syzbot


KCSAN: data-race in __anon_vma_prepare / wp_page_copy (2)

Status: auto-closed as invalid on 2021/10/12 00:20
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 452d, last: 452d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __anon_vma_prepare / wp_page_copy (3) 1 329d 329d 0/24 auto-closed as invalid on 2022/02/12 08:56
upstream KCSAN: data-race in __anon_vma_prepare / wp_page_copy 7 488d 585d 0/24 auto-closed as invalid on 2021/09/06 09:04

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __anon_vma_prepare / wp_page_copy

write to 0xffff8881321f4208 of 8 bytes by task 5730 on cpu 1:
 __anon_vma_prepare+0x12f/0x2d0 mm/rmap.c:208
 anon_vma_prepare include/linux/rmap.h:149 [inline]
 wp_page_copy+0xb17/0x10d0 mm/memory.c:2994
 do_wp_page+0x5a8/0xba0
 handle_pte_fault mm/memory.c:4576 [inline]
 __handle_mm_fault mm/memory.c:4693 [inline]
 handle_mm_fault+0x946/0x1530 mm/memory.c:4791
 do_user_addr_fault+0x609/0xbe0 arch/x86/mm/fault.c:1390
 handle_page_fault arch/x86/mm/fault.c:1475 [inline]
 exc_page_fault+0x91/0x220 arch/x86/mm/fault.c:1531
 asm_exc_page_fault+0x1e/0x30
 copy_user_enhanced_fast_string+0xe/0x40
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
 _copy_to_user+0x77/0x90 lib/usercopy.c:33
 copy_to_user include/linux/uaccess.h:200 [inline]
 snd_seq_ioctl+0x1ee/0x250 sound/core/seq/seq_clientmgr.c:2180
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:860
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881321f4208 of 8 bytes by task 5716 on cpu 0:
 anon_vma_prepare include/linux/rmap.h:146 [inline]
 wp_page_copy+0x5f/0x10d0 mm/memory.c:2994
 do_wp_page+0x5a8/0xba0
 handle_pte_fault mm/memory.c:4576 [inline]
 __handle_mm_fault mm/memory.c:4693 [inline]
 handle_mm_fault+0x946/0x1530 mm/memory.c:4791
 do_user_addr_fault+0x609/0xbe0 arch/x86/mm/fault.c:1390
 handle_page_fault arch/x86/mm/fault.c:1475 [inline]
 exc_page_fault+0x91/0x220 arch/x86/mm/fault.c:1531
 asm_exc_page_fault+0x1e/0x30
 copy_user_enhanced_fast_string+0xe/0x40
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
 _copy_to_user+0x77/0x90 lib/usercopy.c:33
 copy_to_user include/linux/uaccess.h:200 [inline]
 snd_seq_ioctl+0x1ee/0x250 sound/core/seq/seq_clientmgr.c:2180
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:860
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000000000000000 -> 0xffff888102f55690

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 5716 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/09/07 00:16 upstream 4b93c544e90e 6ca60148 .config log report info KCSAN: data-race in __anon_vma_prepare / wp_page_copy
* Struck through repros no longer work on HEAD.