syzbot


KCSAN: data-race in __filemap_remove_folio / page_remove_rmap (3)

Status: auto-obsoleted due to no activity on 2024/02/08 19:56
Subsystems: iomap
[Documentation on labels]
Reported-by: syzbot+5a1447ee077a1fd163f5@syzkaller.appspotmail.com
First crash: 89d, last: 58d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __filemap_remove_folio / page_remove_rmap (2) iomap 3 134d 160d 0/26 auto-obsoleted due to no activity on 2023/11/25 14:34
upstream KCSAN: data-race in __filemap_remove_folio / page_remove_rmap iomap 2 239d 240d 0/26 auto-obsoleted due to no activity on 2023/08/12 06:26

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __filemap_remove_folio / page_remove_rmap

write to 0xffffea0004450758 of 8 bytes by task 4778 on cpu 0:
 page_cache_delete mm/filemap.c:142 [inline]
 __filemap_remove_folio+0x1b8/0x2d0 mm/filemap.c:222
 invalidate_complete_folio2 mm/truncate.c:584 [inline]
 invalidate_inode_pages2_range+0x404/0x720 mm/truncate.c:671
 kiocb_invalidate_pages+0x1b1/0x1e0 mm/filemap.c:2714
 __iomap_dio_rw+0x5ad/0x1090 fs/iomap/direct-io.c:638
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:748
 ext4_dio_write_iter fs/ext4/file.c:577 [inline]
 ext4_file_write_iter+0xa8a/0xe10 fs/ext4/file.c:696
 do_iter_write+0x4ad/0x770 fs/read_write.c:860
 vfs_iter_write+0x56/0x70 fs/read_write.c:901
 iter_file_splice_write+0x462/0x7e0 fs/splice.c:736
 do_splice_from fs/splice.c:933 [inline]
 direct_splice_actor+0x8a/0xb0 fs/splice.c:1142
 splice_direct_to_actor+0x31d/0x690 fs/splice.c:1088
 do_splice_direct+0x10d/0x190 fs/splice.c:1194
 do_sendfile+0x3c4/0x980 fs/read_write.c:1254
 __do_sys_sendfile64 fs/read_write.c:1322 [inline]
 __se_sys_sendfile64 fs/read_write.c:1308 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffffea0004450758 of 8 bytes by task 4772 on cpu 1:
 folio_test_anon include/linux/page-flags.h:652 [inline]
 page_remove_rmap+0x135/0x260 mm/rmap.c:1487
 zap_pte_range mm/memory.c:1465 [inline]
 zap_pmd_range mm/memory.c:1583 [inline]
 zap_pud_range mm/memory.c:1612 [inline]
 zap_p4d_range mm/memory.c:1633 [inline]
 unmap_page_range+0xdb6/0x1cd0 mm/memory.c:1654
 unmap_single_vma+0x142/0x1d0 mm/memory.c:1700
 zap_page_range_single+0x213/0x2f0 mm/memory.c:1778
 unmap_mapping_range_vma mm/memory.c:3518 [inline]
 unmap_mapping_range_tree+0xa6/0xe0 mm/memory.c:3535
 unmap_mapping_pages+0xc0/0xd0 mm/memory.c:3601
 invalidate_inode_pages2_range+0x203/0x720 mm/truncate.c:652
 kiocb_invalidate_pages+0x1b1/0x1e0 mm/filemap.c:2714
 __iomap_dio_rw+0x5ad/0x1090 fs/iomap/direct-io.c:638
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:748
 ext4_dio_write_iter fs/ext4/file.c:577 [inline]
 ext4_file_write_iter+0xa8a/0xe10 fs/ext4/file.c:696
 do_iter_write+0x4ad/0x770 fs/read_write.c:860
 vfs_iter_write+0x56/0x70 fs/read_write.c:901
 iter_file_splice_write+0x462/0x7e0 fs/splice.c:736
 do_splice_from fs/splice.c:933 [inline]
 direct_splice_actor+0x8a/0xb0 fs/splice.c:1142
 splice_direct_to_actor+0x31d/0x690 fs/splice.c:1088
 do_splice_direct+0x10d/0x190 fs/splice.c:1194
 do_sendfile+0x3c4/0x980 fs/read_write.c:1254
 __do_sys_sendfile64 fs/read_write.c:1322 [inline]
 __se_sys_sendfile64 fs/read_write.c:1308 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0xffff8881065ce720 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 4772 Comm: syz-executor.1 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
==================================================================
syz-executor.1 (4772) used greatest stack depth: 9424 bytes left

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/04 19:55 upstream 5eff55d725a4 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
2024/01/03 22:44 upstream ac865f00af29 28c42cff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
2023/12/23 21:24 upstream 3f82f1c3a036 fb427a07 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
2023/12/22 11:05 upstream 24e0d2e527a3 4f9530a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
2023/12/05 19:28 upstream bee0e7762ad2 858d62d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
2023/12/05 02:10 upstream bee0e7762ad2 f819d6f7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __filemap_remove_folio / page_remove_rmap
* Struck through repros no longer work on HEAD.