syzbot


KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (7)

Status: moderation: reported on 2025/01/31 15:56
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+90985875775c771287a9@syzkaller.appspotmail.com
First crash: 73d, last: 11h40m
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (4) ext4 80 350d 494d 0/28 auto-obsoleted due to no activity on 2024/06/03 21:44
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (3) fs 1 787d 787d 0/28 auto-obsoleted due to no activity on 2023/04/01 03:15
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (5) ext4 13 176d 293d 0/28 auto-obsoleted due to no activity on 2024/11/24 11:50
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru fs 14 1895d 1962d 0/28 auto-closed as invalid on 2020/04/15 20:03
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (2) ext4 exfat 213 831d 1291d 0/28 auto-obsoleted due to no activity on 2023/02/08 20:39
upstream KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru (6) ext4 1 138d 138d 0/28 auto-obsoleted due to no activity on 2025/01/22 20:51

Sample crash report:
EXT4-fs (loop5): failed to initialize system zone (-22)
EXT4-fs (loop5): mount failed
==================================================================
BUG: KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru

write to 0xffff888237c26b30 of 8 bytes by task 3311 on cpu 0:
 __invalidate_bh_lrus fs/buffer.c:1499 [inline]
 invalidate_bh_lru+0x8b/0xf0 fs/buffer.c:1511
 csd_do_func kernel/smp.c:134 [inline]
 smp_call_function_many_cond+0x5b0/0xbc0 kernel/smp.c:876
 on_each_cpu_cond_mask+0x3c/0x90 kernel/smp.c:1052
 on_each_cpu_cond include/linux/smp.h:105 [inline]
 invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1530
 invalidate_bdev+0x42/0x70 block/bdev.c:100
 ext4_put_super+0x65b/0x910 fs/ext4/super.c:1343
 generic_shutdown_super+0xe5/0x220 fs/super.c:642
 kill_block_super+0x2a/0x70 fs/super.c:1710
 ext4_kill_sb+0x44/0x80 fs/ext4/super.c:7393
 deactivate_locked_super+0x7d/0x1c0 fs/super.c:473
 deactivate_super+0x9f/0xb0 fs/super.c:506
 cleanup_mnt+0x26e/0x2e0 fs/namespace.c:1435
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1442
 task_work_run+0x13c/0x1b0 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xa8/0x120 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c26b30 of 8 bytes by task 6402 on cpu 1:
 has_bh_in_lru+0x35/0x1f0 fs/buffer.c:1521
 smp_call_function_many_cond+0x30a/0xbc0 kernel/smp.c:838
 on_each_cpu_cond_mask+0x3c/0x90 kernel/smp.c:1052
 on_each_cpu_cond include/linux/smp.h:105 [inline]
 invalidate_bh_lrus+0x2a/0x30 fs/buffer.c:1530
 invalidate_bdev+0x42/0x70 block/bdev.c:100
 __ext4_fill_super fs/ext4/super.c:5701 [inline]
 ext4_fill_super+0x1551/0x3580 fs/ext4/super.c:5726
 get_tree_bdev_flags+0x2b4/0x330 fs/super.c:1636
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5758
 vfs_get_tree+0x56/0x1e0 fs/super.c:1759
 do_new_mount+0x246/0x6b0 fs/namespace.c:3879
 path_mount+0x49b/0xb30 fs/namespace.c:4206
 do_mount fs/namespace.c:4219 [inline]
 __do_sys_mount fs/namespace.c:4430 [inline]
 __se_sys_mount+0x28f/0x2e0 fs/namespace.c:4407
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4407
 x64_sys_call+0xd11/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff8881049126e8 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6402 Comm: syz.5.1069 Not tainted 6.15.0-rc2-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/14 21:45 upstream 8ffd015db85f 0bd6db41 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/04/13 00:41 upstream 7cdabafc0012 0bd6db41 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/02/25 19:59 upstream 2a1944bff549 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/02/18 00:11 upstream 2408a807bfc3 429ea007 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/02/02 15:53 upstream a86bf2283d2c 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
2025/01/31 15:55 upstream 69e858e0b8b2 4c6ac32f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in has_bh_in_lru / invalidate_bh_lru
* Struck through repros no longer work on HEAD.