syzbot


KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (6)

Status: auto-closed as invalid on 2021/09/09 17:02
Subsystems: ext4
[Documentation on labels]
First crash: 1012d, last: 993d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (4) ext4 4 1175d 1233d 0/26 auto-closed as invalid on 2021/03/12 12:46
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (2) ext4 1 1364d 1364d 0/26 auto-closed as invalid on 2020/09/03 19:58
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (3) ext4 1 1309d 1309d 0/26 auto-closed as invalid on 2020/10/29 03:12
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma ext4 1 1441d 1441d 0/26 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (7) ext4 1 794d 794d 0/26 auto-closed as invalid on 2022/03/28 08:47
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (5) ext4 3 1067d 1128d 0/26 auto-closed as invalid on 2021/06/28 10:29

Sample crash report:
==================================================================
BUG: KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma

write to 0xffffea0005df3318 of 8 bytes by task 29084 on cpu 1:
 page_cache_delete_batch mm/filemap.c:318 [inline]
 delete_from_page_cache_batch+0x2fc/0x690 mm/filemap.c:349
 truncate_inode_pages_range+0x1a5/0xa70 mm/truncate.c:326
 truncate_inode_pages mm/truncate.c:424 [inline]
 truncate_pagecache+0x4f/0x70 mm/truncate.c:736
 ext4_setattr+0xa21/0xec0 fs/ext4/inode.c:5498
 notify_change+0x8a3/0xa80 fs/attr.c:398
 do_truncate+0xe8/0x130 fs/open.c:64
 handle_truncate fs/namei.c:3030 [inline]
 do_open fs/namei.c:3378 [inline]
 path_openat+0x19b2/0x1f20 fs/namei.c:3507
 do_filp_open+0xe9/0x200 fs/namei.c:3534
 do_sys_openat2+0xa3/0x250 fs/open.c:1204
 do_sys_open fs/open.c:1220 [inline]
 __do_sys_openat fs/open.c:1236 [inline]
 __se_sys_openat fs/open.c:1231 [inline]
 __x64_sys_openat+0xef/0x110 fs/open.c:1231
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffffea0005df3318 of 8 bytes by task 29091 on cpu 0:
 PageAnon include/linux/page-flags.h:493 [inline]
 page_address_in_vma+0x4a/0x300 mm/rmap.c:710
 new_page+0x4b/0x170 mm/mempolicy.c:1214
 unmap_and_move mm/migrate.c:1132 [inline]
 migrate_pages+0x3b3/0x1530 mm/migrate.c:1411
 do_mbind+0xd43/0xf50 mm/mempolicy.c:1340
 kernel_mbind mm/mempolicy.c:1475 [inline]
 __do_sys_mbind mm/mempolicy.c:1482 [inline]
 __se_sys_mbind mm/mempolicy.c:1478 [inline]
 __x64_sys_mbind+0x10a/0x130 mm/mempolicy.c:1478
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88812dfc1dc8 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 29091 Comm: syz-executor.0 Tainted: G        W         5.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/05 17:02 upstream 251a1524293d d2d6e680 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma
2021/07/29 13:16 upstream 4010a528219e b44001ce .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma
2021/07/25 17:07 upstream d8079fac1681 4d1b57d4 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma
2021/07/17 19:13 upstream d980cc0620ae f115ae98 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma
* Struck through repros no longer work on HEAD.