syzbot


KCSAN: data-race in drain_all_stock / drain_obj_stock

Status: auto-closed as invalid on 2022/03/06 02:49
Subsystems: cgroups mm
[Documentation on labels]
First crash: 751d, last: 751d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in drain_all_stock / drain_obj_stock (2) cgroups mm 1 698d 698d 0/26 auto-closed as invalid on 2022/04/28 00:32
upstream KCSAN: data-race in drain_all_stock / drain_obj_stock (3) mm cgroups 1 563d 563d 0/26 auto-closed as invalid on 2022/09/10 21:57
upstream KCSAN: data-race in drain_all_stock / drain_obj_stock (4) cgroups mm 3 289d 305d 23/26 fixed on 2023/09/28 17:51

Sample crash report:
==================================================================
BUG: KCSAN: data-race in drain_all_stock / drain_obj_stock

write to 0xffff888237c28320 of 8 bytes by interrupt on cpu 0:
 drain_obj_stock+0x2af/0x350 mm/memcontrol.c:3199
 refill_obj_stock+0x80/0x220 mm/memcontrol.c:3229
 obj_cgroup_uncharge+0xa/0x10 mm/memcontrol.c:3295
 memcg_slab_free_hook+0xe4/0x170 mm/slab.h:571
 ___cache_free+0x46/0x310 mm/slab.c:3456
 __cache_free mm/slab.c:3445 [inline]
 kmem_cache_free+0x65/0x110 mm/slab.c:3733
 put_pid kernel/pid.c:114 [inline]
 delayed_put_pid+0x69/0xb0 kernel/pid.c:123
 rcu_do_batch kernel/rcu/tree.c:2527 [inline]
 rcu_core+0x886/0xee0 kernel/rcu/tree.c:2778
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2795
 __do_softirq+0x158/0x2de kernel/softirq.c:558
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0x37/0x70 kernel/softirq.c:649
 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x12/0x20
 decode_watchpoint kernel/kcsan/encoding.h:74 [inline]
 find_watchpoint kernel/kcsan/core.c:130 [inline]
 check_access kernel/kcsan/core.c:726 [inline]
 __tsan_unaligned_write1+0x3c/0x180 kernel/kcsan/core.c:1011
 __hrtimer_init kernel/time/hrtimer.c:1572 [inline]
 __hrtimer_init_sleeper kernel/time/hrtimer.c:1996 [inline]
 hrtimer_init_sleeper+0xd7/0x1f0 kernel/time/hrtimer.c:2011
 hrtimer_init_sleeper_on_stack include/linux/hrtimer.h:397 [inline]
 hrtimer_nanosleep+0xaf/0x200 kernel/time/hrtimer.c:2095
 common_nsleep+0x69/0x80 kernel/time/posix-timers.c:1227
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1267 [inline]
 __se_sys_clock_nanosleep+0x1f1/0x220 kernel/time/posix-timers.c:1245
 __x64_sys_clock_nanosleep+0x51/0x60 kernel/time/posix-timers.c:1245
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888237c28320 of 8 bytes by task 18719 on cpu 1:
 obj_stock_flush_required mm/memcontrol.c:3212 [inline]
 drain_all_stock+0x1bb/0x4b0 mm/memcontrol.c:2258
 mem_cgroup_css_offline+0x79/0x210 mm/memcontrol.c:5287
 offline_css kernel/cgroup/cgroup.c:5277 [inline]
 css_killed_work_fn+0x8d/0x210 kernel/cgroup/cgroup.c:5554
 process_one_work+0x3f6/0x960 kernel/workqueue.c:2307
 worker_thread+0x616/0xa70 kernel/workqueue.c:2454
 kthread+0x1bf/0x1e0 kernel/kthread.c:377
 ret_from_fork+0x1f/0x30

value changed: 0xffff8881368e8640 -> 0xffff888136234980

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 18719 Comm: kworker/1:51 Not tainted 5.17.0-rc1-syzkaller-00418-gf8c7e4ede46f-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: cgroup_destroy css_killed_work_fn
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/30 02:48 upstream f8c7e4ede46f 495e00c5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in drain_all_stock / drain_obj_stock
* Struck through repros no longer work on HEAD.