syzbot


KCSAN: data-race in __es_find_extent_range / __es_find_extent_range (2)

Status: auto-closed as invalid on 2021/10/01 16:26
Subsystems: ext4
[Documentation on labels]
First crash: 1034d, last: 965d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __es_find_extent_range / __es_find_extent_range ext4 2 1092d 1097d 0/26 auto-closed as invalid on 2021/05/27 20:25
upstream KCSAN: data-race in __es_find_extent_range / __es_find_extent_range (4) ext4 1 530d 530d 0/26 auto-obsoleted due to no activity on 2022/12/10 23:58
upstream KCSAN: data-race in __es_find_extent_range / __es_find_extent_range (5) ext4 1 493d 493d 0/26 auto-obsoleted due to no activity on 2023/01/17 15:46
upstream KCSAN: data-race in __es_find_extent_range / __es_find_extent_range (3) ext4 1 885d 885d 0/26 auto-closed as invalid on 2021/12/20 16:23
upstream KCSAN: data-race in __es_find_extent_range / __es_find_extent_range (6) ext4 4 370d 360d 22/26 fixed on 2023/07/01 16:05

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __es_find_extent_range / __es_find_extent_range

write to 0xffff888106abb5f8 of 8 bytes by task 16885 on cpu 0:
 __es_find_extent_range+0x28e/0x330 fs/ext4/extents_status.c:298
 ext4_es_find_extent_range+0x84/0x190 fs/ext4/extents_status.c:320
 ext4_ext_put_gap_in_cache fs/ext4/extents.c:2241 [inline]
 ext4_ext_map_blocks+0xf19/0x1f00 fs/ext4/extents.c:4150
 ext4_map_blocks+0x1be/0xef0 fs/ext4/inode.c:563
 ext4_mpage_readpages+0x6d9/0x1130 fs/ext4/readpage.c:304
 ext4_readahead+0x99/0xa0 fs/ext4/inode.c:3260
 read_pages+0x9f/0x530 mm/readahead.c:130
 page_cache_ra_unbounded+0x3c8/0x410 mm/readahead.c:238
 ondemand_readahead+0x579/0x7b0 mm/readahead.c:267
 page_cache_async_ra+0x165/0x190 mm/readahead.c:607
 page_cache_async_readahead include/linux/pagemap.h:907 [inline]
 do_async_mmap_readahead+0x214/0x250 mm/filemap.c:2930
 filemap_fault+0x10a/0x7b0 mm/filemap.c:2984
 ext4_filemap_fault+0x4b/0x60 fs/ext4/inode.c:6194
 __do_fault mm/memory.c:3857 [inline]
 do_read_fault mm/memory.c:4172 [inline]
 do_fault mm/memory.c:4300 [inline]
 handle_pte_fault mm/memory.c:4558 [inline]
 __handle_mm_fault mm/memory.c:4693 [inline]
 handle_mm_fault+0xe6d/0x1a50 mm/memory.c:4791
 faultin_page mm/gup.c:951 [inline]
 __get_user_pages+0x32b/0xbc0 mm/gup.c:1173
 populate_vma_page_range mm/gup.c:1506 [inline]
 __mm_populate+0x24d/0x380 mm/gup.c:1615
 mm_populate include/linux/mm.h:2623 [inline]
 vm_mmap_pgoff+0x142/0x1d0 mm/util.c:524
 ksys_mmap_pgoff+0x2a8/0x380 mm/mmap.c:1635
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888106abb5f8 of 8 bytes by task 16913 on cpu 1:
 __es_find_extent_range+0x79/0x330 fs/ext4/extents_status.c:272
 ext4_es_find_extent_range+0x84/0x190 fs/ext4/extents_status.c:320
 ext4_ext_put_gap_in_cache fs/ext4/extents.c:2241 [inline]
 ext4_ext_map_blocks+0xf19/0x1f00 fs/ext4/extents.c:4150
 ext4_da_map_blocks fs/ext4/inode.c:1757 [inline]
 ext4_da_get_block_prep+0x428/0x9b0 fs/ext4/inode.c:1834
 __block_write_begin_int+0x4a2/0x1060 fs/buffer.c:2006
 __block_write_begin+0x2b/0x40 fs/buffer.c:2056
 ext4_da_write_begin+0x4c8/0x820 fs/ext4/inode.c:3018
 generic_perform_write+0x196/0x3c0 mm/filemap.c:3656
 ext4_buffered_write_iter+0x2f2/0x3f0 fs/ext4/file.c:269
 ext4_file_write_iter+0x2e7/0x11d0 fs/ext4/file.c:519
 call_write_iter include/linux/fs.h:2114 [inline]
 do_iter_readv_writev+0x2cb/0x360 fs/read_write.c:740
 do_iter_write+0x112/0x4c0 fs/read_write.c:866
 vfs_iter_write+0x4c/0x70 fs/read_write.c:907
 iter_file_splice_write+0x40a/0x750 fs/splice.c:689
 do_splice_from fs/splice.c:767 [inline]
 direct_splice_actor+0x80/0xa0 fs/splice.c:936
 splice_direct_to_actor+0x345/0x650 fs/splice.c:891
 do_splice_direct+0xf5/0x170 fs/splice.c:979
 do_sendfile+0x773/0xda0 fs/read_write.c:1260
 __do_sys_sendfile64 fs/read_write.c:1325 [inline]
 __se_sys_sendfile64 fs/read_write.c:1311 [inline]
 __x64_sys_sendfile64+0xf2/0x130 fs/read_write.c:1311
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff8881069d91e0 -> 0xffff88813305c820

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16913 Comm: syz-executor.5 Not tainted 5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
syz-executor.5 (16913) used greatest stack depth: 10464 bytes left

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/27 16:25 upstream 77dd11439b86 b318694d .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __es_find_extent_range / __es_find_extent_range
2021/08/01 18:27 upstream f3438b4c4e69 6c236867 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __es_find_extent_range / __es_find_extent_range
2021/07/13 17:31 upstream 7fef2edf7cc7 70168d5c .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __es_find_extent_range / __es_find_extent_range
2021/06/19 10:00 upstream 9ed13a17e38e aba2b2fb .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __es_find_extent_range / __es_find_extent_range
* Struck through repros no longer work on HEAD.