syzbot


KCSAN: data-race in mlock_pagevec / need_mlock_page_drain

Status: auto-closed as invalid on 2022/08/13 12:31
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 170d, last: 142d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mlock_pagevec / need_mlock_page_drain (2) 1 93d 93d 0/24 auto-closed as invalid on 2022/10/01 08:17

Sample crash report:
EXT4-fs (loop0): unmounting filesystem.
==================================================================
BUG: KCSAN: data-race in mlock_pagevec / need_mlock_page_drain

write to 0xffff888237c27ec0 of 1 bytes by task 32603 on cpu 0:
 pagevec_reinit include/linux/pagevec.h:57 [inline]
 mlock_pagevec+0x13a/0x150 mm/mlock.c:210
 munlock_page+0x25f/0x2a0 mm/mlock.c:304
 munlock_vma_page mm/internal.h:539 [inline]
 page_remove_rmap+0x17e/0x220 mm/rmap.c:1467
 zap_pte_range+0x6ca/0x1560 mm/memory.c:1446
 zap_pmd_range mm/memory.c:1567 [inline]
 zap_pud_range mm/memory.c:1596 [inline]
 zap_p4d_range mm/memory.c:1617 [inline]
 unmap_page_range+0x2dc/0x3d0 mm/memory.c:1638
 unmap_single_vma+0x157/0x230 mm/memory.c:1686
 unmap_vmas+0xdf/0x1a0 mm/memory.c:1723
 exit_mmap+0x11f/0x380 mm/mmap.c:3162
 __mmput+0x27/0x1b0 kernel/fork.c:1187
 mmput+0x3d/0x50 kernel/fork.c:1208
 exit_mm+0xdb/0x170 kernel/exit.c:510
 do_exit+0x51d/0x1720 kernel/exit.c:782
 do_group_exit+0xa5/0x160 kernel/exit.c:925
 get_signal+0xf54/0x1020 kernel/signal.c:2857
 arch_do_signal_or_restart+0x87/0x2d0 arch/x86/kernel/signal.c:869
 exit_to_user_mode_loop+0x78/0x130 kernel/entry/common.c:166
 exit_to_user_mode_prepare kernel/entry/common.c:201 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x6a/0x90 kernel/entry/common.c:294
 do_syscall_64+0x37/0x70 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

read to 0xffff888237c27ec0 of 1 bytes by task 5362 on cpu 1:
 pagevec_count include/linux/pagevec.h:62 [inline]
 need_mlock_page_drain+0x2c/0x50 mm/mlock.c:236
 __lru_add_drain_all+0x24c/0x3e0 mm/swap.c:832
 lru_add_drain_all+0xc/0x10 mm/swap.c:849
 invalidate_bdev+0x56/0x80 block/bdev.c:87
 ext4_put_super+0x510/0x810 fs/ext4/super.c:1279
 generic_shutdown_super+0xd5/0x240 fs/super.c:462
 kill_block_super+0x4a/0x90 fs/super.c:1394
 deactivate_locked_super+0x6a/0xb0 fs/super.c:332
 deactivate_super+0x85/0x90 fs/super.c:363
 cleanup_mnt+0x267/0x2d0 fs/namespace.c:1186
 __cleanup_mnt+0x15/0x20 fs/namespace.c:1193
 task_work_run+0x8e/0x110 kernel/task_work.c:177
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0x124/0x130 kernel/entry/common.c:169
 exit_to_user_mode_prepare kernel/entry/common.c:201 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
 syscall_exit_to_user_mode+0x6a/0x90 kernel/entry/common.c:294
 do_syscall_64+0x37/0x70 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

value changed: 0x0f -> 0x06

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 5362 Comm: syz-executor.0 Tainted: G        W         5.19.0-rc5-syzkaller-00228-ge5524c2a1fc4-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
==================================================================
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.
EXT4-fs (loop0): unmounting filesystem.

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/07/09 12:31 upstream e5524c2a1fc4 b5765a15 .config log report info KCSAN: data-race in mlock_pagevec / need_mlock_page_drain
ci2-upstream-kcsan-gce 2022/06/12 10:28 upstream 7a68065eb9cd 0d5abf15 .config log report info KCSAN: data-race in mlock_pagevec / need_mlock_page_drain
ci2-upstream-kcsan-gce 2022/06/11 03:21 upstream a32e7ea36235 0d5abf15 .config log report info KCSAN: data-race in mlock_pagevec / need_mlock_page_drain
* Struck through repros no longer work on HEAD.