KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_node_cpus (2)

Status: fixed on 2020/07/17 17:58
Subsystems: fs mm
[Documentation on labels]
Fix commit: 314eeb43e5f2 rcu: Add *_ONCE() and data_race() to rcu_node ->exp_tasks plus locking
First crash: 1643d, last: 1476d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_node_cpus block 1 1664d 1664d 0/26 closed as invalid on 2019/11/19 13:44

Sample crash report:
BUG: KCSAN: data-race in __rcu_read_unlock / sync_rcu_exp_select_node_cpus

write to 0xffffffff872851a0 of 8 bytes by task 10538 on cpu 1:
 sync_rcu_exp_select_node_cpus+0x21a/0x500 kernel/rcu/tree_exp.h:376
 sync_rcu_exp_select_cpus+0x31f/0x5a0 kernel/rcu/tree_exp.h:441
 rcu_exp_sel_wait_wake kernel/rcu/tree_exp.h:614 [inline]
 wait_rcu_exp_gp+0x25/0x40 kernel/rcu/tree_exp.h:628
 process_one_work+0x424/0x930 kernel/workqueue.c:2268
 worker_thread+0x9a/0x7e0 kernel/workqueue.c:2414
 kthread+0x203/0x230 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffffffff872851a0 of 8 bytes by task 2178 on cpu 0:
 rcu_read_unlock_special kernel/rcu/tree_plugin.h:618 [inline]
 __rcu_read_unlock+0x1cf/0x390 kernel/rcu/tree_plugin.h:400
 rcu_read_unlock include/linux/rcupdate.h:654 [inline]
 filemap_map_pages+0x6e8/0xa50 mm/filemap.c:2652
 do_fault_around mm/memory.c:3807 [inline]
 do_read_fault mm/memory.c:3841 [inline]
 do_fault mm/memory.c:3975 [inline]
 handle_pte_fault mm/memory.c:4215 [inline]
 __handle_mm_fault+0x2ba6/0x2da0 mm/memory.c:4345
 handle_mm_fault+0x21c/0x540 mm/memory.c:4382
 faultin_page mm/gup.c:879 [inline]
 __get_user_pages+0x533/0x11c0 mm/gup.c:1098
 populate_vma_page_range+0xdc/0x100 mm/gup.c:1430
 __mm_populate+0x168/0x2b0 mm/gup.c:1478
 mm_populate include/linux/mm.h:2562 [inline]
 vm_mmap_pgoff+0x185/0x190 mm/util.c:511
 ksys_mmap_pgoff+0x96/0x420 mm/mmap.c:1595
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 2178 Comm: syz-executor.2 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/05/10 17:07 kcsan 7c3cd68e5d38 8742a2b9 .config console log report ci2-upstream-kcsan-gce
2020/05/01 04:28 kcsan 7c3cd68e5d38 3698959a .config console log report ci2-upstream-kcsan-gce
2020/04/26 10:35 kcsan 7c3cd68e5d38 0ce7569e .config console log report ci2-upstream-kcsan-gce
2020/01/15 20:35 kcsan 245a43005292 f9b69507 .config console log report ci2-upstream-kcsan-gce
2020/01/15 13:57 kcsan 245a43005292 fa12bd3c .config console log report ci2-upstream-kcsan-gce
2019/12/22 18:07 kcsan 245a43005292 8b967267 .config console log report ci2-upstream-kcsan-gce
2019/11/29 21:44 kcsan ef798c30ba4e 4f7e1d0f .config console log report ci2-upstream-kcsan-gce
2019/11/26 21:08 kcsan ef798c30ba4e 1048481f .config console log report ci2-upstream-kcsan-gce
2019/11/25 21:31 kcsan 5863cc791e4c 598ca6c8 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.