KCSAN: data-race in pcpu_balance_workfn / pcpu_nr

KCSAN: data-race in pcpu_balance_workfn / pcpu_nr_pages (2)

Status: moderation: reported on 2025/06/27 22:40
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+e5bd32b79413e86f389e@syzkaller.appspotmail.com
Fix commit: mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 22d, last: 22d

▶ ▼ Discussions (2)

Title	Replies (including bot)	Last reply
[PATCH v2] mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock	4 (4)	2025/07/14 07:10
[PATCH] mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock	9 (9)	2025/07/03 16:39

▶ ▼ Similar bugs (1)

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in pcpu_balance_workfn / pcpu_nr_pages kernel	6				1	238d	238d	0/29	auto-obsoleted due to no activity on 2025/01/18 07:22

Sample crash report:

==================================================================
BUG: KCSAN: data-race in pcpu_balance_workfn / pcpu_nr_pages

read-write to 0xffffffff88e84988 of 8 bytes by task 3391 on cpu 1:
 pcpu_chunk_depopulated mm/percpu.c:1540 [inline]
 pcpu_reclaim_populated mm/percpu.c:2152 [inline]
 pcpu_balance_workfn+0x2eb/0xc00 mm/percpu.c:2204
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3321
 worker_thread+0x582/0x770 kernel/workqueue.c:3402
 kthread+0x486/0x510 kernel/kthread.c:464
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffffffff88e84988 of 8 bytes by task 12195 on cpu 0:
 pcpu_nr_pages+0x16/0x40 mm/percpu.c:3358
 meminfo_proc_show+0x94b/0xa30 fs/proc/meminfo.c:132
 traverse+0x144/0x3a0 fs/seq_file.c:111
 seq_read_iter+0x853/0x940 fs/seq_file.c:195
 proc_reg_read_iter+0xe3/0x180 fs/proc/inode.c:295
 io_iter_do_read io_uring/rw.c:828 [inline]
 __io_read+0x438/0xc20 io_uring/rw.c:941
 io_read+0x1c/0x60 io_uring/rw.c:1020
 __io_issue_sqe+0xfe/0x2e0 io_uring/io_uring.c:1738
 io_issue_sqe+0x53/0x970 io_uring/io_uring.c:1761
 io_queue_sqe io_uring/io_uring.c:1968 [inline]
 io_submit_sqe io_uring/io_uring.c:2224 [inline]
 io_submit_sqes+0x667/0xfd0 io_uring/io_uring.c:2337
 __do_sys_io_uring_enter io_uring/io_uring.c:3404 [inline]
 __se_sys_io_uring_enter+0x1c1/0x1b70 io_uring/io_uring.c:3338
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3338
 x64_sys_call+0x28c8/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000295 -> 0x000000000000028e

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 12195 Comm: syz.5.3624 Not tainted 6.16.0-rc3-syzkaller-00190-g67a993863163 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/06/27 22:39	upstream	67a993863163	fc9d8ee5	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-kcsan-gce	KCSAN: data-race in pcpu_balance_workfn / pcpu_nr_pages

* ~~Struck through~~ repros no longer work on HEAD.