syzbot


KCSAN: data-race in mas_state_walk / mas_wr_store_entry

Status: moderation: reported on 2025/04/27 04:37
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+ff9c72a9eb3dc1c87021@syzkaller.appspotmail.com
First crash: 7d05h, last: 1d10h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wr_store_entry

write to 0xffff888104af6310 of 8 bytes by task 7406 on cpu 0:
 mas_wr_slot_store lib/maple_tree.c:3895 [inline]
 mas_wr_store_entry+0x15cc/0x2b60 lib/maple_tree.c:4080
 mas_store_prealloc+0x74d/0x9e0 lib/maple_tree.c:5475
 vma_iter_store_overwrite mm/vma.h:448 [inline]
 commit_merge+0x66e/0x6f0 mm/vma.c:709
 vma_expand+0x1d0/0x370 mm/vma.c:1114
 vma_merge_new_range+0x296/0x310 mm/vma.c:1052
 __mmap_region mm/vma.c:2514 [inline]
 mmap_region+0x7e6/0x1470 mm/vma.c:2597
 do_mmap+0x9de/0xc20 mm/mmap.c:561
 vm_mmap_pgoff+0x17a/0x2e0 mm/util.c:579
 ksys_mmap_pgoff+0xc2/0x310 mm/mmap.c:607
 x64_sys_call+0x1602/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888104af6310 of 8 bytes by task 7408 on cpu 1:
 mtree_range_walk lib/maple_tree.c:2777 [inline]
 mas_state_walk+0x2f5/0x650 lib/maple_tree.c:3605
 mas_walk+0x30/0x120 lib/maple_tree.c:4905
 lock_vma_under_rcu+0xa2/0x2f0 mm/memory.c:6553
 do_user_addr_fault+0x233/0x1090 arch/x86/mm/fault.c:1328
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00007f38e5865fff -> 0xffffffff855c9c30

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 7408 Comm: syz.6.824 Not tainted 6.15.0-rc4-syzkaller-00189-g2bfcee565c3a #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/03 00:27 upstream 2bfcee565c3a b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wr_store_entry
2025/04/29 02:53 upstream f15d97df5afa aeb6ec69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wr_store_entry
2025/04/27 04:36 upstream 5bc1018675ec c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wr_store_entry
* Struck through repros no longer work on HEAD.