syzbot


KCSAN: data-race in xas_create / xas_find (4)

Status: auto-closed as invalid on 2022/06/09 16:26
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 254d, last: 216d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in xas_create / xas_find (2) 5 476d 548d 0/24 auto-closed as invalid on 2021/09/22 15:56
upstream KCSAN: data-race in xas_create / xas_find (5) 1 174d 174d 0/24 auto-closed as invalid on 2022/07/21 09:43
upstream KCSAN: data-race in xas_create / xas_find (3) 11 325d 441d 0/24 auto-closed as invalid on 2022/02/20 21:56
upstream KCSAN: data-race in xas_create / xas_find 2 587d 600d 0/24 auto-closed as invalid on 2021/06/03 16:29

Sample crash report:
loop2: detected capacity change from 0 to 4096
==================================================================
BUG: KCSAN: data-race in xas_create / xas_find

write to 0xffff8881371ae6c1 of 1 bytes by task 1916 on cpu 0:
 xas_expand lib/xarray.c:613 [inline]
 xas_create+0x68a/0xb20 lib/xarray.c:654
 xas_store+0x71/0xc90 lib/xarray.c:788
 __filemap_add_folio+0x271/0x7f0 mm/filemap.c:900
 filemap_add_folio+0x6b/0x150 mm/filemap.c:959
 page_cache_ra_unbounded+0x19e/0x2e0 mm/readahead.c:243
 do_page_cache_ra mm/readahead.c:291 [inline]
 force_page_cache_ra+0x1c6/0x200 mm/readahead.c:322
 page_cache_sync_ra+0x190/0x1b0 mm/readahead.c:688
 page_cache_sync_readahead include/linux/pagemap.h:1185 [inline]
 filemap_get_pages mm/filemap.c:2592 [inline]
 filemap_read+0x3e5/0x1400 mm/filemap.c:2679
 blkdev_read_iter+0x2c6/0x370 block/fops.c:611
 call_read_iter include/linux/fs.h:2044 [inline]
 new_sync_read fs/read_write.c:401 [inline]
 vfs_read+0x5a5/0x6a0 fs/read_write.c:482
 ksys_read+0xe8/0x1a0 fs/read_write.c:620
 __do_sys_read fs/read_write.c:630 [inline]
 __se_sys_read fs/read_write.c:628 [inline]
 __x64_sys_read+0x3e/0x50 fs/read_write.c:628
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881371ae6c1 of 1 bytes by task 2985 on cpu 1:
 xas_find+0x35d/0x3d0 lib/xarray.c:1263
 find_get_entry mm/filemap.c:2030 [inline]
 find_get_entries+0x90/0x2e0 mm/filemap.c:2085
 truncate_inode_pages_range+0x76d/0xae0 mm/truncate.c:404
 truncate_inode_pages+0x20/0x30 mm/truncate.c:452
 kill_bdev block/bdev.c:77 [inline]
 set_blocksize+0x24e/0x270 block/bdev.c:153
 sb_set_blocksize+0x2c/0xa0 block/bdev.c:162
 __ext4_fill_super fs/ext4/super.c:4829 [inline]
 ext4_fill_super+0x16f7/0x3a90 fs/ext4/super.c:5603
 get_tree_bdev+0x2b4/0x3b0 fs/super.c:1292
 vfs_get_tree+0x49/0x190 fs/super.c:1497
 do_new_mount+0x200/0x650 fs/namespace.c:3040
 path_mount+0x4b1/0xb60 fs/namespace.c:3370
 do_mount fs/namespace.c:3383 [inline]
 __do_sys_mount fs/namespace.c:3591 [inline]
 __se_sys_mount+0x281/0x2d0 fs/namespace.c:3568
 __x64_sys_mount+0x63/0x70 fs/namespace.c:3568
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 2985 Comm: syz-executor.2 Not tainted 5.18.0-rc5-syzkaller-00028-ga7391ad35724-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
EXT4-fs error (device loop2): __ext4_fill_super:5326: inode #2: comm syz-executor.2: iget: root inode unallocated
EXT4-fs (loop2): get root inode failed
EXT4-fs (loop2): mount failed

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/05/05 16:24 upstream a7391ad35724 b3f09415 .config log report info KCSAN: data-race in xas_create / xas_find
ci2-upstream-kcsan-gce 2022/04/10 11:39 upstream e1f700ebd6be e22c3da3 .config log report info KCSAN: data-race in xas_create / xas_find
ci2-upstream-kcsan-gce 2022/03/28 14:59 upstream f82da161ea75 89bc8608 .config log report info KCSAN: data-race in xas_create / xas_find
* Struck through repros no longer work on HEAD.