syzbot


KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start (2)

Status: closed as invalid on 2020/06/18 14:24
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 961d, last: 854d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start 7 1037d 1066d 0/24 auto-closed as invalid on 2020/02/01 21:57
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start (3) 4 790d 829d 0/24 auto-closed as invalid on 2020/08/31 17:17
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start (4) 1 755d 755d 0/24 auto-closed as invalid on 2020/10/06 00:28
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start (5) 17 529d 657d 0/24 auto-closed as invalid on 2021/05/19 10:43

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_start

write to 0xffffc90014b66160 of 8 bytes by task 17963 on cpu 1:
 kvm_mmu_notifier_invalidate_range_start+0x62/0x160 arch/x86/kvm/../../../virt/kvm/kvm_main.c:412
 mn_hlist_invalidate_range_start mm/mmu_notifier.c:493 [inline]
 __mmu_notifier_invalidate_range_start+0x27e/0x350 mm/mmu_notifier.c:525
 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:446 [inline]
 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:439 [inline]
 try_to_unmap_one+0x1797/0x1b30 mm/rmap.c:1412
 rmap_walk_file+0x240/0x590 mm/rmap.c:1917
 rmap_walk+0x10e/0x180 mm/rmap.c:1935
 try_to_unmap+0x14c/0x2e0 mm/rmap.c:1754
 shrink_page_list+0xfa4/0x2a40 mm/vmscan.c:1301
 reclaim_pages+0x5de/0x830 mm/vmscan.c:2138
 madvise_cold_or_pageout_pte_range+0xc31/0x1b20 mm/madvise.c:379
 walk_pmd_range mm/pagewalk.c:89 [inline]
 walk_pud_range mm/pagewalk.c:160 [inline]
 walk_p4d_range mm/pagewalk.c:193 [inline]
 walk_pgd_range mm/pagewalk.c:229 [inline]
 __walk_page_range+0xa6e/0x1550 mm/pagewalk.c:331
 walk_page_range+0x14c/0x280 mm/pagewalk.c:427
 madvise_pageout_page_range mm/madvise.c:520 [inline]
 madvise_pageout+0x15e/0x200 mm/madvise.c:556
 madvise_vma mm/madvise.c:945 [inline]
 do_madvise mm/madvise.c:1127 [inline]
 do_madvise+0x865/0x12c0 mm/madvise.c:1053
 __do_sys_madvise mm/madvise.c:1153 [inline]
 __se_sys_madvise mm/madvise.c:1151 [inline]
 __x64_sys_madvise+0x48/0x60 mm/madvise.c:1151
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffc90014b66160 of 8 bytes by task 310 on cpu 0:
 kvm_mmu_notifier_invalidate_range_end+0x77/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:451
 mn_hlist_invalidate_end mm/mmu_notifier.c:560 [inline]
 __mmu_notifier_invalidate_range_end+0x19e/0x250 mm/mmu_notifier.c:580
 mmu_notifier_invalidate_range_end include/linux/mmu_notifier.h:472 [inline]
 page_mkclean_one+0x408/0x410 mm/rmap.c:966
 rmap_walk_file+0x240/0x590 mm/rmap.c:1917
 rmap_walk+0x10e/0x180 mm/rmap.c:1935
 page_mkclean+0x15d/0x190 mm/rmap.c:998
 clear_page_dirty_for_io+0x16c/0x520 mm/page-writeback.c:2690
 mpage_submit_page+0x64/0x190 fs/ext4/inode.c:2053
 mpage_process_page_bufs+0x3df/0x400 fs/ext4/inode.c:2187
 mpage_prepare_extent_to_map+0x43b/0x6e0 fs/ext4/inode.c:2595
 ext4_writepages+0x5a1/0x1e10 fs/ext4/inode.c:2723
 do_writepages+0x6b/0x170 mm/page-writeback.c:2344
 __writeback_single_inode+0xaa/0x910 fs/fs-writeback.c:1452
 writeback_sb_inodes+0x4c8/0xa10 fs/fs-writeback.c:1716
 __writeback_inodes_wb+0xe9/0x1b0 fs/fs-writeback.c:1785
 wb_writeback+0x557/0x6a0 fs/fs-writeback.c:1894
 wb_check_old_data_flush fs/fs-writeback.c:1996 [inline]
 wb_do_writeback fs/fs-writeback.c:2049 [inline]
 wb_workfn+0x796/0x970 fs/fs-writeback.c:2078
 process_one_work+0x424/0x930 kernel/workqueue.c:2268
 worker_thread+0x9a/0x7e0 kernel/workqueue.c:2414
 kthread+0x203/0x230 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 310 Comm: kworker/u4:3 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
==================================================================

Crashes (5):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2020/05/24 11:43 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 96c92ad3 .config log report
ci2-upstream-kcsan-gce 2020/04/27 14:37 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 0ce7569e .config log report
ci2-upstream-kcsan-gce 2020/03/12 11:14 https://github.com/google/ktsan.git kcsan 941e0d917bbf d850e9d0 .config log report
ci2-upstream-kcsan-gce 2020/02/11 09:11 https://github.com/google/ktsan.git kcsan f60f0f543333 084454ae .config log report
ci2-upstream-kcsan-gce 2020/02/07 21:04 https://github.com/google/ktsan.git kcsan 6cccb8ba35bd 06150bf1 .config log report
* Struck through repros no longer work on HEAD.