[moderation] [exfat?] KCSAN: data-race in find_get_block_common / has_bh_in_lru

Hello,

syzbot found the following issue on:

HEAD commit: f1a3944c860b Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=161ff574580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fc7049672597c030
dashboard link: https://syzkaller.appspot.com/bug?extid=a4a07f98f629cf636e9e
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
CC: [[email protected] [email protected] [email protected] [email protected] [email protected]]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/bd20a472b952/disk-f1a3944c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/89776628f114/vmlinux-f1a3944c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/627350ad7741/bzImage-f1a3944c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

==================================================================
BUG: KCSAN: data-race in find_get_block_common / has_bh_in_lru

read-write to 0xffff888237c26b70 of 8 bytes by task 4238 on cpu 0:
bh_lru_install fs/buffer.c:1350 [inline]
find_get_block_common+0x4f0/0x960 fs/buffer.c:1415
__find_get_block_nonatomic fs/buffer.c:1434 [inline]
bdev_getblk+0x7f/0x3d0 fs/buffer.c:1458
__bread_gfp+0x51/0x250 fs/buffer.c:1520
sb_bread include/linux/buffer_head.h:348 [inline]
fat__get_entry fs/fat/dir.c:100 [inline]
fat_get_entry+0x46e/0x5d0 fs/fat/dir.c:128
fat_search_long+0x23b/0x9c0 fs/fat/dir.c:490
vfat_find fs/fat/namei_vfat.c:695 [inline]
vfat_lookup+0xd5/0x2d0 fs/fat/namei_vfat.c:709
lookup_open fs/namei.c:3679 [inline]
open_last_lookups fs/namei.c:3800 [inline]
path_openat+0xcf0/0x2170 fs/namei.c:4036
do_filp_open+0x109/0x230 fs/namei.c:4066
do_sys_openat2+0xa6/0x110 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0xf2/0x120 fs/open.c:1455
x64_sys_call+0x1af/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c26b70 of 8 bytes by task 3305 on cpu 1:
has_bh_in_lru+0x35/0x1f0 fs/buffer.c:1556
smp_call_function_many_cond+0x394/0xb20 kernel/smp.c:838
on_each_cpu_cond_mask+0x3c/0x80 kernel/smp.c:1052
on_each_cpu_cond include/linux/smp.h:105 [inline]
invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1565
kill_bdev block/bdev.c:90 [inline]
blkdev_flush_mapping+0x9a/0x1a0 block/bdev.c:712
blkdev_put_whole block/bdev.c:719 [inline]
bdev_release+0x2bf/0x3d0 block/bdev.c:1144
blkdev_release+0x15/0x20 block/fops.c:660
__fput+0x298/0x650 fs/file_table.c:465
____fput+0x1c/0x30 fs/file_table.c:493
task_work_run+0x12e/0x1a0 kernel/task_work.c:227
resume_user_mode_work+0x6a/0x70 include/linux/resume_user_mode.h:50
exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x77/0xb0 kernel/entry/common.c:218
do_syscall_64+0xdd/0x1a0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff8881051328f0 -> 0xffff888105132d00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3305 Comm: syz-executor Not tainted 6.15.0-rc3-syzkaller-00283-gf1a3944c860b #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup