syzbot


KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue

Status: moderation: reported on 2024/02/10 12:26
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+4097ddb5dd88e13f86e9@syzkaller.appspotmail.com
First crash: 63d, last: 30d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue

write to 0xffff888103e5b508 of 8 bytes by task 11356 on cpu 1:
 rcu_segcblist_enqueue+0x67/0xb0 kernel/rcu/rcu_segcblist.c:345
 rcutree_enqueue kernel/rcu/tree.c:2602 [inline]
 call_rcu_core kernel/rcu/tree.c:2619 [inline]
 __call_rcu_common kernel/rcu/tree.c:2755 [inline]
 call_rcu+0x1bd/0x430 kernel/rcu/tree.c:2838
 ma_free_rcu lib/maple_tree.c:197 [inline]
 mas_free lib/maple_tree.c:1304 [inline]
 mas_replace_node+0x2f8/0x440 lib/maple_tree.c:1741
 mas_wr_node_store lib/maple_tree.c:3958 [inline]
 mas_wr_modify+0x2bc3/0x3c90 lib/maple_tree.c:4191
 mas_wr_store_entry+0x250/0x390 lib/maple_tree.c:4231
 mas_store_prealloc+0x151/0x2b0 lib/maple_tree.c:5487
 vma_iter_store mm/internal.h:1185 [inline]
 vma_complete+0x3a7/0x760 mm/mmap.c:532
 __split_vma+0x58d/0x610 mm/mmap.c:2389
 split_vma mm/mmap.c:2415 [inline]
 vma_modify+0x156/0x240 mm/mmap.c:2450
 vma_modify_flags include/linux/mm.h:3283 [inline]
 mprotect_fixup+0x325/0x5c0 mm/mprotect.c:635
 do_mprotect_pkey+0x655/0x940 mm/mprotect.c:809
 __do_sys_mprotect mm/mprotect.c:830 [inline]
 __se_sys_mprotect mm/mprotect.c:827 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:827
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

read to 0xffff888103e5b508 of 8 bytes by task 11360 on cpu 0:
 mtree_range_walk+0x2a3/0x460 lib/maple_tree.c:2791
 mas_state_walk lib/maple_tree.c:3680 [inline]
 mas_walk+0x16e/0x320 lib/maple_tree.c:4911
 lock_vma_under_rcu+0x84/0x2a0 mm/memory.c:5622
 do_user_addr_fault arch/x86/mm/fault.c:1354 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x161/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x0000000000000000 -> 0xffff888103e5b408

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11360 Comm: syz-executor.1 Not tainted 6.8.0-syzkaller-08951-gfe46a7dd189e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/15 00:02 upstream fe46a7dd189e d615901c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue
2024/02/23 01:18 upstream 1c892cdd8fe0 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue
2024/02/10 12:26 upstream 4a7bbe7519b6 77b23aa1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue
* Struck through repros no longer work on HEAD.