syzbot


KCSAN: data-race in drain_all_stock / drain_stock (9)

Status: moderation: reported on 2024/01/18 23:03
Subsystems: mm cgroups
[Documentation on labels]
Reported-by: syzbot+3e1db7e06629b0fa6fe5@syzkaller.appspotmail.com
First crash: 91d, last: 20d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in drain_all_stock / drain_stock (7) cgroups mm 4 367d 448d 0/26 auto-obsoleted due to no activity on 2023/05/23 02:38
upstream KCSAN: data-race in drain_all_stock / drain_stock (5) cgroups mm 1 613d 613d 0/26 auto-closed as invalid on 2022/09/19 00:38
upstream KCSAN: data-race in drain_all_stock / drain_stock (3) cgroups mm 1 751d 751d 0/26 auto-closed as invalid on 2022/05/03 08:41
upstream KCSAN: data-race in drain_all_stock / drain_stock (6) cgroups mm 4 505d 564d 0/26 auto-obsoleted due to no activity on 2023/01/16 19:50
upstream KCSAN: data-race in drain_all_stock / drain_stock (8) cgroups mm 12 143d 131d 0/26 auto-obsoleted due to no activity on 2024/01/01 19:14
upstream KCSAN: data-race in drain_all_stock / drain_stock (2) cgroups mm 3 907d 912d 0/26 auto-closed as invalid on 2021/11/28 07:11
upstream KCSAN: data-race in drain_all_stock / drain_stock cgroups mm 1 1374d 1374d 0/26 auto-closed as invalid on 2020/08/18 19:14
upstream KCSAN: data-race in drain_all_stock / drain_stock (4) cgroups mm 2 660d 691d 0/26 auto-closed as invalid on 2022/08/02 11:05

Sample crash report:
==================================================================
BUG: KCSAN: data-race in drain_all_stock / drain_stock

write to 0xffff888237d2b950 of 4 bytes by task 28945 on cpu 1:
 drain_stock+0x48/0x100 mm/memcontrol.c:2346
 __refill_stock+0x39/0xc0 mm/memcontrol.c:2386
 refill_stock mm/memcontrol.c:2401 [inline]
 obj_cgroup_uncharge_pages+0x126/0x200 mm/memcontrol.c:3281
 refill_obj_stock+0x15c/0x1e0 mm/memcontrol.c:3553
 obj_cgroup_uncharge+0xe/0x20 mm/memcontrol.c:3602
 __memcg_slab_free_hook+0xa9/0x130 mm/slub.c:2000
 memcg_slab_free_hook mm/slub.c:2020 [inline]
 slab_free mm/slub.c:4278 [inline]
 kmem_cache_free+0x18b/0x250 mm/slub.c:4344
 file_free fs/file_table.c:73 [inline]
 __fput+0x56a/0x660 fs/file_table.c:435
 __fput_sync+0x44/0x60 fs/file_table.c:507
 __do_sys_close fs/open.c:1556 [inline]
 __se_sys_close+0x101/0x1b0 fs/open.c:1541
 __x64_sys_close+0x1f/0x30 fs/open.c:1541
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

read to 0xffff888237d2b950 of 4 bytes by task 28927 on cpu 0:
 drain_all_stock+0xd3/0x2e0 mm/memcontrol.c:2431
 try_charge_memcg+0x6bb/0xd10 mm/memcontrol.c:2791
 obj_cgroup_charge_pages+0xbd/0x1d0 mm/memcontrol.c:3302
 __memcg_kmem_charge_page+0x9d/0x170 mm/memcontrol.c:3328
 __alloc_pages+0x1bc/0x360 mm/page_alloc.c:4592
 alloc_pages_mpol+0xb1/0x1e0 mm/mempolicy.c:2264
 alloc_pages+0xe1/0x100 mm/mempolicy.c:2335
 vm_area_alloc_pages mm/vmalloc.c:3545 [inline]
 __vmalloc_area_node mm/vmalloc.c:3621 [inline]
 __vmalloc_node_range+0x6f2/0xee0 mm/vmalloc.c:3802
 kvmalloc_node+0x121/0x170 mm/util.c:659
 kvmalloc include/linux/slab.h:766 [inline]
 xt_alloc_table_info+0x3d/0x80 net/netfilter/x_tables.c:1193
 do_replace net/ipv6/netfilter/ip6_tables.c:1139 [inline]
 do_ip6t_set_ctl+0x63f/0x1800 net/ipv6/netfilter/ip6_tables.c:1636
 nf_setsockopt+0x195/0x1b0 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x126/0x140 net/ipv6/ipv6_sockglue.c:999
 dccp_setsockopt+0xe1/0xc40 net/dccp/proto.c:579
 sock_common_setsockopt+0x64/0x80 net/core/sock.c:3727
 do_sock_setsockopt net/socket.c:2311 [inline]
 __sys_setsockopt+0x1d8/0x250 net/socket.c:2334
 __do_sys_setsockopt net/socket.c:2343 [inline]
 __se_sys_setsockopt net/socket.c:2340 [inline]
 __x64_sys_setsockopt+0x66/0x80 net/socket.c:2340
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

value changed: 0x0000001b -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 28927 Comm: syz-executor.3 Not tainted 6.9.0-rc1-syzkaller-00178-g317c7bc0ef03 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/29 07:58 upstream 317c7bc0ef03 c52bcb23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_stock
2024/02/28 09:47 upstream cf1182944c7c d367cbe5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_stock
2024/02/25 23:59 upstream 70ff1fe626a1 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_stock
2024/02/09 07:36 upstream 1f719a2f3fa6 7f07e9b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_stock
2024/01/18 23:03 upstream 296455ade1fd 239abf84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_stock
* Struck through repros no longer work on HEAD.