syzbot


KCSAN: data-race in __delete_from_swap_cache / folio_mapping (4)

Status: moderation: reported on 2024/06/04 14:06
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+d4866c171a234211e4a7@syzkaller.appspotmail.com
First crash: 52d, last: 6d00h
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping mm 2 219d 228d 0/27 auto-obsoleted due to no activity on 2024/01/24 15:33
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping (2) mm 2 164d 176d 0/27 auto-obsoleted due to no activity on 2024/03/19 16:43
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping (3) mm 1 116d 115d 0/27 auto-obsoleted due to no activity on 2024/05/06 15:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __delete_from_swap_cache / folio_mapping

write to 0xffffea00045a83a8 of 8 bytes by task 9976 on cpu 1:
 __delete_from_swap_cache+0x1f2/0x290 mm/swap_state.c:161
 delete_from_swap_cache+0x72/0xe0 mm/swap_state.c:241
 shmem_swapin_folio+0x69e/0x760 mm/shmem.c:1939
 shmem_get_folio_gfp+0x278/0xb70 mm/shmem.c:2002
 shmem_get_folio mm/shmem.c:2171 [inline]
 shmem_file_read_iter+0x152/0x550 mm/shmem.c:2825
 do_iter_readv_writev+0x3b0/0x470
 vfs_iter_read+0x16e/0x3b0 fs/read_write.c:830
 lo_read_simple drivers/block/loop.c:283 [inline]
 do_req_filebacked drivers/block/loop.c:516 [inline]
 loop_handle_cmd drivers/block/loop.c:1910 [inline]
 loop_process_work+0x7a6/0x1230 drivers/block/loop.c:1945
 loop_workfn+0x31/0x40 drivers/block/loop.c:1969
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
 worker_thread+0x526/0x700 kernel/workqueue.c:3390
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffffea00045a83a8 of 8 bytes by task 11404 on cpu 0:
 folio_mapping+0xd2/0x110 mm/util.c:813
 folio_evictable mm/internal.h:353 [inline]
 sort_folio mm/vmscan.c:4259 [inline]
 scan_folios mm/vmscan.c:4385 [inline]
 isolate_folios mm/vmscan.c:4510 [inline]
 evict_folios+0x817/0x3400 mm/vmscan.c:4541
 try_to_shrink_lruvec+0x719/0x8b0 mm/vmscan.c:4749
 lru_gen_shrink_lruvec mm/vmscan.c:4892 [inline]
 shrink_lruvec+0x25c/0x1760 mm/vmscan.c:5669
 shrink_node_memcgs mm/vmscan.c:5889 [inline]
 shrink_node+0x55e/0x1da0 mm/vmscan.c:5924
 shrink_zones mm/vmscan.c:6168 [inline]
 do_try_to_free_pages+0x3cf/0xc20 mm/vmscan.c:6230
 try_to_free_mem_cgroup_pages+0x1ea/0x4e0 mm/vmscan.c:6545
 try_charge_memcg+0x27a/0xcd0 mm/memcontrol.c:2944
 obj_cgroup_charge_pages+0xbd/0x1d0 mm/memcontrol.c:3416
 __memcg_kmem_charge_page+0x9d/0x170 mm/memcontrol.c:3442
 __alloc_pages_noprof+0x1bc/0x360 mm/page_alloc.c:4700
 alloc_pages_mpol_noprof+0xb1/0x1e0 mm/mempolicy.c:2265
 alloc_pages_noprof+0xe1/0x100 mm/mempolicy.c:2336
 vm_area_alloc_pages mm/vmalloc.c:3583 [inline]
 __vmalloc_area_node mm/vmalloc.c:3659 [inline]
 __vmalloc_node_range_noprof+0x719/0xef0 mm/vmalloc.c:3840
 __kvmalloc_node_noprof+0x121/0x170 mm/util.c:675
 ip_set_alloc+0x1f/0x30 net/netfilter/ipset/ip_set_core.c:256
 hash_netiface_create+0x273/0x730 net/netfilter/ipset/ip_set_hash_gen.h:1568
 ip_set_create+0x359/0x8a0 net/netfilter/ipset/ip_set_core.c:1104
 nfnetlink_rcv_msg+0x4a9/0x570 net/netfilter/nfnetlink.c:302
 netlink_rcv_skb+0x12c/0x230 net/netlink/af_netlink.c:2550
 nfnetlink_rcv+0x16c/0x15b0 net/netfilter/nfnetlink.c:664
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x593/0x670 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x5cc/0x6e0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x140/0x180 net/socket.c:745
 ____sys_sendmsg+0x312/0x410 net/socket.c:2597
 ___sys_sendmsg net/socket.c:2651 [inline]
 __sys_sendmsg+0x1e9/0x280 net/socket.c:2680
 __do_sys_sendmsg net/socket.c:2689 [inline]
 __se_sys_sendmsg net/socket.c:2687 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2687
 x64_sys_call+0x26f8/0x2e00 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000006f8 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11404 Comm: syz.4.2756 Not tainted 6.10.0-syzkaller-10729-g3c3ff7be9729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/07/21 08:30 upstream 3c3ff7be9729 b88348e9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/07/19 22:18 upstream 4305ca0087dd 890ce4f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/07/11 11:24 upstream 9d9a2f29aefd c699c2eb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/27 08:31 upstream afcd48134c58 6ef39602 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/10 06:59 upstream 83a7eefedc9b 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/08 04:40 upstream 96e09b8f8166 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/04 14:06 upstream 2ab795141095 11f2afa5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
* Struck through repros no longer work on HEAD.