syzbot

Page cache invalidation failure on direct I/O.  Possible data corruption due to collision with buffered I/O!
File: /root/syzkaller-testdir686514694/syzkaller.XiRYya/5019/bus PID: 30937 Comm: syz-executor.3
==================================================================
BUG: KCSAN: data-race in __add_to_page_cache_locked / iomap_dio_complete

write to 0xffff8881010abd60 of 8 bytes by task 30936 on cpu 0:
 __add_to_page_cache_locked+0x276/0x4f0 mm/filemap.c:931
 add_to_page_cache_lru+0xa0/0x1b0 mm/filemap.c:984
 page_cache_ra_unbounded+0x274/0x430 mm/readahead.c:222
 ondemand_readahead+0x58c/0x7c0
 page_cache_async_ra+0x17e/0x1a0 mm/readahead.c:609
 page_cache_async_readahead include/linux/pagemap.h:906 [inline]
 do_async_mmap_readahead+0x211/0x250 mm/filemap.c:3008
 filemap_fault+0x106/0x9f0 mm/filemap.c:3064
 __do_fault mm/memory.c:3858 [inline]
 do_read_fault mm/memory.c:4173 [inline]
 do_fault mm/memory.c:4301 [inline]
 handle_pte_fault mm/memory.c:4559 [inline]
 __handle_mm_fault mm/memory.c:4694 [inline]
 handle_mm_fault+0xbb7/0x1580 mm/memory.c:4792
 do_user_addr_fault+0x609/0xbe0 arch/x86/mm/fault.c:1397
 handle_page_fault arch/x86/mm/fault.c:1485 [inline]
 exc_page_fault+0x91/0x220 arch/x86/mm/fault.c:1541
 asm_exc_page_fault+0x1e/0x30
 copy_user_generic_unrolled+0x86/0xc0
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:52 [inline]
 _copy_from_user+0x7e/0xd0 lib/usercopy.c:16
 copy_from_user include/linux/uaccess.h:192 [inline]
 __copy_msghdr_from_user net/socket.c:2291 [inline]
 copy_msghdr_from_user net/socket.c:2342 [inline]
 recvmsg_copy_msghdr net/socket.c:2594 [inline]
 ___sys_recvmsg net/socket.c:2666 [inline]
 do_recvmmsg+0x2c3/0xae0 net/socket.c:2764
 __sys_recvmmsg net/socket.c:2843 [inline]
 __do_sys_recvmmsg net/socket.c:2866 [inline]
 __se_sys_recvmmsg net/socket.c:2859 [inline]
 __x64_sys_recvmmsg+0xde/0x160 net/socket.c:2859
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881010abd60 of 8 bytes by task 30937 on cpu 1:
 iomap_dio_complete+0x31d/0x3c0 fs/iomap/direct-io.c:110
 iomap_dio_rw+0x4e/0x70 fs/iomap/direct-io.c:652
 ext4_dio_write_iter fs/ext4/file.c:568 [inline]
 ext4_file_write_iter+0xaa9/0x11f0 fs/ext4/file.c:678
 call_write_iter include/linux/fs.h:2163 [inline]
 do_iter_readv_writev+0x2de/0x380 fs/read_write.c:729
 do_iter_write+0x192/0x5c0 fs/read_write.c:855
 vfs_iter_write+0x4c/0x70 fs/read_write.c:896
 iter_file_splice_write+0x43a/0x790 fs/splice.c:689
 do_splice_from fs/splice.c:767 [inline]
 direct_splice_actor+0x80/0xa0 fs/splice.c:936
 splice_direct_to_actor+0x345/0x650 fs/splice.c:891
 do_splice_direct+0x106/0x190 fs/splice.c:979
 do_sendfile+0x63e/0xbb0 fs/read_write.c:1249
 __do_sys_sendfile64 fs/read_write.c:1314 [inline]
 __se_sys_sendfile64 fs/read_write.c:1300 [inline]
 __x64_sys_sendfile64+0x102/0x140 fs/read_write.c:1300
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000000000003e3 -> 0x00000000000003f5

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 30937 Comm: syz-executor.3 Tainted: G        W         5.15.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================