syzbot


KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages (3)

Status: auto-closed as invalid on 2022/05/12 02:32
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 278d, last: 242d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages (2) 2 346d 356d 0/24 auto-closed as invalid on 2022/01/27 23:42
upstream KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages 1 414d 414d 0/24 auto-closed as invalid on 2021/11/21 07:08

Sample crash report:
==================================================================
BUG: KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages

write to 0xffff888237d283b0 of 4 bytes by task 30597 on cpu 1:
 __refill_stock mm/memcontrol.c:2229 [inline]
 refill_stock mm/memcontrol.c:2240 [inline]
 obj_cgroup_uncharge_pages+0x1b2/0x2a0 mm/memcontrol.c:2930
 __memcg_kmem_uncharge_page+0x4f/0x100 mm/memcontrol.c:3003
 free_pages_prepare mm/page_alloc.c:1348 [inline]
 free_pcp_prepare+0x5c/0x260 mm/page_alloc.c:1428
 free_unref_page_prepare mm/page_alloc.c:3328 [inline]
 free_unref_page mm/page_alloc.c:3423 [inline]
 free_the_page mm/page_alloc.c:688 [inline]
 __free_pages+0x141/0x250 mm/page_alloc.c:5493
 __vunmap+0x61c/0x760 mm/vmalloc.c:2675
 __vfree mm/vmalloc.c:2723 [inline]
 __vmalloc_area_node+0xaee/0xb90 mm/vmalloc.c:3055
 __vmalloc_node_range+0x24b/0x2e0 mm/vmalloc.c:3172
 __bpf_map_area_alloc+0xfd/0x120 kernel/bpf/syscall.c:330
 bpf_map_area_alloc+0x18/0x20 kernel/bpf/syscall.c:337
 bloom_map_alloc+0x229/0x370 kernel/bpf/bloom_filter.c:144
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create kernel/bpf/syscall.c:864 [inline]
 __sys_bpf+0x484f/0xa1f0 kernel/bpf/syscall.c:4645
 __do_sys_bpf kernel/bpf/syscall.c:4767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4765 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4765
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888237d283b0 of 4 bytes by task 30608 on cpu 0:
 drain_all_stock+0xb5/0x2e0 mm/memcontrol.c:2270
 try_charge_memcg+0x682/0xa70 mm/memcontrol.c:2612
 obj_cgroup_charge_pages mm/memcontrol.c:2951 [inline]
 __memcg_kmem_charge_page+0x2e6/0x490 mm/memcontrol.c:2977
 __alloc_pages+0x1b7/0x330 mm/page_alloc.c:5425
 alloc_pages+0x316/0x420
 vm_area_alloc_pages mm/vmalloc.c:2942 [inline]
 __vmalloc_area_node+0x479/0xb90 mm/vmalloc.c:3001
 __vmalloc_node_range+0x24b/0x2e0 mm/vmalloc.c:3172
 __bpf_map_area_alloc+0xfd/0x120 kernel/bpf/syscall.c:330
 bpf_map_area_alloc+0x18/0x20 kernel/bpf/syscall.c:337
 bloom_map_alloc+0x229/0x370 kernel/bpf/bloom_filter.c:144
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create kernel/bpf/syscall.c:864 [inline]
 __sys_bpf+0x484f/0xa1f0 kernel/bpf/syscall.c:4645
 __do_sys_bpf kernel/bpf/syscall.c:4767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4765 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4765
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000006 -> 0x0000000b

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 30608 Comm: syz-executor.5 Not tainted 5.18.0-rc1-syzkaller-00016-g3e732ebf7316-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/04/07 02:30 upstream 3e732ebf7316 97582466 .config log report info KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages
ci2-upstream-kcsan-gce 2022/03/23 00:33 upstream b47d5a4f6b8d d88ef0c5 .config log report info KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages
ci2-upstream-kcsan-gce 2022/03/02 12:14 upstream fb184c4af9b9 45a13a73 .config log report info KCSAN: data-race in drain_all_stock / obj_cgroup_uncharge_pages
* Struck through repros no longer work on HEAD.