syzbot


KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue (3)

Status: moderation: reported on 2024/12/20 03:22
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+6a4be99fad05176d0434@syzkaller.appspotmail.com
First crash: 55d, last: 32d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue mm 3 335d 369d 0/28 auto-obsoleted due to no activity on 2024/04/19 00:03
upstream KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue (2) mm 4 174d 237d 0/28 auto-obsoleted due to no activity on 2024/09/27 23:15

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue

write to 0xffff888104b5eb08 of 8 bytes by task 30520 on cpu 1:
 rcu_segcblist_enqueue+0x67/0xb0 kernel/rcu/rcu_segcblist.c:334
 rcutree_enqueue kernel/rcu/tree.c:2954 [inline]
 call_rcu_core kernel/rcu/tree.c:2971 [inline]
 __call_rcu_common kernel/rcu/tree.c:3107 [inline]
 call_rcu+0x1bd/0x430 kernel/rcu/tree.c:3190
 ma_free_rcu lib/maple_tree.c:211 [inline]
 mas_free lib/maple_tree.c:1317 [inline]
 mas_replace_node+0x2fa/0x430 lib/maple_tree.c:1754
 mas_wr_node_store lib/maple_tree.c:3878 [inline]
 mas_wr_store_entry+0x1fbf/0x2d10 lib/maple_tree.c:4098
 mas_store_prealloc+0x6bf/0x960 lib/maple_tree.c:5520
 vma_iter_store mm/vma.h:387 [inline]
 vma_complete+0x3a7/0x760 mm/vma.c:277
 __split_vma+0x5d6/0x6a0 mm/vma.c:480
 split_vma mm/vma.c:510 [inline]
 vma_modify+0xd3/0x1e0 mm/vma.c:1520
 vma_modify_flags+0xf1/0x120 mm/vma.c:1546
 mprotect_fixup+0x31a/0x5e0 mm/mprotect.c:666
 do_mprotect_pkey+0x653/0x960 mm/mprotect.c:840
 __do_sys_mprotect mm/mprotect.c:861 [inline]
 __se_sys_mprotect mm/mprotect.c:858 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:858
 x64_sys_call+0x2770/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104b5eb08 of 8 bytes by task 30522 on cpu 0:
 mtree_range_walk+0x140/0x460 lib/maple_tree.c:2784
 mas_state_walk lib/maple_tree.c:3620 [inline]
 mas_walk+0x16e/0x320 lib/maple_tree.c:4947
 lock_vma_under_rcu+0x95/0x260 mm/memory.c:6274
 do_user_addr_fault arch/x86/mm/fault.c:1329 [inline]
 handle_page_fault arch/x86/mm/fault.c:1481 [inline]
 exc_page_fault+0x150/0x650 arch/x86/mm/fault.c:1539
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 30522 Comm: syz.4.8653 Not tainted 6.13.0-rc6-syzkaller-00262-gb62cef9a5c67 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/12 06:33 upstream b62cef9a5c67 6dbc6a9b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue
2024/12/20 03:21 upstream baaa2567a712 5905cb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mtree_range_walk / rcu_segcblist_enqueue
* Struck through repros no longer work on HEAD.