syzbot


KCSAN: data-race in __anon_vma_prepare / handle_mm_fault (3)

Status: auto-obsoleted due to no activity on 2024/09/15 23:12
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+3d69e72f363bbb907374@syzkaller.appspotmail.com
First crash: 96d, last: 47d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in __anon_vma_prepare / handle_mm_fault (3) 0 (1) 2024/06/24 08:17
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __anon_vma_prepare / handle_mm_fault (2) mm 123 154d 294d 0/28 auto-obsoleted due to no activity on 2024/05/31 23:05
upstream KCSAN: data-race in __anon_vma_prepare / handle_mm_fault mm 7 1141d 1221d 0/28 auto-closed as invalid on 2021/09/18 03:16

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __anon_vma_prepare / handle_mm_fault

write to 0xffff8881040dbe28 of 8 bytes by task 6329 on cpu 0:
 __anon_vma_prepare+0x180/0x310 mm/rmap.c:213
 vmf_anon_prepare mm/memory.c:3289 [inline]
 wp_page_copy mm/memory.c:3330 [inline]
 do_wp_page+0xfc0/0x22c0 mm/memory.c:3727
 handle_pte_fault mm/memory.c:5538 [inline]
 __handle_mm_fault mm/memory.c:5665 [inline]
 handle_mm_fault+0xbf0/0x2940 mm/memory.c:5833
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x296/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 rep_movs_alternative+0x15/0x70 arch/x86/lib/copy_user_64.S:43
 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
 _inline_copy_to_user include/linux/uaccess.h:181 [inline]
 _copy_to_user+0x77/0xa0 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:209 [inline]
 copy_to_sockptr_offset include/linux/sockptr.h:110 [inline]
 copy_to_sockptr+0x65/0xa0 include/linux/sockptr.h:117
 do_tcp_getsockopt+0x1653/0x1a50 net/ipv4/tcp.c:4122
 tcp_getsockopt+0x6e/0xe0 net/ipv4/tcp.c:4411
 sock_common_getsockopt+0x5b/0x70 net/core/sock.c:3708
 do_sock_getsockopt+0x121/0x1a0 net/socket.c:2386
 __sys_getsockopt+0x19a/0x210 net/socket.c:2415
 __do_sys_getsockopt net/socket.c:2425 [inline]
 __se_sys_getsockopt net/socket.c:2422 [inline]
 __x64_sys_getsockopt+0x66/0x80 net/socket.c:2422
 x64_sys_call+0x11cd/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:56
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881040dbe28 of 8 bytes by task 6328 on cpu 1:
 vmf_anon_prepare mm/memory.c:3281 [inline]
 do_anonymous_page mm/memory.c:4551 [inline]
 do_pte_missing mm/memory.c:3945 [inline]
 handle_pte_fault mm/memory.c:5522 [inline]
 __handle_mm_fault mm/memory.c:5665 [inline]
 handle_mm_fault+0xd36/0x2940 mm/memory.c:5833
 do_user_addr_fault arch/x86/mm/fault.c:1338 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x3b9/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x0000000000000000 -> 0xffff888108502c30

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6328 Comm: syz.4.838 Not tainted 6.11.0-rc2-syzkaller-00315-g7006fe2f7f78 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/11 23:11 upstream 7006fe2f7f78 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __anon_vma_prepare / handle_mm_fault
2024/08/07 00:03 upstream eb5e56d14912 1ef9fe42 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __anon_vma_prepare / handle_mm_fault
2024/07/28 15:50 upstream 5437f30d3458 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __anon_vma_prepare / handle_mm_fault
2024/06/24 10:15 upstream f2661062f16b edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __anon_vma_prepare / handle_mm_fault
2024/06/23 21:59 upstream 7c16f0a4ed1c edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __anon_vma_prepare / handle_mm_fault
* Struck through repros no longer work on HEAD.