syzbot


KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (7)

Status: auto-closed as invalid on 2022/03/28 08:47
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 288d, last: 288d
similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (4) 4 669d 727d 0/24 auto-closed as invalid on 2021/03/12 12:46
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (2) 1 858d 858d 0/24 auto-closed as invalid on 2020/09/03 19:58
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (3) 1 803d 803d 0/24 auto-closed as invalid on 2020/10/29 03:12
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (6) 4 487d 506d 0/24 auto-closed as invalid on 2021/09/09 17:02
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma 1 935d 935d 0/24 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma (5) 3 561d 622d 0/24 auto-closed as invalid on 2021/06/28 10:29

Sample crash report:
==================================================================
BUG: KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma

write to 0xffffea00052dd258 of 8 bytes by task 10723 on cpu 1:
 page_cache_delete_batch mm/filemap.c:304 [inline]
 delete_from_page_cache_batch+0x301/0x760 mm/filemap.c:330
 truncate_inode_pages_range+0x305/0x8b0 mm/truncate.c:379
 truncate_inode_pages+0x20/0x30 mm/truncate.c:461
 swap_inode_boot_loader fs/ext4/ioctl.c:406 [inline]
 __ext4_ioctl fs/ext4/ioctl.c:1351 [inline]
 ext4_ioctl+0x1a0e/0x1f40 fs/ext4/ioctl.c:1578
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:860
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffffea00052dd258 of 8 bytes by task 10711 on cpu 0:
 folio_test_anon include/linux/page-flags.h:582 [inline]
 PageAnon include/linux/page-flags.h:587 [inline]
 page_address_in_vma+0x4a/0x300 mm/rmap.c:740
 new_page+0x4b/0x170 mm/mempolicy.c:1208
 unmap_and_move mm/migrate.c:1101 [inline]
 migrate_pages+0x465/0x1810 mm/migrate.c:1388
 do_mbind+0x5b7/0x760 mm/mempolicy.c:1334
 kernel_mbind mm/mempolicy.c:1481 [inline]
 __do_sys_mbind mm/mempolicy.c:1559 [inline]
 __se_sys_mbind+0x151/0x410 mm/mempolicy.c:1555
 __x64_sys_mbind+0x74/0x80 mm/mempolicy.c:1555
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff888135729380 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10711 Comm: syz-executor.1 Not tainted 5.17.0-rc4-syzkaller-00241-g7f25f0412c9e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/02/21 08:40 upstream 7f25f0412c9e 3cd800e4 .config log report info KCSAN: data-race in delete_from_page_cache_batch / page_address_in_vma
* Struck through repros no longer work on HEAD.