Re: [syzbot] [mm?] KCSAN: data-race in copy_mm / lru_gen_del_mm (3)

[Barry Song]

On Mon, Sep 21, 2026 at 9:03 AM syzbot
<syzbot+c6e1b1b32ff2fc3b7d60@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit:    17e7b8eacf4c Merge tag 'cifs-fixes-7.3-rc4' of https://git..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11d6c525580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8372e2cd52628d4f
> dashboard link: https://syzkaller.appspot.com/bug?extid=c6e1b1b32ff2fc3b7d60
> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/60ea54622289/disk-17e7b8ea.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/675e38c8bebf/vmlinux-17e7b8ea.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/1006b8efd827/bzImage-17e7b8ea.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c6e1b1b32ff2fc3b7d60@xxxxxxxxxxxxxxxxxxxxxxxxx
>
> ==================================================================
> BUG: KCSAN: data-race in copy_mm / lru_gen_del_mm
>
> write to 0xffff8881077eb088 of 8 bytes by task 7336 on cpu 0:
>  __list_del include/linux/list.h:241 [inline]
>  __list_del_entry include/linux/list.h:264 [inline]
>  list_del_init include/linux/list.h:333 [inline]
>  lru_gen_del_mm+0x299/0x3e0 mm/vmscan.c:2998
>  __mmput+0x17a/0x1c0 kernel/fork.c:1203
>  mmput+0x40/0x50 kernel/fork.c:1216
>  exit_mm+0x113/0x1a0 kernel/exit.c:617
>  do_exit+0x438/0x1510 kernel/exit.c:999
>  do_group_exit+0x138/0x140 kernel/exit.c:1154
>  __do_sys_exit_group kernel/exit.c:1165 [inline]
>  __se_sys_exit_group kernel/exit.c:1163 [inline]
>  __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1163
>  x64_sys_call+0x254f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:232
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> read to 0xffff8881077eaa00 of 1728 bytes by task 7337 on cpu 1:
>  dup_mm kernel/fork.c:1537 [inline]
>  copy_mm+0xd6/0x340 kernel/fork.c:1595

I guess all we need is:

diff --git a/kernel/fork.c b/kernel/fork.c
index 22283bf849e1..696021c459d9 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1532,7 +1532,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk,
        if (!mm)
                goto fail_nomem;

-       memcpy(mm, oldmm, sizeof(*mm));
+       data_race(memcpy(mm, oldmm, sizeof(*mm)));

        if (!mm_init(mm, tsk))
                goto fail_nomem;

As we don't really care about the data copied by `memcpy()`, since
`lru_gen_init_mm()` will reinitialize the lru_gen state in the new `mm`.

static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p)
{
        ...
        lru_gen_init_mm(mm);
        return mm;
        ...
}

static inline void lru_gen_init_mm(struct mm_struct *mm)
{
        INIT_LIST_HEAD(&mm->lru_gen.list);
        mm->lru_gen.bitmap = 0;
#ifdef CONFIG_MEMCG
        mm->lru_gen.memcg = NULL;
#endif
}

>  copy_process+0x10ad/0x2340 kernel/fork.c:2310
>  kernel_clone+0x1c0/0x5f0 kernel/fork.c:2769
>  __do_sys_clone kernel/fork.c:2911 [inline]
>  __se_sys_clone kernel/fork.c:2895 [inline]
>  __x64_sys_clone+0x143/0x180 kernel/fork.c:2895
>  x64_sys_call+0x2479/0x2550 arch/x86/include/generated/asm/syscalls_64.h:57
>  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
>  do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Reported by Kernel Concurrency Sanitizer on:
> CPU: 1 UID: 0 PID: 7337 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(lazy)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
> ==================================================================

Best Regards
Barry