syzbot


KCSAN: data-race in vm_area_dup / vma_interval_tree_remove

Status: closed as invalid on 2019/10/18 14:11
Subsystems: kernel
[Documentation on labels]
First crash: 1709d, last: 1709d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in vm_area_dup / vma_interval_tree_remove (2) mm 70 1461d 1575d 15/27 fixed on 2020/09/16 22:51

Sample crash report:
==================================================================
BUG: KCSAN: data-race in vm_area_dup / vma_interval_tree_remove

read to 0xffff88811c628af0 of 200 bytes by task 9827 on cpu 1:
 vm_area_dup+0x70/0xf0 kernel/fork.c:350
 __split_vma+0x88/0x350 mm/mmap.c:2663
 split_vma+0x73/0xa0 mm/mmap.c:2721
 mprotect_fixup+0x4bf/0x600 mm/mprotect.c:413
 do_mprotect_pkey+0x3eb/0x660 mm/mprotect.c:557
 __do_sys_mprotect mm/mprotect.c:582 [inline]
 __se_sys_mprotect mm/mprotect.c:579 [inline]
 __x64_sys_mprotect+0x51/0x70 mm/mprotect.c:579
 do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff88811c628b48 of 8 bytes by task 9825 on cpu 0:
 rb_set_parent include/linux/rbtree_augmented.h:113 [inline]
 __rb_erase_augmented include/linux/rbtree_augmented.h:233 [inline]
 rb_erase_augmented include/linux/rbtree_augmented.h:259 [inline]
 rb_erase_augmented_cached include/linux/rbtree_augmented.h:270 [inline]
 vma_interval_tree_remove+0x2ff/0x8b0 mm/interval_tree.c:23
 __remove_shared_vm_struct+0xad/0xd0 mm/mmap.c:154
 unlink_file_vma+0x69/0x90 mm/mmap.c:169
 free_pgtables+0x14f/0x200 mm/memory.c:396
 exit_mmap+0x151/0x300 mm/mmap.c:3146
 __mmput kernel/fork.c:1064 [inline]
 mmput+0xea/0x280 kernel/fork.c:1085
 exit_mm kernel/exit.c:547 [inline]
 do_exit+0x4ed/0x18e0 kernel/exit.c:866
 do_group_exit+0xb4/0x1c0 kernel/exit.c:983
 __do_sys_exit_group kernel/exit.c:994 [inline]
 __se_sys_exit_group kernel/exit.c:992 [inline]
 __x64_sys_exit_group+0x2e/0x30 kernel/exit.c:992
 do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9825 Comm: blkid Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/10 08:59 https://github.com/google/ktsan.git kcsan d724f94f63de d52eff28 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.