syzbot


KCSAN: data-race in __delete_from_swap_cache / folio_mapping (2)

Status: auto-obsoleted due to no activity on 2024/03/19 16:43
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+cf119d1637f0bd53608c@syzkaller.appspotmail.com
First crash: 110d, last: 98d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [mm?] KCSAN: data-race in __delete_from_swap_cache / folio_mapping (2) 0 (1) 2024/02/01 11:10
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping mm 2 153d 161d 0/26 auto-obsoleted due to no activity on 2024/01/24 15:33
upstream KCSAN: data-race in __delete_from_swap_cache / folio_mapping (3) mm 1 50d 49d 0/26 auto-obsoleted due to no activity on 2024/05/06 15:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __delete_from_swap_cache / folio_mapping

write to 0xffffea0004a44428 of 8 bytes by task 13219 on cpu 0:
 __delete_from_swap_cache+0x1f2/0x290 mm/swap_state.c:160
 delete_from_swap_cache+0x72/0xd0 mm/swap_state.c:240
 folio_free_swap+0x19f/0x1c0 mm/swapfile.c:1590
 do_swap_page+0xaf3/0x1530 mm/memory.c:4052
 handle_pte_fault mm/memory.c:5147 [inline]
 __handle_mm_fault mm/memory.c:5285 [inline]
 handle_mm_fault+0x7f6/0x27c0 mm/memory.c:5450
 faultin_page mm/gup.c:958 [inline]
 __get_user_pages+0x402/0xe40 mm/gup.c:1241
 faultin_vma_page_range+0x7e/0xa0 mm/gup.c:1737
 madvise_populate mm/madvise.c:930 [inline]
 madvise_vma_behavior mm/madvise.c:1039 [inline]
 madvise_walk_vmas mm/madvise.c:1261 [inline]
 do_madvise+0x90b/0x25e0 mm/madvise.c:1441
 __do_sys_madvise mm/madvise.c:1454 [inline]
 __se_sys_madvise mm/madvise.c:1452 [inline]
 __x64_sys_madvise+0x60/0x70 mm/madvise.c:1452
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffffea0004a44428 of 8 bytes by task 13207 on cpu 1:
 folio_mapping+0xca/0x110 mm/util.c:780
 folio_evictable mm/internal.h:162 [inline]
 lru_add_fn+0x8d/0x430 mm/swap.c:181
 folio_batch_move_lru+0x21e/0x2f0 mm/swap.c:217
 folio_batch_add_and_move mm/swap.c:234 [inline]
 folio_add_lru+0xc4/0x120 mm/swap.c:517
 folio_putback_lru mm/vmscan.c:812 [inline]
 reclaim_folio_list+0x13f/0x1d0 mm/vmscan.c:2105
 reclaim_pages+0x220/0x280 mm/vmscan.c:2137
 madvise_cold_or_pageout_pte_range+0xa89/0xb20 mm/madvise.c:527
 walk_pmd_range mm/pagewalk.c:143 [inline]
 walk_pud_range mm/pagewalk.c:221 [inline]
 walk_p4d_range mm/pagewalk.c:256 [inline]
 walk_pgd_range+0x80a/0xec0 mm/pagewalk.c:293
 __walk_page_range+0xc2/0x320 mm/pagewalk.c:395
 walk_page_range+0x2c7/0x3f0 mm/pagewalk.c:521
 madvise_pageout_page_range mm/madvise.c:586 [inline]
 madvise_pageout mm/madvise.c:613 [inline]
 madvise_vma_behavior mm/madvise.c:1032 [inline]
 madvise_walk_vmas mm/madvise.c:1261 [inline]
 do_madvise+0x1a21/0x25e0 mm/madvise.c:1441
 __do_sys_madvise mm/madvise.c:1454 [inline]
 __se_sys_madvise mm/madvise.c:1452 [inline]
 __x64_sys_madvise+0x60/0x70 mm/madvise.c:1452
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x0000000000000da5 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13207 Comm: syz-executor.0 Not tainted 6.8.0-rc4-syzkaller-00005-gc664e16bb1ba #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/13 16:42 upstream c664e16bb1ba e66542d7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
2024/01/31 23:16 upstream 1bbb19b6eb1b 373b66cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __delete_from_swap_cache / folio_mapping
* Struck through repros no longer work on HEAD.