KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_cpus

Status: fixed on 2020/02/18 14:31
Subsystems: fs mm
[Documentation on labels]
Reported-by: syzbot+99f4ddade3c22ab0cf23@syzkaller.appspotmail.com
Fix commit: c51f83c315c3 rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
First crash: 2478d, last: 2373d
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[PATCH 5.4 000/309] 5.4.19-stable review 321 (321) 2020/02/12 21:17
[PATCH 5.5 000/367] 5.5.3-stable review 385 (385) 2020/02/12 07:27
[tip: core/rcu] rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special() 1 (1) 2020/01/25 10:42
[PATCH tip/core/rcu 0/11] Preemptible-RCU updates for v5.6 12 (12) 2019/12/10 04:26
KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_cpus 4 (5) 2019/11/04 17:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_cpus

read to 0xffffffff85c7d080 of 8 bytes by task 30033 on cpu 1:
 rcu_read_unlock_special kernel/rcu/tree_plugin.h:615 [inline]
 __rcu_read_unlock+0x392/0x3d0 kernel/rcu/tree_plugin.h:383
 rcu_read_unlock include/linux/rcupdate.h:670 [inline]
 filemap_map_pages+0x5b3/0x990 mm/filemap.c:2667
 do_fault_around mm/memory.c:3546 [inline]
 do_read_fault mm/memory.c:3580 [inline]
 do_fault mm/memory.c:3714 [inline]
 handle_pte_fault mm/memory.c:3945 [inline]
 __handle_mm_fault+0x2a92/0x2e00 mm/memory.c:4075
 handle_mm_fault+0x21b/0x530 mm/memory.c:4112
 faultin_page mm/gup.c:640 [inline]
 __get_user_pages+0x485/0x1130 mm/gup.c:851
 populate_vma_page_range+0xe6/0x100 mm/gup.c:1235
 __mm_populate+0x168/0x2a0 mm/gup.c:1283
 mm_populate include/linux/mm.h:2347 [inline]
 vm_mmap_pgoff+0x181/0x190 mm/util.c:511
 ksys_mmap_pgoff+0x99/0x420 mm/mmap.c:1607
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
 __x64_sys_mmap+0x2e/0x40 arch/x86/kernel/sys_x86_64.c:91
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffffffff85c7d080 of 8 bytes by task 8080 on cpu 0:
 sync_exp_reset_tree kernel/rcu/tree_exp.h:137 [inline]
 sync_rcu_exp_select_cpus+0xd5/0x590 kernel/rcu/tree_exp.h:427
 rcu_exp_sel_wait_wake kernel/rcu/tree_exp.h:575 [inline]
 wait_rcu_exp_gp+0x25/0x40 kernel/rcu/tree_exp.h:589
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2264
 worker_thread+0xa0/0x800 kernel/workqueue.c:2410
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8080 Comm: kworker/0:3 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: rcu_gp wait_rcu_exp_gp
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/06 11:14 https://github.com/google/ktsan.git kcsan 245a43005292 662cf49a .config console log report ci2-upstream-kcsan-gce
2020/01/29 19:28 https://github.com/google/ktsan.git kcsan 245a43005292 5ed23f9a .config console log report ci2-upstream-kcsan-gce
2019/12/21 06:56 https://github.com/google/ktsan.git kcsan 245a43005292 bc586918 .config console log report ci2-upstream-kcsan-gce
2019/12/05 04:53 https://github.com/google/ktsan.git kcsan ef798c30ba4e b2088328 .config console log report ci2-upstream-kcsan-gce
2019/12/02 17:41 https://github.com/google/ktsan.git kcsan ef798c30ba4e f879db37 .config console log report ci2-upstream-kcsan-gce
2019/11/17 05:46 https://github.com/google/ktsan.git kcsan 5863cc791e4c cdac920b .config console log report ci2-upstream-kcsan-gce
2019/10/24 23:14 https://github.com/google/ktsan.git kcsan 05f2236801fe d01bb02a .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.