syzbot


KCSAN: data-race in mas_state_walk / mas_wmb_replace (3)

Status: moderation: reported on 2025/04/25 22:31
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+2b197cc5ae2316e142b4@syzkaller.appspotmail.com
First crash: 14h44m, last: 1h34m
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace mm 1 698d 698d 0/28 auto-obsoleted due to no activity on 2023/07/03 09:03
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace (2) mm 199 472d 505d 0/28 auto-obsoleted due to no activity on 2024/02/06 14:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wmb_replace

write to 0xffff8881034d7300 of 8 bytes by task 9942 on cpu 1:
 mte_set_node_dead lib/maple_tree.c:337 [inline]
 mas_put_in_tree lib/maple_tree.c:1735 [inline]
 mas_topiary_replace lib/maple_tree.c:2550 [inline]
 mas_wmb_replace+0x20e/0x14a0 lib/maple_tree.c:2641
 mas_split lib/maple_tree.c:3368 [inline]
 mas_commit_b_node lib/maple_tree.c:3388 [inline]
 mas_wr_bnode lib/maple_tree.c:4049 [inline]
 mas_wr_store_entry+0x17ae/0x2b60 lib/maple_tree.c:4090
 mas_store_prealloc+0x74d/0x9e0 lib/maple_tree.c:5475
 vma_iter_store_overwrite mm/vma.h:448 [inline]
 vma_iter_store_new+0x1c5/0x200 mm/vma.h:455
 __split_vma+0x594/0x610 mm/vma.c:523
 vma_modify_flags+0x101/0x130 mm/vma.c:1605
 do_mprotect_pkey+0x6d6/0x980 mm/mprotect.c:832
 x64_sys_call+0x2794/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94

read to 0xffff8881034d7300 of 8 bytes by task 9943 on cpu 0:
 ma_dead_node lib/maple_tree.c:575 [inline]
 mtree_range_walk lib/maple_tree.c:2788 [inline]
 mas_state_walk+0x485/0x650 lib/maple_tree.c:3605
 mas_walk+0x30/0x120 lib/maple_tree.c:4905
 lock_vma_under_rcu+0xa2/0x2f0 mm/memory.c:6553
 do_user_addr_fault+0x233/0x1090 arch/x86/mm/fault.c:1328
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0xffff888108882c41 -> 0xffff8881034d7300

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9943 Comm: wg1 Not tainted 6.15.0-rc3-syzkaller-00283-gf1a3944c860b #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/26 11:40 upstream f1a3944c860b c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/25 22:31 upstream 02ddfb981de8 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
* Struck through repros no longer work on HEAD.