syzbot


KCSAN: data-race in list_lru_add / list_lru_count_node (10)

Status: moderation: reported on 2024/04/01 12:23
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+93aab41231573c431949@syzkaller.appspotmail.com
First crash: 29d, last: 24d
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (3) mm 3 1191d 1218d 0/26 auto-closed as invalid on 2021/02/28 22:07
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (6) mm 15 832d 966d 0/26 auto-closed as invalid on 2022/02/23 08:49
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (2) mm 1 1410d 1410d 0/26 auto-closed as invalid on 2020/07/25 12:43
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (9) mm 1 156d 140d 0/26 auto-obsoleted due to no activity on 2023/12/31 11:14
upstream KCSAN: data-race in list_lru_add / list_lru_count_node mm 1 1480d 1480d 0/26 auto-closed as invalid on 2020/06/18 13:43
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (4) mm 5 1079d 1092d 0/26 auto-closed as invalid on 2021/06/20 16:41
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (7) mm 1 655d 655d 0/26 auto-closed as invalid on 2022/08/18 15:43
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (5) mm 3 1010d 1031d 0/26 auto-closed as invalid on 2021/09/03 02:37
upstream KCSAN: data-race in list_lru_add / list_lru_count_node (8) mm 1 592d 592d 0/26 auto-obsoleted due to no activity on 2022/10/21 06:23

Sample crash report:
==================================================================
BUG: KCSAN: data-race in list_lru_add / list_lru_count_node

read-write to 0xffff8881045634a0 of 8 bytes by task 4018 on cpu 0:
 list_lru_add+0x1f4/0x230 mm/list_lru.c:101
 list_lru_add_obj+0xbb/0xd0 mm/list_lru.c:116
 d_lru_add+0xa8/0xe0 fs/dcache.c:430
 retain_dentry fs/dcache.c:712 [inline]
 fast_dput+0x26b/0x2b0 fs/dcache.c:799
 dput+0x24/0xd0 fs/dcache.c:839
 path_put+0x1f/0x40 fs/namei.c:561
 free_fs_struct fs/fs_struct.c:91 [inline]
 exit_fs+0xaf/0xe0 fs/fs_struct.c:108
 do_exit+0x5e6/0x1740 kernel/exit.c:874
 do_group_exit+0x102/0x150 kernel/exit.c:1027
 get_signal+0xf2f/0x1080 kernel/signal.c:2911
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x59/0x130 kernel/entry/common.c:218
 do_syscall_64+0xe2/0x1d0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x72/0x7a

read to 0xffff8881045634a0 of 8 bytes by task 4020 on cpu 1:
 list_lru_count_node+0x2c/0x40 mm/list_lru.c:188
 list_lru_count include/linux/list_lru.h:165 [inline]
 shrink_dcache_sb+0x1bc/0x2a0 fs/dcache.c:1196
 reconfigure_super+0x3fe/0x5a0 fs/super.c:1049
 do_remount fs/namespace.c:2892 [inline]
 path_mount+0x96e/0xb30 fs/namespace.c:3671
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount+0x27f/0x2d0 fs/namespace.c:3875
 __x64_sys_mount+0x67/0x80 fs/namespace.c:3875
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x72/0x7a

value changed: 0x0000000000000000 -> 0x0000000000000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 4020 Comm: syz-executor.2 Tainted: G        W          6.9.0-rc2-syzkaller-00385-g104db052b62d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================
EXT4-fs (sda1): re-mounted 5941fea2-f5fa-4b4e-b5ef-9af118b27b95 r/w. Quota mode: none.

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/06 04:16 upstream 104db052b62d ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in list_lru_add / list_lru_count_node
2024/04/01 12:22 upstream 39cd87c4eb2b 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in list_lru_add / list_lru_count_node
* Struck through repros no longer work on HEAD.