syzbot


KCSAN: data-race in __unmap_hugepage_range / free_huge_folio

Status: upstream: reported on 2025/02/20 19:03
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+4769dec94e62d3835199@syzkaller.appspotmail.com
First crash: 2d02h, last: 2d02h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in __unmap_hugepage_range / free_huge_folio 0 (1) 2025/02/20 19:03

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __unmap_hugepage_range / free_huge_folio

read-write to 0xffffffff88c2b1f8 of 8 bytes by task 8563 on cpu 0:
 remove_hugetlb_folio mm/hugetlb.c:1540 [inline]
 free_huge_folio+0x81a/0xae0 mm/hugetlb.c:1869
 folios_put_refs+0x1ce/0x2b0 mm/swap.c:975
 free_pages_and_swap_cache+0x3c7/0x400 mm/swap_state.c:334
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:389 [inline]
 tlb_flush_mmu+0x2cf/0x440 mm/mmu_gather.c:396
 zap_pte_range mm/memory.c:1781 [inline]
 zap_pmd_range mm/memory.c:1834 [inline]
 zap_pud_range mm/memory.c:1863 [inline]
 zap_p4d_range mm/memory.c:1884 [inline]
 unmap_page_range+0x21db/0x2660 mm/memory.c:1905
 unmap_single_vma+0x142/0x1d0 mm/memory.c:1951
 unmap_vmas+0x18d/0x2b0 mm/memory.c:1995
 exit_mmap+0x1ae/0x6d0 mm/mmap.c:1284
 __mmput+0x28/0x1d0 kernel/fork.c:1356
 mmput+0x4c/0x60 kernel/fork.c:1378
 exit_mm+0xe4/0x190 kernel/exit.c:570
 do_exit+0x559/0x17f0 kernel/exit.c:925
 do_group_exit+0x142/0x150 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1096
 x64_sys_call+0x2db8/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88c2b1f8 of 8 bytes by task 8570 on cpu 1:
 __unmap_hugepage_range+0xbff/0x18c0 mm/hugetlb.c:5644
 unmap_single_vma+0x1c7/0x1d0 mm/memory.c:1947
 unmap_vmas+0x18d/0x2b0 mm/memory.c:1995
 exit_mmap+0x1ae/0x6d0 mm/mmap.c:1284
 __mmput+0x28/0x1d0 kernel/fork.c:1356
 mmput+0x4c/0x60 kernel/fork.c:1378
 exit_mm+0xe4/0x190 kernel/exit.c:570
 do_exit+0x559/0x17f0 kernel/exit.c:925
 do_group_exit+0x142/0x150 kernel/exit.c:1087
 __do_sys_exit_group kernel/exit.c:1098 [inline]
 __se_sys_exit_group kernel/exit.c:1096 [inline]
 __x64_sys_exit_group+0x1f/0x20 kernel/exit.c:1096
 x64_sys_call+0x2db8/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000003 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8570 Comm: syz.4.1159 Not tainted 6.14.0-rc3-syzkaller-00079-g87a132e73910 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/20 05:07 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __unmap_hugepage_range / free_huge_folio
* Struck through repros no longer work on HEAD.