syzbot


KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (7)

Status: auto-obsoleted due to no activity on 2024/09/23 07:15
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+55b80301d2f1b98738ce@syzkaller.appspotmail.com
First crash: 148d, last: 76d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (7) 0 (1) 2024/09/06 10:46
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (5) mm 8 398d 494d 0/28 auto-obsoleted due to no activity on 2023/11/06 01:09
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (3) fs mm 3 592d 609d 0/28 auto-obsoleted due to no activity on 2023/04/29 19:41
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead fs 7 1012d 1086d 0/28 auto-closed as invalid on 2022/03/01 21:22
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (2) fs 1 797d 797d 0/28 auto-closed as invalid on 2022/10/02 20:33
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (6) fs mm 5 214d 308d 0/28 auto-obsoleted due to no activity on 2024/05/08 09:54
upstream KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead (4) fs 1 551d 551d 0/28 auto-obsoleted due to no activity on 2023/06/06 03:32

Sample crash report:
==================================================================
BUG: KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead

write to 0xffff88810f822480 of 4 bytes by task 4192 on cpu 0:
 do_sync_mmap_readahead+0x236/0x2a0 mm/filemap.c:3172
 filemap_fault+0x331/0xa60 mm/filemap.c:3314
 __do_fault+0xb6/0x200 mm/memory.c:4655
 do_shared_fault mm/memory.c:5121 [inline]
 do_fault mm/memory.c:5195 [inline]
 do_pte_missing mm/memory.c:3947 [inline]
 handle_pte_fault mm/memory.c:5521 [inline]
 __handle_mm_fault mm/memory.c:5664 [inline]
 handle_mm_fault+0xc0a/0x2940 mm/memory.c:5832
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x296/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:57
 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
 _inline_copy_to_user include/linux/uaccess.h:181 [inline]
 _copy_to_user+0x77/0xa0 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:209 [inline]
 put_timespec64+0x64/0xb0 kernel/time/time.c:910
 __do_sys_clock_gettime kernel/time/posix-timers.c:1144 [inline]
 __se_sys_clock_gettime kernel/time/posix-timers.c:1132 [inline]
 __x64_sys_clock_gettime+0x138/0x180 kernel/time/posix-timers.c:1132
 x64_sys_call+0x27b5/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:229
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff88810f822480 of 4 bytes by task 4191 on cpu 1:
 do_sync_mmap_readahead+0x236/0x2a0 mm/filemap.c:3172
 filemap_fault+0x331/0xa60 mm/filemap.c:3314
 __do_fault+0xb6/0x200 mm/memory.c:4655
 do_shared_fault mm/memory.c:5121 [inline]
 do_fault mm/memory.c:5195 [inline]
 do_pte_missing mm/memory.c:3947 [inline]
 handle_pte_fault mm/memory.c:5521 [inline]
 __handle_mm_fault mm/memory.c:5664 [inline]
 handle_mm_fault+0xc0a/0x2940 mm/memory.c:5832
 do_user_addr_fault arch/x86/mm/fault.c:1389 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x296/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:57
 copy_user_generic arch/x86/include/asm/uaccess_64.h:110 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:131 [inline]
 _inline_copy_to_user include/linux/uaccess.h:181 [inline]
 _copy_to_user+0x77/0xa0 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:209 [inline]
 put_timespec64+0x64/0xb0 kernel/time/time.c:910
 __do_sys_clock_gettime kernel/time/posix-timers.c:1144 [inline]
 __se_sys_clock_gettime kernel/time/posix-timers.c:1132 [inline]
 __x64_sys_clock_gettime+0x138/0x180 kernel/time/posix-timers.c:1132
 x64_sys_call+0x27b5/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:229
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x00000020

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4191 Comm: syz.0.141 Not tainted 6.11.0-rc3-syzkaller-00338-gc3f2d783a459 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/19 07:14 upstream c3f2d783a459 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/08/17 19:33 upstream e5fa841af679 dbc93b08 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/08/11 20:01 upstream 5189dafa4cf9 6f4edef4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/07/27 01:17 upstream 2f8c4f506285 46eb10b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/07/25 14:55 upstream c33ffdb70cc6 466a14e5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/06/28 22:16 upstream 6c0483dbfe72 757f06b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/06/25 19:19 upstream 55027e689933 04bd2a30 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/06/12 22:54 upstream cea2a26553ac f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/06/09 06:23 upstream 061d1af7b030 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
2024/06/08 10:14 upstream 96e09b8f8166 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_sync_mmap_readahead / do_sync_mmap_readahead
* Struck through repros no longer work on HEAD.