syzbot


KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn (2)

Status: auto-closed as invalid on 2021/12/25 22:36
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 381d, last: 372d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn (3) 1 288d 288d 0/24 auto-closed as invalid on 2022/03/19 14:36
upstream KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn (4) 3 141d 193d 0/24 auto-closed as invalid on 2022/08/13 14:33
upstream KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn 1 486d 486d 0/24 auto-closed as invalid on 2021/09/03 07:09

Sample crash report:
EXT4-fs (loop2): bad geometry: block count 128 exceeds size of device (10 blocks)
==================================================================
BUG: KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn

write to 0xffff888237c279c8 of 1 bytes by task 1826 on cpu 0:
 pagevec_reinit include/linux/pagevec.h:56 [inline]
 pagevec_lru_move_fn+0x317/0x340 mm/swap.c:215
 activate_page_drain mm/swap.c:338 [inline]
 lru_add_drain_cpu+0x230/0x260 mm/swap.c:637
 lru_add_drain mm/swap.c:716 [inline]
 __pagevec_release+0x4b/0xc0 mm/swap.c:996
 pagevec_release include/linux/pagevec.h:81 [inline]
 write_cache_pages+0x699/0x7f0 mm/page-writeback.c:2294
 generic_writepages+0x7c/0xc0 mm/page-writeback.c:2346
 blkdev_writepages+0x19/0x20 block/fops.c:428
 do_writepages+0x1cb/0x330 mm/page-writeback.c:2364
 filemap_fdatawrite_wbc mm/filemap.c:407 [inline]
 __filemap_fdatawrite_range mm/filemap.c:440 [inline]
 __filemap_fdatawrite mm/filemap.c:446 [inline]
 filemap_flush+0xd7/0x100 mm/filemap.c:473
 sync_blockdev_nowait+0x32/0x40 block/bdev.c:192
 sync_filesystem+0xc9/0x150 fs/sync.c:57
 generic_shutdown_super+0x40/0x250 fs/super.c:448
 kill_block_super+0x4a/0x90 fs/super.c:1397
 deactivate_locked_super+0x6a/0xb0 fs/super.c:335
 deactivate_super+0x85/0x90 fs/super.c:366
 cleanup_mnt+0x267/0x2d0 fs/namespace.c:1137
 __cleanup_mnt+0x15/0x20 fs/namespace.c:1144
 task_work_run+0x8e/0x110 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:175 [inline]
 exit_to_user_mode_prepare+0x160/0x190 kernel/entry/common.c:207
 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
 syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300
 do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888237c279c8 of 1 bytes by task 6086 on cpu 1:
 pagevec_count include/linux/pagevec.h:61 [inline]
 need_activate_page_drain mm/swap.c:343 [inline]
 __lru_add_drain_all+0x236/0x3e0 mm/swap.c:839
 lru_add_drain_all+0xc/0x10 mm/swap.c:856
 invalidate_bdev+0x56/0x80 block/bdev.c:88
 invalidate_disk+0x25/0xb0 block/genhd.c:651
 __loop_clr_fd+0x41f/0x6c0 drivers/block/loop.c:1147
 loop_clr_fd drivers/block/loop.c:1237 [inline]
 lo_ioctl+0x985/0x1270 drivers/block/loop.c:1562
 blkdev_ioctl+0x20e/0x440 block/ioctl.c:609
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:860
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6086 Comm: syz-executor.2 Not tainted 5.16.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/11/20 22:28 upstream 61564e7b3abc 4eb20a4e .config log report info KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn
ci2-upstream-kcsan-gce 2021/11/12 13:34 upstream 5833291ab6de 75b04091 .config log report info KCSAN: data-race in __lru_add_drain_all / pagevec_lru_move_fn
* Struck through repros no longer work on HEAD.