co.jp linki...@kernel.org linux-...@vger.kernel.org linux-...@vger.kernel.org sj155...@samsung.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/71b57e193725/disk-d69eb204.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fe6e375bf647/vmlinux-d69eb204.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e9d043c98cdb/bzImage-d69eb204.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6dd7d6...@syzkaller.appspotmail.com

loop4: rw=2049, sector=217, nr_sectors = 8 limit=128
==================================================================
BUG: KCSAN: data-race in xas_find_marked / xas_init_marks

read-write to 0xffff88811920e480 of 8 bytes by task 6506 on cpu 1:
instrument_read_write include/linux/instrumented.h:55 [inline]
__instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
node_clear_mark lib/xarray.c:102 [inline]
xas_clear_mark lib/xarray.c:922 [inline]
xas_init_marks+0x18a/0x320 lib/xarray.c:955
xas_store+0x3cf/0xce0 lib/xarray.c:817
page_cache_delete_batch mm/filemap.c:310 [inline]
delete_from_page_cache_batch+0x30a/0x6f0 mm/filemap.c:332
truncate_inode_pages_range+0x1b8/0x690 mm/truncate.c:380
truncate_inode_pages mm/truncate.c:460 [inline]
truncate_pagecache mm/truncate.c:769 [inline]
truncate_setsize+0x9b/0xc0 mm/truncate.c:794
fat_setattr+0x77b/0x8a0 fs/fat/file.c:550
notify_change+0x806/0x890 fs/attr.c:552
do_truncate fs/open.c:68 [inline]
do_ftruncate+0x34b/0x450 fs/open.c:195
do_sys_ftruncate fs/open.c:210 [inline]
__do_sys_ftruncate fs/open.c:215 [inline]
__se_sys_ftruncate fs/open.c:213 [inline]
__x64_sys_ftruncate+0x68/0xc0 fs/open.c:213
x64_sys_call+0x2d52/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:78
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811920e480 of 8 bytes by task 6504 on cpu 0:
xas_find_chunk include/linux/xarray.h:1752 [inline]
xas_find_marked+0x218/0x620 lib/xarray.c:1510
find_get_entry+0x5d/0x380 mm/filemap.c:2039
filemap_get_folios_tag+0x92/0x210 mm/filemap.c:2307
writeback_get_folio mm/page-writeback.c:2461 [inline]
writeback_iter+0x4bb/0x820 mm/page-writeback.c:2562
mpage_writepages+0x718/0x1250 fs/mpage.c:663
fat_writepages+0x24/0x30 fs/fat/inode.c:199
do_writepages+0x1c6/0x310 mm/page-writeback.c:2634
filemap_fdatawrite_wbc mm/filemap.c:386 [inline]
__filemap_fdatawrite_range mm/filemap.c:419 [inline]
file_write_and_wait_range+0x156/0x2c0 mm/filemap.c:794
__generic_file_fsync+0x46/0x140 fs/libfs.c:1539
fat_file_fsync+0x49/0x100 fs/fat/file.c:191
vfs_fsync_range fs/sync.c:187 [inline]
vfs_fsync fs/sync.c:201 [inline]
do_fsync fs/sync.c:212 [inline]
__do_sys_fdatasync fs/sync.c:222 [inline]
__se_sys_fdatasync fs/sync.c:220 [inline]
__x64_sys_fdatasync+0x80/0xe0 fs/sync.c:220
x64_sys_call+0x2f83/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:76
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000e00000000 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6504 Comm: syz.4.1107 Tainted: G W syzkaller #0 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================
syz.4.1107: attempt to access beyond end of device
loop4: rw=2049, sector=233, nr_sectors = 8 limit=128


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup