syzbot


KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (3)

Status: auto-closed as invalid on 2022/03/06 18:39
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 390d, last: 302d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (2) 3 750d 722d 0/24 auto-closed as invalid on 2020/12/21 11:49
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (4) 11 101d 254d 0/24 auto-closed as invalid on 2022/09/24 02:55
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf 17 1030d 1126d 0/24 auto-closed as invalid on 2020/04/13 07:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf

write to 0xffff8881406a5438 of 8 bytes by interrupt on cpu 1:
 relay_switch_subbuf+0x3b5/0x3c0 kernel/relay.c:711
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x66f/0x740 kernel/trace/blktrace.c:275
 blk_add_trace_rq kernel/trace/blktrace.c:836 [inline]
 blk_add_trace_rq_complete+0x102/0x110 kernel/trace/blktrace.c:869
 trace_block_rq_complete include/trace/events/block.h:115 [inline]
 blk_update_request+0x8a9/0x8f0 block/blk-mq.c:780
 scsi_end_request+0x4b/0x460 drivers/scsi/scsi_lib.c:543
 scsi_io_completion+0x10d/0x1220 drivers/scsi/scsi_lib.c:980
 scsi_finish_command+0x1d0/0x1e0 drivers/scsi/scsi.c:198
 scsi_complete+0x1a5/0x1e0 drivers/scsi/scsi_lib.c:1482
 blk_complete_reqs block/blk-mq.c:999 [inline]
 blk_done_softirq+0x92/0xc0 block/blk-mq.c:1004
 __do_softirq+0x158/0x2de kernel/softirq.c:558
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0x37/0x70 kernel/softirq.c:649
 common_interrupt+0x9f/0xc0 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40
 __mem_cgroup_charge+0xc/0xa0 mm/memcontrol.c:6703
 mem_cgroup_charge include/linux/memcontrol.h:667 [inline]
 do_anonymous_page+0x1ce/0x8d0 mm/memory.c:3783
 handle_pte_fault mm/memory.c:4568 [inline]
 __handle_mm_fault mm/memory.c:4705 [inline]
 handle_mm_fault+0x814/0x1590 mm/memory.c:4803
 faultin_page mm/gup.c:944 [inline]
 __get_user_pages+0x388/0xc80 mm/gup.c:1165
 __get_user_pages_locked mm/gup.c:1350 [inline]
 __gup_longterm_locked+0x185/0x7d0 mm/gup.c:1941
 pin_user_pages+0x6b/0x90 mm/gup.c:3100
 xdp_umem_pin_pages+0xad/0x1e0 net/xdp/xdp_umem.c:107
 xdp_umem_reg net/xdp/xdp_umem.c:219 [inline]
 xdp_umem_create+0x551/0x6c0 net/xdp/xdp_umem.c:252
 xsk_setsockopt+0x623/0x6a0 net/xdp/xsk.c:1051
 __sys_setsockopt+0x209/0x2a0 net/socket.c:2180
 __do_sys_setsockopt net/socket.c:2191 [inline]
 __se_sys_setsockopt net/socket.c:2188 [inline]
 __x64_sys_setsockopt+0x62/0x70 net/socket.c:2188
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

write to 0xffff8881406a5438 of 8 bytes by task 31506 on cpu 0:
 relay_switch_subbuf+0x3b5/0x3c0 kernel/relay.c:711
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x66f/0x740 kernel/trace/blktrace.c:275
 blk_add_trace_bio kernel/trace/blktrace.c:896 [inline]
 blk_add_trace_bio_queue+0xb1/0xc0 kernel/trace/blktrace.c:928
 trace_block_bio_queue include/trace/events/block.h:332 [inline]
 submit_bio_checks+0x84e/0x890 block/blk-core.c:772
 __submit_bio+0x41/0x350 block/blk-core.c:802
 __submit_bio_noacct_mq block/blk-core.c:881 [inline]
 submit_bio_noacct+0x418/0x4e0 block/blk-core.c:907
 submit_bio+0x10c/0x180
 iomap_dio_submit_bio fs/iomap/direct-io.c:66 [inline]
 iomap_dio_bio_iter+0x9ed/0xc70 fs/iomap/direct-io.c:351
 __iomap_dio_rw+0x915/0x10b0 fs/iomap/direct-io.c:590
 iomap_dio_rw+0x38/0x80 fs/iomap/direct-io.c:680
 ext4_dio_write_iter fs/ext4/file.c:564 [inline]
 ext4_file_write_iter+0x7d5/0xda0 fs/ext4/file.c:675
 call_write_iter include/linux/fs.h:2074 [inline]
 do_iter_readv_writev+0x2de/0x380 fs/read_write.c:725
 do_iter_write+0x192/0x5c0 fs/read_write.c:851
 vfs_iter_write+0x4c/0x70 fs/read_write.c:892
 iter_file_splice_write+0x43a/0x790 fs/splice.c:689
 do_splice_from fs/splice.c:767 [inline]
 direct_splice_actor+0x80/0xa0 fs/splice.c:936
 splice_direct_to_actor+0x345/0x650 fs/splice.c:891
 do_splice_direct+0x106/0x190 fs/splice.c:979
 do_sendfile+0x675/0xc40 fs/read_write.c:1245
 __do_sys_sendfile64 fs/read_write.c:1310 [inline]
 __se_sys_sendfile64 fs/read_write.c:1296 [inline]
 __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1296
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000000000000040 -> 0x0000000000000030

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 31506 Comm: syz-executor.2 Not tainted 5.17.0-rc1-syzkaller-00431-g8dd71685dcb7-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/01/30 18:32 upstream 8dd71685dcb7 495e00c5 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/01/25 00:07 upstream dd81e1c7d5fb 2cbffd88 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2021/12/22 20:03 upstream 2f47a9a4dfa3 6caa12e4 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2021/12/14 01:46 upstream 5472f14a3742 5d14b1ea .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2021/11/16 11:15 upstream 8ab774587903 600426bd .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2021/11/04 01:21 upstream dcd68326d29b 4c1be0be .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
* Struck through repros no longer work on HEAD.