syzbot


KCSAN: data-race in shmem_fallocate / shmem_fault (8)

Status: moderation: reported on 2024/07/31 23:50
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+3b72eab3f50bc31d8357@syzkaller.appspotmail.com
First crash: 42d, last: 4d07h
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (6) mm 1 404d 404d 0/27 auto-obsoleted due to no activity on 2023/09/08 14:27
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (2) mm 2 1241d 1245d 0/27 auto-closed as invalid on 2021/05/24 18:53
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (3) mm 2 1041d 1059d 0/27 auto-closed as invalid on 2021/12/11 00:12
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (4) mm 1 649d 649d 0/27 auto-obsoleted due to no activity on 2023/01/13 18:30
upstream KCSAN: data-race in shmem_fallocate / shmem_fault mm 1 1440d 1440d 0/27 auto-closed as invalid on 2020/11/07 06:23
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (5) mm 1 533d 533d 0/27 auto-obsoleted due to no activity on 2023/05/03 07:41
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (7) mm 7 260d 277d 0/27 auto-obsoleted due to no activity on 2024/01/31 00:24

Sample crash report:
==================================================================
BUG: KCSAN: data-race in shmem_fallocate / shmem_fault

write to 0xffff88811c387fe0 of 8 bytes by task 7104 on cpu 0:
 shmem_fallocate+0x23a/0x860 mm/shmem.c:3266
 vfs_fallocate+0x392/0x3e0 fs/open.c:334
 madvise_remove mm/madvise.c:1012 [inline]
 madvise_vma_behavior mm/madvise.c:1036 [inline]
 madvise_walk_vmas mm/madvise.c:1271 [inline]
 do_madvise+0x1177/0x2620 mm/madvise.c:1467
 __do_sys_madvise mm/madvise.c:1484 [inline]
 __se_sys_madvise mm/madvise.c:1482 [inline]
 __x64_sys_madvise+0x61/0x70 mm/madvise.c:1482
 x64_sys_call+0x2320/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:29
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811c387fe0 of 8 bytes by task 7106 on cpu 1:
 shmem_fault+0x9d/0x260 mm/shmem.c:2381
 __do_fault+0xb6/0x200 mm/memory.c:4655
 do_read_fault mm/memory.c:5061 [inline]
 do_fault mm/memory.c:5191 [inline]
 do_pte_missing mm/memory.c:3947 [inline]
 handle_pte_fault mm/memory.c:5521 [inline]
 __handle_mm_fault mm/memory.c:5664 [inline]
 handle_mm_fault+0xe8b/0x2a30 mm/memory.c:5832
 faultin_page mm/gup.c:1194 [inline]
 __get_user_pages+0x499/0x10d0 mm/gup.c:1493
 populate_vma_page_range mm/gup.c:1932 [inline]
 __mm_populate+0x25b/0x3b0 mm/gup.c:2035
 mm_populate include/linux/mm.h:3430 [inline]
 vm_mmap_pgoff+0x1d6/0x290 mm/util.c:593
 ksys_mmap_pgoff+0xd0/0x340 mm/mmap.c:1514
 x64_sys_call+0x1884/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xffffc9000203fcb8

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7106 Comm: syz.2.709 Not tainted 6.11.0-rc6-syzkaller-00326-gd1f2d51b711a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/08 06:12 upstream d1f2d51b711a 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/09/07 06:31 upstream b31c44928842 9750182a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/09/01 08:39 upstream e8784b0aef62 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/08/29 22:10 upstream d5d547aa7b51 9bd464fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/08/14 08:42 upstream 6b0f8db921ab 07a4d4ad .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/08/05 13:56 upstream de9c2c66ad8e e35c337f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/07/31 23:49 upstream 21b136cc63d2 1e9c4cf3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
* Struck through repros no longer work on HEAD.