syzbot


KCSAN: data-race in get_tree_bdev_flags / super_cache_count

Status: moderation: reported on 2025/02/15 12:24
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+5258530073bb567f37b0@syzkaller.appspotmail.com
First crash: 5d16h, last: 5d16h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in get_tree_bdev_flags / super_cache_count

read-write to 0xffff888132a59050 of 8 bytes by task 19616 on cpu 0:
 get_tree_bdev_flags+0x2f7/0x310 fs/super.c:1641
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5754
 vfs_get_tree+0x56/0x1e0 fs/super.c:1814
 do_new_mount+0x227/0x690 fs/namespace.c:3560
 path_mount+0x49b/0xb30 fs/namespace.c:3887
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x27f/0x2d0 fs/namespace.c:4088
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4088
 x64_sys_call+0x2c84/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888132a59050 of 8 bytes by task 19593 on cpu 1:
 super_cache_count+0x30/0x1a0 fs/super.c:256
 do_shrink_slab+0x5a/0x680 mm/shrinker.c:384
 shrink_slab_memcg mm/shrinker.c:550 [inline]
 shrink_slab+0x4ea/0x850 mm/shrinker.c:628
 shrink_node_memcgs mm/vmscan.c:5953 [inline]
 shrink_node+0x63f/0x1d80 mm/vmscan.c:5992
 shrink_zones mm/vmscan.c:6237 [inline]
 do_try_to_free_pages+0x3c6/0xc50 mm/vmscan.c:6299
 try_to_free_mem_cgroup_pages+0x1e3/0x490 mm/vmscan.c:6631
 try_charge_memcg+0x2bc/0x7f0 mm/memcontrol.c:2255
 obj_cgroup_charge_pages+0xbd/0x1a0 mm/memcontrol.c:2636
 __memcg_kmem_charge_page+0x9d/0x170 mm/memcontrol.c:2663
 __alloc_frozen_pages_noprof+0x1bc/0x340 mm/page_alloc.c:4756
 alloc_pages_mpol+0xb4/0x260 mm/mempolicy.c:2270
 alloc_frozen_pages_noprof mm/mempolicy.c:2341 [inline]
 alloc_pages_noprof+0xe8/0x130 mm/mempolicy.c:2361
 vm_area_alloc_pages mm/vmalloc.c:3591 [inline]
 __vmalloc_area_node mm/vmalloc.c:3669 [inline]
 __vmalloc_node_range_noprof+0x6e5/0xe70 mm/vmalloc.c:3846
 __kvmalloc_node_noprof+0x121/0x170 mm/util.c:684
 ip_set_alloc+0x1f/0x30 net/netfilter/ipset/ip_set_core.c:261
 hash_ipport_create+0x4dc/0x9f0 net/netfilter/ipset/ip_set_hash_gen.h:1568
 ip_set_create+0x3b1/0x970 net/netfilter/ipset/ip_set_core.c:1109
 nfnetlink_rcv_msg+0x4a9/0x570 net/netfilter/nfnetlink.c:302
 netlink_rcv_skb+0x12c/0x230 net/netlink/af_netlink.c:2543
 nfnetlink_rcv+0x16c/0x15d0 net/netfilter/nfnetlink.c:667
 netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]
 netlink_unicast+0x599/0x670 net/netlink/af_netlink.c:1348
 netlink_sendmsg+0x5cc/0x6e0 net/netlink/af_netlink.c:1892
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0x140/0x180 net/socket.c:733
 ____sys_sendmsg+0x326/0x4b0 net/socket.c:2573
 ___sys_sendmsg net/socket.c:2627 [inline]
 __sys_sendmsg+0x19d/0x230 net/socket.c:2659
 __do_sys_sendmsg net/socket.c:2664 [inline]
 __se_sys_sendmsg net/socket.c:2662 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2662
 x64_sys_call+0x2734/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000010818001 -> 0x0000000070818001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 19593 Comm: syz.0.17745 Not tainted 6.14.0-rc2-syzkaller-00253-g78a632a2086c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/15 12:23 upstream 78a632a2086c 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in get_tree_bdev_flags / super_cache_count
* Struck through repros no longer work on HEAD.