syzbot


KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn

Status: moderation: reported on 2024/06/15 11:16
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+433f6493e3caec5344d0@syzkaller.appspotmail.com
First crash: 3d02h, last: 13h07m

Sample crash report:
==================================================================
BUG: KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn

read-write to 0xffffffff8841f6ac of 4 bytes by task 35 on cpu 1:
 pcpu_update_empty_pages mm/percpu.c:602 [inline]
 pcpu_chunk_populated mm/percpu.c:1531 [inline]
 pcpu_balance_populated mm/percpu.c:2062 [inline]
 pcpu_balance_workfn+0x94e/0xa60 mm/percpu.c:2212
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
 worker_thread+0x526/0x730 kernel/workqueue.c:3393
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffffffff8841f6ac of 4 bytes by task 3110 on cpu 0:
 pcpu_alloc_noprof+0x9a7/0x10c0 mm/percpu.c:1894
 snmp6_alloc_dev net/ipv6/addrconf.c:344 [inline]
 ipv6_add_dev+0x2ee/0xab0 net/ipv6/addrconf.c:409
 addrconf_notify+0x407/0x950 net/ipv6/addrconf.c:3652
 notifier_call_chain kernel/notifier.c:93 [inline]
 raw_notifier_call_chain+0x6f/0x1d0 kernel/notifier.c:461
 call_netdevice_notifiers_info+0xae/0x100 net/core/dev.c:1992
 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]
 call_netdevice_notifiers net/core/dev.c:2044 [inline]
 register_netdevice+0xc54/0xdd0 net/core/dev.c:10408
 __ip_tunnel_create+0x1c5/0x270 net/ipv4/ip_tunnel.c:266
 ip_tunnel_init_net+0x18a/0x3e0 net/ipv4/ip_tunnel.c:1160
 ipgre_tap_init_net+0x35/0x40 net/ipv4/ip_gre.c:1734
 ops_init+0x1ef/0x2b0 net/core/net_namespace.c:139
 setup_net+0x2ea/0x7c0 net/core/net_namespace.c:343
 copy_net_ns+0x37b/0x510 net/core/net_namespace.c:508
 create_new_namespaces+0x228/0x430 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xe6/0x120 kernel/nsproxy.c:228
 ksys_unshare+0x3da/0x720 kernel/fork.c:3323
 __do_sys_unshare kernel/fork.c:3394 [inline]
 __se_sys_unshare kernel/fork.c:3392 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3392
 x64_sys_call+0x2ca9/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000004

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 3110 Comm: syz-executor.0 Not tainted 6.10.0-rc4-syzkaller-00007-g6226e74900d7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/18 00:35 upstream 6226e74900d7 ce6011bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
2024/06/17 13:49 upstream 6ba59ff42279 1f11cfd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
2024/06/17 04:02 upstream 6ba59ff42279 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
2024/06/17 04:02 upstream 6ba59ff42279 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
2024/06/16 08:29 upstream a3e18a540541 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
2024/06/15 11:15 upstream 44ef20baed8e f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in pcpu_alloc_noprof / pcpu_balance_workfn
* Struck through repros no longer work on HEAD.