syzbot


KCSAN: data-race in ext4_mpage_readpages / file_remove_privs (2)

Status: auto-closed as invalid on 2020/10/11 10:30
Subsystems: ext4
[Documentation on labels]
First crash: 1324d, last: 1324d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ext4_mpage_readpages / file_remove_privs ext4 1 1382d 1382d 0/26 auto-closed as invalid on 2020/08/15 08:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ext4_mpage_readpages / file_remove_privs

write to 0xffff88811d9fb57c of 4 bytes by task 10869 on cpu 1:
 inode_has_no_xattr include/linux/fs.h:3456 [inline]
 file_remove_privs+0x2e0/0x370 fs/inode.c:1943
 file_modified+0x16/0x80 fs/inode.c:2006
 ext4_write_checks fs/ext4/file.c:248 [inline]
 ext4_buffered_write_iter+0x1d0/0x3b0 fs/ext4/file.c:264
 ext4_file_write_iter+0x768/0x1060 include/linux/fs.h:784
 call_write_iter include/linux/fs.h:1882 [inline]
 do_iter_readv_writev+0x32e/0x3d0 fs/read_write.c:713
 do_iter_write+0x112/0x4b0 fs/read_write.c:1018
 vfs_iter_write+0x4c/0x70 fs/read_write.c:1059
 iter_file_splice_write+0x41a/0x770 fs/splice.c:750
 do_splice_from fs/splice.c:846 [inline]
 direct_splice_actor+0x95/0x160 fs/splice.c:1016
 splice_direct_to_actor+0x365/0x660 fs/splice.c:971
 do_splice_direct+0xf2/0x170 fs/splice.c:1059
 do_sendfile+0x56a/0xba0 fs/read_write.c:1540
 __do_sys_sendfile64 fs/read_write.c:1601 [inline]
 __se_sys_sendfile64 fs/read_write.c:1587 [inline]
 __x64_sys_sendfile64+0xf2/0x130 fs/read_write.c:1587
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88811d9fb57c of 4 bytes by task 10861 on cpu 0:
 ext4_readpage_limit fs/ext4/readpage.c:218 [inline]
 ext4_mpage_readpages+0x3d4/0x13a0 fs/ext4/readpage.c:265
 ext4_readahead+0x93/0xa0 fs/ext4/inode.c:3241
 read_pages+0x9c/0x700 mm/readahead.c:130
 page_cache_readahead_unbounded+0x41a/0x470 mm/readahead.c:244
 ondemand_readahead+0x4e4/0x6e0 mm/readahead.c:273
 page_cache_async_readahead+0x1c6/0x1e0 mm/readahead.c:631
 do_async_mmap_readahead mm/filemap.c:2532 [inline]
 filemap_fault+0x2ef/0x1270 mm/filemap.c:2587
 ext4_filemap_fault+0x4b/0x60 fs/ext4/inode.c:6060
 __do_fault mm/memory.c:3450 [inline]
 do_read_fault+0x41f/0x760 mm/memory.c:3843
 do_fault mm/memory.c:3971 [inline]
 handle_pte_fault mm/memory.c:4211 [inline]
 __handle_mm_fault mm/memory.c:4346 [inline]
 handle_mm_fault+0x14e9/0x1af0 mm/memory.c:4444
 do_user_addr_fault+0x380/0x770 arch/x86/mm/fault.c:1294
 handle_page_fault arch/x86/mm/fault.c:1351 [inline]
 exc_page_fault+0xb8/0x330 arch/x86/mm/fault.c:1404
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:538
 copy_user_enhanced_fast_string+0xe/0x30 arch/x86/lib/copy_user_64.S:204
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:68 [inline]
 copyin lib/iov_iter.c:153 [inline]
 copy_page_from_iter_iovec lib/iov_iter.c:297 [inline]
 copy_page_from_iter+0x32d/0x5a0 lib/iov_iter.c:943
 pipe_write+0x47e/0xbc0 fs/pipe.c:539
 call_write_iter include/linux/fs.h:1882 [inline]
 new_sync_write fs/read_write.c:503 [inline]
 vfs_write+0x665/0x6f0 fs/read_write.c:578
 ksys_write+0xce/0x180 fs/read_write.c:631
 __do_sys_write fs/read_write.c:643 [inline]
 __se_sys_write fs/read_write.c:640 [inline]
 __x64_sys_write+0x3e/0x50 fs/read_write.c:640
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10861 Comm: syz-executor.1 Not tainted 5.9.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/09/06 10:22 upstream dd9fb9bb3340 abf9ba4f .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.