syzbot


KCSAN: data-race in __delete_from_swap_cache / folio_mapping (4)

Status: moderation: reported on 2024/06/04 14:06
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+d4866c171a234211e4a7@syzkaller.appspotmail.com
First crash: 10d, last: 4d22h
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping mm 2 177d 186d 0/27 auto-obsoleted due to no activity on 2024/01/24 15:33
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping (2) mm 2 122d 134d 0/27 auto-obsoleted due to no activity on 2024/03/19 16:43
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping (3) mm 1 74d 73d 0/27 auto-obsoleted due to no activity on 2024/05/06 15:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __delete_from_swap_cache / folio_mapping

write to 0xffffea00041372e8 of 8 bytes by task 28720 on cpu 0:
 __delete_from_swap_cache+0x1f2/0x290 mm/swap_state.c:161
 delete_from_swap_cache+0x72/0xe0 mm/swap_state.c:241
 folio_free_swap+0x19f/0x1c0 mm/swapfile.c:1593
 free_swap_cache mm/swap_state.c:290 [inline]
 free_pages_and_swap_cache+0x1f4/0x400 mm/swap_state.c:322
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
 tlb_flush_mmu+0x2cf/0x440 mm/mmu_gather.c:373
 tlb_finish_mmu+0x8c/0x100 mm/mmu_gather.c:465
 unmap_region+0x1f7/0x230 mm/mmap.c:2370
 do_vmi_align_munmap+0x6df/0xa60 mm/mmap.c:2683
 do_vmi_munmap+0x1fb/0x250 mm/mmap.c:2759
 do_munmap+0x7a/0xb0 mm/mmap.c:2775
 mremap_to mm/mremap.c:924 [inline]
 __do_sys_mremap mm/mremap.c:1076 [inline]
 __se_sys_mremap+0xabc/0xf20 mm/mremap.c:993
 __x64_sys_mremap+0x67/0x80 mm/mremap.c:993
 x64_sys_call+0x1029/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:26
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffea00041372e8 of 8 bytes by task 28709 on cpu 1:
 folio_mapping+0xd2/0x110 mm/util.c:797
 folio_evictable mm/internal.h:353 [inline]
 move_folios_to_lru+0x137/0x690 mm/vmscan.c:1826
 shrink_inactive_list mm/vmscan.c:1947 [inline]
 shrink_list mm/vmscan.c:2179 [inline]
 shrink_lruvec+0xbfa/0x15f0 mm/vmscan.c:5703
 shrink_node_memcgs mm/vmscan.c:5889 [inline]
 shrink_node+0x9d1/0x13c0 mm/vmscan.c:5924
 shrink_zones mm/vmscan.c:6168 [inline]
 do_try_to_free_pages+0x3c6/0xc50 mm/vmscan.c:6230
 try_to_free_mem_cgroup_pages+0x1eb/0x4e0 mm/vmscan.c:6545
 try_charge_memcg+0x27a/0xcd0 mm/memcontrol.c:2944
 obj_cgroup_charge_pages+0xbd/0x1d0 mm/memcontrol.c:3416
 __memcg_kmem_charge_page+0x9d/0x170 mm/memcontrol.c:3442
 __alloc_pages_noprof+0x1bc/0x360 mm/page_alloc.c:4695
 alloc_pages_mpol_noprof+0xb1/0x1e0 mm/mempolicy.c:2265
 alloc_pages_noprof+0xe1/0x100 mm/mempolicy.c:2336
 vm_area_alloc_pages mm/vmalloc.c:3566 [inline]
 __vmalloc_area_node mm/vmalloc.c:3642 [inline]
 __vmalloc_node_range_noprof+0x719/0xef0 mm/vmalloc.c:3823
 kvmalloc_node_noprof+0x121/0x170 mm/util.c:659
 ip_set_alloc+0x1f/0x30 net/netfilter/ipset/ip_set_core.c:255
 hash_netiface_create+0x273/0x730 net/netfilter/ipset/ip_set_hash_gen.h:1568
 ip_set_create+0x359/0x8a0 net/netfilter/ipset/ip_set_core.c:1103
 nfnetlink_rcv_msg+0x4a9/0x570 net/netfilter/nfnetlink.c:302
 netlink_rcv_skb+0x12c/0x230 net/netlink/af_netlink.c:2564
 nfnetlink_rcv+0x16c/0x15b0 net/netfilter/nfnetlink.c:664
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x58d/0x660 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x5ca/0x6e0 net/netlink/af_netlink.c:1905
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x140/0x180 net/socket.c:745
 ____sys_sendmsg+0x312/0x410 net/socket.c:2585
 ___sys_sendmsg net/socket.c:2639 [inline]
 __sys_sendmsg+0x1e9/0x280 net/socket.c:2668
 __do_sys_sendmsg net/socket.c:2677 [inline]
 __se_sys_sendmsg net/socket.c:2675 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2675
 x64_sys_call+0xb25/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000005d8 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 28709 Comm: syz-executor.2 Tainted: G        W          6.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/10 06:59 upstream 83a7eefedc9b 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/08 04:40 upstream 96e09b8f8166 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/06/04 14:06 upstream 2ab795141095 11f2afa5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
* Struck through repros no longer work on HEAD.