syzbot


KCSAN: data-race in shmem_fallocate / shmem_fault (9)

Status: moderation: reported on 2024/10/17 04:10
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+76cc716982cf0254f302@syzkaller.appspotmail.com
First crash: 49d, last: 1d11h
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (6) mm 1 489d 489d 0/28 auto-obsoleted due to no activity on 2023/09/08 14:27
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (2) mm 2 1326d 1330d 0/28 auto-closed as invalid on 2021/05/24 18:53
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (3) mm 2 1125d 1143d 0/28 auto-closed as invalid on 2021/12/11 00:12
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (4) mm 1 734d 734d 0/28 auto-obsoleted due to no activity on 2023/01/13 18:30
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (8) mm 7 88d 126d 0/28 auto-obsoleted due to no activity on 2024/10/13 06:13
upstream KCSAN: data-race in shmem_fallocate / shmem_fault mm 1 1524d 1524d 0/28 auto-closed as invalid on 2020/11/07 06:23
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (5) mm 1 617d 617d 0/28 auto-obsoleted due to no activity on 2023/05/03 07:41
upstream KCSAN: data-race in shmem_fallocate / shmem_fault (7) mm 7 344d 361d 0/28 auto-obsoleted due to no activity on 2024/01/31 00:24

Sample crash report:
lo speed is unknown, defaulting to 1000
lo speed is unknown, defaulting to 1000
==================================================================
BUG: KCSAN: data-race in shmem_fallocate / shmem_fault

write to 0xffff888117cf1fe8 of 8 bytes by task 6365 on cpu 1:
 shmem_fallocate+0x22e/0x860 mm/shmem.c:3507
 vfs_fallocate+0x368/0x3b0 fs/open.c:327
 madvise_remove mm/madvise.c:1020 [inline]
 madvise_vma_behavior mm/madvise.c:1255 [inline]
 madvise_walk_vmas mm/madvise.c:1497 [inline]
 do_madvise+0x14bd/0x2a70 mm/madvise.c:1684
 __do_sys_madvise mm/madvise.c:1700 [inline]
 __se_sys_madvise mm/madvise.c:1698 [inline]
 __x64_sys_madvise+0x61/0x70 mm/madvise.c:1698
 x64_sys_call+0x23ab/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:29
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888117cf1fe8 of 8 bytes by task 6361 on cpu 0:
 shmem_fault+0x97/0x250 mm/shmem.c:2549
 __do_fault+0xb6/0x200 mm/memory.c:4907
 do_read_fault mm/memory.c:5322 [inline]
 do_fault mm/memory.c:5456 [inline]
 do_pte_missing mm/memory.c:3979 [inline]
 handle_pte_fault mm/memory.c:5801 [inline]
 __handle_mm_fault mm/memory.c:5944 [inline]
 handle_mm_fault+0xe98/0x2ac0 mm/memory.c:6112
 faultin_page mm/gup.c:1187 [inline]
 __get_user_pages+0xf2c/0x2670 mm/gup.c:1485
 populate_vma_page_range mm/gup.c:1923 [inline]
 __mm_populate+0x25b/0x3b0 mm/gup.c:2026
 mm_populate include/linux/mm.h:3386 [inline]
 vm_mmap_pgoff+0x1d6/0x290 mm/util.c:585
 ksys_mmap_pgoff+0xd0/0x330 mm/mmap.c:542
 x64_sys_call+0x1940/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xffffc90001377ca8

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6361 Comm: syz.2.912 Not tainted 6.13.0-rc1-syzkaller-00005-gceb8bf2ceaa7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
==================================================================

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/04 08:45 upstream ceb8bf2ceaa7 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/12/03 13:51 upstream cdd30ebb1b9f 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/28 22:49 upstream 7af08b57bcb9 5df23865 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/23 22:23 upstream 42d9e8b7ccdd 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/23 08:03 upstream 06afb0f36106 68da6d95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/20 18:03 upstream bf9aa14fc523 4fca1650 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/09 15:01 upstream da4373fbcf00 6b856513 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/11/04 04:13 upstream a33ab3f94f51 f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
2024/10/17 04:10 upstream c964ced77262 666f77ed .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in shmem_fallocate / shmem_fault
* Struck through repros no longer work on HEAD.