syzbot


KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64

Status: auto-closed as invalid on 2022/09/14 20:32
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 222d, last: 116d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64

read-write to 0xffffffff85c079c0 of 8 bytes by interrupt on cpu 0:
 tick_do_update_jiffies64+0x112/0x1b0 kernel/time/tick-sched.c:118
 tick_sched_do_timer kernel/time/tick-sched.c:199 [inline]
 tick_sched_timer+0x7e/0x2d0 kernel/time/tick-sched.c:1473
 __run_hrtimer+0x132/0x420 kernel/time/hrtimer.c:1685
 __hrtimer_run_queues kernel/time/hrtimer.c:1749 [inline]
 hrtimer_interrupt+0x36e/0xa70 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1095 [inline]
 __sysvec_apic_timer_interrupt+0xa3/0x250 arch/x86/kernel/apic/apic.c:1112
 sysvec_apic_timer_interrupt+0x88/0xb0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x16/0x20
 __rcu_read_unlock+0x0/0x70 kernel/rcu/tree_plugin.h:406
 rcu_read_unlock include/linux/rcupdate.h:738 [inline]
 mod_memcg_page_state include/linux/memcontrol.h:985 [inline]
 __vunmap+0x60b/0x750 mm/vmalloc.c:2691
 __vfree mm/vmalloc.c:2744 [inline]
 __vmalloc_area_node mm/vmalloc.c:3079 [inline]
 __vmalloc_node_range+0xdfd/0xef0 mm/vmalloc.c:3196
 __bpf_map_area_alloc kernel/bpf/syscall.c:332 [inline]
 bpf_map_area_alloc+0xbc/0xd0 kernel/bpf/syscall.c:339
 bloom_map_alloc+0x229/0x370 kernel/bpf/bloom_filter.c:145
 find_and_alloc_map kernel/bpf/syscall.c:131 [inline]
 map_create+0x38a/0x6f0 kernel/bpf/syscall.c:1102
 __sys_bpf+0x296/0x630 kernel/bpf/syscall.c:4936
 __do_sys_bpf kernel/bpf/syscall.c:5058 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5056 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:5056
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffffffff85c079c0 of 8 bytes by task 11177 on cpu 1:
 __mem_cgroup_flush_stats mm/memcontrol.c:648 [inline]
 mem_cgroup_flush_stats+0x7f/0x110 mm/memcontrol.c:657
 shrink_node+0x306/0x1180 mm/vmscan.c:3209
 shrink_zones+0x2c1/0x5d0 mm/vmscan.c:3542
 do_try_to_free_pages+0x195/0x740 mm/vmscan.c:3601
 try_to_free_mem_cgroup_pages+0x1d1/0x420 mm/vmscan.c:3916
 try_charge_memcg+0x2ed/0xa40 mm/memcontrol.c:2627
 obj_cgroup_charge_pages mm/memcontrol.c:3040 [inline]
 __memcg_kmem_charge_page+0x2e4/0x480 mm/memcontrol.c:3066
 __alloc_pages+0x1c1/0x340 mm/page_alloc.c:5532
 alloc_pages+0x3f4/0x4f0
 vm_area_alloc_pages mm/vmalloc.c:2958 [inline]
 __vmalloc_area_node mm/vmalloc.c:3026 [inline]
 __vmalloc_node_range+0x730/0xef0 mm/vmalloc.c:3196
 __bpf_map_area_alloc kernel/bpf/syscall.c:332 [inline]
 bpf_map_area_alloc+0xbc/0xd0 kernel/bpf/syscall.c:339
 bloom_map_alloc+0x229/0x370 kernel/bpf/bloom_filter.c:145
 find_and_alloc_map kernel/bpf/syscall.c:131 [inline]
 map_create+0x38a/0x6f0 kernel/bpf/syscall.c:1102
 __sys_bpf+0x296/0x630 kernel/bpf/syscall.c:4936
 __do_sys_bpf kernel/bpf/syscall.c:5058 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5056 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:5056
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x0000000100001955 -> 0x0000000100001956

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 11177 Comm: syz-executor.2 Not tainted 5.19.0-syzkaller-13322-gd4252071b97d-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
==================================================================
syz-executor.2 (11177) used greatest stack depth: 10960 bytes left

Crashes (12):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/08/10 20:25 upstream d4252071b97d aaa9eaa0 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/07/13 01:23 upstream 72a8e05d4f66 d91dd8ea .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/07/02 08:45 upstream b336ad598a3b 1434eec0 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/06/25 16:04 upstream 8c23f235a6a8 a371c43c .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/06/23 07:53 upstream de5c208d533a 912f5df7 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/06/13 10:25 upstream b13baccc3850 0d5abf15 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/05/29 22:04 upstream c3a9a3c5f559 a46af346 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/05/26 15:23 upstream d7227785e384 3037caa9 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/05/20 03:07 upstream b015dcd62b86 cb1ac2e7 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/05/18 21:54 upstream ef1302160bfb 50c53f39 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/05/11 01:58 upstream feb9c5e19e91 8d7b3b67 .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
ci2-upstream-kcsan-gce 2022/04/27 15:14 upstream 46cf2c613f4b 1fa34c1b .config log report info KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64
* Struck through repros no longer work on HEAD.