KCSAN: data-race in __delete_from_page_cache / shmem_recalc_inode

14 views
Skip to first unread message

syzbot

unread,
Dec 23, 2019, 9:45:11 AM12/23/19
to syzkaller-upst...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 245a4300 Merge branch 'rcu/kcsan' into tip/locking/kcsan
git tree: https://github.com/google/ktsan.git kcsan
console output: https://syzkaller.appspot.com/x/log.txt?x=10687ce1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a38292766f8efdaa
dashboard link: https://syzkaller.appspot.com/bug?extid=ce6e261fd5567b8b5270
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org
linu...@kvack.org el...@google.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ce6e26...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __delete_from_page_cache / shmem_recalc_inode

write to 0xffff8881024d2e60 of 8 bytes by task 5097 on cpu 0:
page_cache_delete mm/filemap.c:153 [inline]
__delete_from_page_cache+0x1d8/0x4a0 mm/filemap.c:238
__remove_mapping+0x2db/0x530 mm/vmscan.c:939
shrink_page_list+0xf57/0x2710 mm/vmscan.c:1439
reclaim_pages+0x52f/0x6f0 mm/vmscan.c:2153
madvise_cold_or_pageout_pte_range+0xd49/0x1860 mm/madvise.c:377
walk_pmd_range mm/pagewalk.c:54 [inline]
walk_pud_range mm/pagewalk.c:113 [inline]
walk_p4d_range mm/pagewalk.c:140 [inline]
walk_pgd_range mm/pagewalk.c:167 [inline]
__walk_page_range+0xa94/0x1070 mm/pagewalk.c:269
walk_page_range+0x133/0x260 mm/pagewalk.c:365
madvise_pageout_page_range mm/madvise.c:514 [inline]
madvise_pageout+0x179/0x220 mm/madvise.c:550
madvise_vma mm/madvise.c:939 [inline]
__do_sys_madvise+0x548/0x1150 mm/madvise.c:1121
__se_sys_madvise mm/madvise.c:1047 [inline]
__x64_sys_madvise+0x4c/0x60 mm/madvise.c:1047
do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8881024d2e60 of 8 bytes by task 5102 on cpu 1:
shmem_recalc_inode+0x54/0x190 mm/shmem.c:306
shmem_getpage_gfp+0x552/0x1390 mm/shmem.c:1890
shmem_fault+0x114/0x470 mm/shmem.c:2067
__do_fault+0xae/0x1f0 mm/memory.c:3188
do_read_fault mm/memory.c:3585 [inline]
do_fault mm/memory.c:3714 [inline]
handle_pte_fault mm/memory.c:3945 [inline]
__handle_mm_fault+0x270d/0x2e00 mm/memory.c:4075
handle_mm_fault+0x21b/0x530 mm/memory.c:4112
faultin_page mm/gup.c:640 [inline]
__get_user_pages+0x485/0x1130 mm/gup.c:851
populate_vma_page_range+0xe6/0x100 mm/gup.c:1235
__mm_populate+0x168/0x2a0 mm/gup.c:1283
mm_populate include/linux/mm.h:2347 [inline]
vm_mmap_pgoff+0x181/0x190 mm/util.c:511
ksys_mmap_pgoff+0x99/0x420 mm/mmap.c:1607
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:100 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:91 [inline]
__x64_sys_mmap+0x2e/0x40 arch/x86/kernel/sys_x86_64.c:91
do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 5102 Comm: syz-executor.1 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jul 22, 2020, 7:39:12 PM7/22/20
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages