[moderation] [exfat?] KCSAN: data-race in delete_from_page_cache_batch / filemap_write_and_wait_range (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7f7072574127 Merge tag 'kbuild-6.18-1' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113cc92f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1c0b4663059de6a6
dashboard link: https://syzkaller.appspot.com/bug?extid=7944b52826307871707c
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
CC: [hiro...@mail.parknet.co.jp linki...@kernel.org linux-...@vger.kernel.org linux-...@vger.kernel.org sj155...@samsung.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b352170d9a4d/disk-7f707257.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2f306abd3fab/vmlinux-7f707257.xz
kernel image: https://storage.googleapis.com/syzbot-assets/deb01400860b/bzImage-7f707257.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7944b5...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in delete_from_page_cache_batch / filemap_write_and_wait_range

read-write to 0xffff88811942be60 of 8 bytes by task 16400 on cpu 0:
page_cache_delete_batch mm/filemap.c:313 [inline]
delete_from_page_cache_batch+0x4f1/0x6f0 mm/filemap.c:332
truncate_inode_pages_range+0x1b8/0x690 mm/truncate.c:380
truncate_inode_pages mm/truncate.c:460 [inline]
truncate_pagecache+0x53/0x70 mm/truncate.c:769
fat_write_failed fs/fat/inode.c:217 [inline]
fat_write_end+0xa5/0x160 fs/fat/inode.c:246
generic_perform_write+0x312/0x490 mm/filemap.c:4196
__generic_file_write_iter+0x9e/0x120 mm/filemap.c:4292
generic_file_write_iter+0x8d/0x2f0 mm/filemap.c:4318
do_iter_readv_writev+0x4a1/0x540 fs/read_write.c:-1
vfs_writev+0x2df/0x8b0 fs/read_write.c:1057
do_pwritev fs/read_write.c:1153 [inline]
__do_sys_pwritev2 fs/read_write.c:1211 [inline]
__se_sys_pwritev2+0xfc/0x1c0 fs/read_write.c:1202
__x64_sys_pwritev2+0x67/0x80 fs/read_write.c:1202
x64_sys_call+0x2c59/0x3000 arch/x86/include/generated/asm/syscalls_64.h:329
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811942be60 of 8 bytes by task 16403 on cpu 1:
mapping_needs_writeback mm/filemap.c:641 [inline]
filemap_write_and_wait_range+0x59/0x340 mm/filemap.c:690
kiocb_write_and_wait mm/filemap.c:2802 [inline]
generic_file_read_iter+0x101/0x330 mm/filemap.c:2876
copy_splice_read+0x43f/0x660 fs/splice.c:363
do_splice_read fs/splice.c:981 [inline]
splice_direct_to_actor+0x290/0x680 fs/splice.c:1086
do_splice_direct_actor fs/splice.c:1204 [inline]
do_splice_direct+0xda/0x150 fs/splice.c:1230
do_sendfile+0x380/0x650 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64 fs/read_write.c:1417 [inline]
__x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1417
x64_sys_call+0x2bb4/0x3000 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000000000a -> 0x0000000000000009

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 16403 Comm: syz.3.2467 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup