syzbot


DATA RACE in mm.(*MemoryManager).DecUsers

Status: fixed on 2026/03/17 20:38
Fix commit: 70fb1c0d2c45 Fix the data race for mm.(*MemoryManager).as.
First crash: 22d, last: 22d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000a37ec0 by goroutine 505:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).DecUsers()
      pkg/sentry/mm/lifecycle.go:286 +0x204
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Kernel).LoadTaskImage.deferwrap1()
      pkg/sentry/kernel/task_image.go:146 +0x4f
  runtime.deferreturn()
      GOROOT/src/runtime/panic.go:589 +0x5d
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runExecveAfterExecveCredsLock).execute()
      pkg/sentry/kernel/task_exec.go:191 +0x804
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44

Previous read at 0x00c000a37ec0 by goroutine 507:
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).unmapASLocked()
      pkg/sentry/mm/address_space.go:129 +0x64
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).invalidateLocked()
      pkg/sentry/mm/pma.go:715 +0x355
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).Invalidate()
      pkg/sentry/mm/pma.go:667 +0x22b
  gvisor.dev/gvisor/pkg/sentry/memmap.MappingOfRange.invalidate()
      pkg/sentry/memmap/mapping_set.go:47 +0x28c
  gvisor.dev/gvisor/pkg/sentry/memmap.(*MappingSet).Invalidate()
      pkg/sentry/memmap/mapping_set.go:241 +0x232
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncateLocked()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:227 +0x244
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*regularFile).truncate()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:181 +0xaf
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*dentry).open()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:471 +0x97c
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).OpenAt()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:446 +0xcce
  gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).OpenAt()
      pkg/sentry/vfs/vfs.go:470 +0x732
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.openat()
      pkg/sentry/syscalls/linux/sys_file.go:110 +0x344
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Creat()
      pkg/sentry/syscalls/linux/sys_file.go:96 +0x45
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x94b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x71
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0x93
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x48f
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:258 +0x1eb0
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:89 +0x4a9
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:416 +0x44

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/16 06:28 gvisor 93555402076d ee8d34d6 .config console log report syz / log C ci-gvisor-systrap-1-race DATA RACE in mm.(*MemoryManager).DecUsers
2026/03/16 06:28 gvisor 93555402076d ee8d34d6 .config console log report syz / log C ci-gvisor-ptrace-1-race DATA RACE in mm.(*MemoryManager).DecUsers
2026/03/16 06:12 gvisor 93555402076d ee8d34d6 .config console log report syz / log C ci-gvisor-ptrace-2-race DATA RACE in mm.(*MemoryManager).DecUsers
2026/03/16 05:56 gvisor 93555402076d ee8d34d6 .config console log report info ci-gvisor-ptrace-2-race DATA RACE in mm.(*MemoryManager).DecUsers
* Struck through repros no longer work on HEAD.