syzbot


KCSAN: data-race in drain_all_stock / drain_stock (4)

Status: auto-closed as invalid on 2022/08/02 11:05
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 184d, last: 153d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in drain_all_stock / drain_stock (5) 1 106d 106d 0/24 auto-closed as invalid on 2022/09/19 00:38
upstream KCSAN: data-race in drain_all_stock / drain_stock (3) 1 245d 245d 0/24 auto-closed as invalid on 2022/05/03 08:41
upstream KCSAN: data-race in drain_all_stock / drain_stock (2) 3 401d 405d 0/24 auto-closed as invalid on 2021/11/28 07:11
upstream KCSAN: data-race in drain_all_stock / drain_stock 1 867d 867d 0/24 auto-closed as invalid on 2020/08/18 19:14

Sample crash report:
==================================================================
BUG: KCSAN: data-race in drain_all_stock / drain_stock

write to 0xffff888237c28370 of 4 bytes by task 11896 on cpu 0:
 drain_stock+0x48/0x110 mm/memcontrol.c:2203
 __refill_stock mm/memcontrol.c:2243 [inline]
 refill_stock+0x85/0x130 mm/memcontrol.c:2258
 obj_cgroup_uncharge_pages+0x75/0x130 mm/memcontrol.c:2978
 refill_obj_stock+0x16d/0x1e0 mm/memcontrol.c:3249
 obj_cgroup_uncharge+0xa/0x10 mm/memcontrol.c:3298
 memcg_slab_free_hook+0xe0/0x180 mm/slab.h:587
 ___cache_free+0x46/0x340 mm/slab.c:3444
 __cache_free mm/slab.c:3433 [inline]
 kfree+0xda/0x1e0 mm/slab.c:3796
 __devinet_sysctl_unregister net/ipv4/devinet.c:2610 [inline]
 devinet_sysctl_unregister net/ipv4/devinet.c:2637 [inline]
 inetdev_destroy net/ipv4/devinet.c:327 [inline]
 inetdev_event+0x5dd/0xa80 net/ipv4/devinet.c:1602
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:1945 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
 call_netdevice_notifiers net/core/dev.c:1997 [inline]
 unregister_netdevice_many+0x887/0xfd0 net/core/dev.c:10839
 default_device_exit_batch+0x479/0x4d0 net/core/dev.c:11333
 ops_exit_list net/core/net_namespace.c:167 [inline]
 cleanup_net+0x4dc/0x8d0 net/core/net_namespace.c:594
 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
 worker_thread+0x618/0xa70 kernel/workqueue.c:2436
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

read to 0xffff888237c28370 of 4 bytes by task 21568 on cpu 1:
 drain_all_stock+0xb5/0x2e0 mm/memcontrol.c:2288
 try_charge_memcg+0x68a/0x960 mm/memcontrol.c:2630
 obj_cgroup_charge_pages mm/memcontrol.c:2999 [inline]
 __memcg_kmem_charge_page+0x2e4/0x480 mm/memcontrol.c:3025
 __alloc_pages+0x1c1/0x340 mm/page_alloc.c:5443
 alloc_pages+0x34d/0x450
 vm_area_alloc_pages mm/vmalloc.c:2927 [inline]
 __vmalloc_area_node mm/vmalloc.c:2995 [inline]
 __vmalloc_node_range+0x730/0xef0 mm/vmalloc.c:3165
 kvmalloc_node+0xf3/0x140 mm/util.c:634
 kvmalloc include/linux/slab.h:750 [inline]
 xt_alloc_table_info+0x39/0x70 net/netfilter/x_tables.c:1192
 do_replace net/ipv6/netfilter/ip6_tables.c:1142 [inline]
 do_ip6t_set_ctl+0x645/0x1790 net/ipv6/netfilter/ip6_tables.c:1639
 nf_setsockopt+0x1a6/0x1c0 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x2721/0x2a90 net/ipv6/ipv6_sockglue.c:1026
 dccp_setsockopt+0xe2/0xba0 net/dccp/proto.c:567
 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3581
 __sys_setsockopt+0x212/0x2b0 net/socket.c:2259
 __do_sys_setsockopt net/socket.c:2270 [inline]
 __se_sys_setsockopt net/socket.c:2267 [inline]
 __x64_sys_setsockopt+0x62/0x70 net/socket.c:2267
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

value changed: 0x0000001a -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 21568 Comm: syz-executor.4 Not tainted 5.19.0-rc4-syzkaller-00014-g941e3e791269-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/06/28 11:00 upstream 941e3e791269 ef82eb2c .config log report info KCSAN: data-race in drain_all_stock / drain_stock
ci2-upstream-kcsan-gce 2022/05/28 22:23 upstream 9d004b2f4fea a46af346 .config log report info KCSAN: data-race in drain_all_stock / drain_stock
* Struck through repros no longer work on HEAD.