syzbot


KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (7)

Status: moderation: reported on 2025/01/31 15:56
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+90985875775c771287a9@syzkaller.appspotmail.com
First crash: 4d15h, last: 2d15h
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (4) ext4 80 281d 425d 0/28 auto-obsoleted due to no activity on 2024/06/03 21:44
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (3) fs 1 718d 718d 0/28 auto-obsoleted due to no activity on 2023/04/01 03:15
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (5) ext4 13 107d 224d 0/28 auto-obsoleted due to no activity on 2024/11/24 11:50
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru fs 14 1826d 1893d 0/28 auto-closed as invalid on 2020/04/15 20:03
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (2) ext4 exfat 213 762d 1222d 0/28 auto-obsoleted due to no activity on 2023/02/08 20:39
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (6) ext4 1 69d 69d 0/28 auto-obsoleted due to no activity on 2025/01/22 20:51

Sample crash report:
loop0: detected capacity change from 0 to 512
==================================================================
BUG: KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru

write to 0xffff888237c2b9e8 of 8 bytes by task 3289 on cpu 0:
 __invalidate_bh_lrus fs/buffer.c:1499 [inline]
 invalidate_bh_lru+0x8b/0xf0 fs/buffer.c:1511
 csd_do_func kernel/smp.c:134 [inline]
 smp_call_function_many_cond+0x5ab/0xbb0 kernel/smp.c:876
 on_each_cpu_cond_mask+0x3c/0x90 kernel/smp.c:1052
 on_each_cpu_cond include/linux/smp.h:105 [inline]
 invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1530
 kill_bdev block/bdev.c:90 [inline]
 blkdev_flush_mapping+0x9b/0x1a0 block/bdev.c:670
 blkdev_put_whole block/bdev.c:677 [inline]
 bdev_release+0x2f9/0x420 block/bdev.c:1102
 blkdev_release+0x15/0x20 block/fops.c:660
 __fput+0x2ac/0x640 fs/file_table.c:448
 __fput_sync+0x96/0xc0 fs/file_table.c:534
 __do_sys_close fs/open.c:1579 [inline]
 __se_sys_close fs/open.c:1564 [inline]
 __x64_sys_close+0x55/0xe0 fs/open.c:1564
 x64_sys_call+0x266c/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c2b9e8 of 8 bytes by task 5908 on cpu 1:
 has_bh_in_lru+0x35/0x1f0 fs/buffer.c:1521
 smp_call_function_many_cond+0x305/0xbb0 kernel/smp.c:838
 on_each_cpu_cond_mask+0x3c/0x90 kernel/smp.c:1052
 on_each_cpu_cond include/linux/smp.h:105 [inline]
 invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1530
 kill_bdev block/bdev.c:90 [inline]
 set_blocksize+0x24f/0x270 block/bdev.c:172
 sb_set_blocksize+0x2c/0xb0 block/bdev.c:181
 ext4_load_super fs/ext4/super.c:5096 [inline]
 __ext4_fill_super fs/ext4/super.c:5248 [inline]
 ext4_fill_super+0x12d7/0x3650 fs/ext4/super.c:5722
 get_tree_bdev_flags+0x29f/0x310 fs/super.c:1636
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5754
 vfs_get_tree+0x56/0x1e0 fs/super.c:1814
 do_new_mount+0x227/0x690 fs/namespace.c:3560
 path_mount+0x49b/0xb30 fs/namespace.c:3887
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x27f/0x2d0 fs/namespace.c:4088
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4088
 x64_sys_call+0x2c84/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810065e410 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 5908 Comm: syz.0.822 Not tainted 6.13.0-syzkaller-10003-ga86bf2283d2c #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================
ext4 filesystem being mounted at /184/file0 supports timestamps until 2038-01-19 (0x7fffffff)

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/02 15:53 upstream a86bf2283d2c 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/01/31 15:55 upstream 69e858e0b8b2 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
* Struck through repros no longer work on HEAD.