KCSAN: data-race in find_get_pages_range_tag / xas_clear_mark (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 245a4300 Merge branch 'rcu/kcsan' into tip/locking/kcsan
git tree: https://github.com/google/ktsan.git kcsan
console output: https://syzkaller.appspot.com/x/log.txt?x=1090fac1e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a38292766f8efdaa
dashboard link: https://syzkaller.appspot.com/bug?extid=60d28ccd3e646afdc6bf
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org
linu...@kvack.org el...@google.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+60d28c...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in find_get_pages_range_tag / xas_clear_mark

write to 0xffff888128d46fb0 of 8 bytes by interrupt on cpu 1:
__test_and_clear_bit
include/asm-generic/bitops/instrumented-non-atomic.h:91 [inline]
node_clear_mark lib/xarray.c:99 [inline]
xas_clear_mark+0xe6/0x180 lib/xarray.c:907
__xa_clear_mark+0xd3/0x100 lib/xarray.c:1717
test_clear_page_writeback+0x44c/0x790 mm/page-writeback.c:2731
end_page_writeback+0x9e/0x190 mm/filemap.c:1339
ext4_finish_bio+0x40d/0x520 fs/ext4/page-io.c:148
ext4_end_bio+0xd2/0x2f0 fs/ext4/page-io.c:370
bio_endio+0x2fa/0x400 block/bio.c:1821
req_bio_endio block/blk-core.c:245 [inline]
blk_update_request+0x427/0x7b0 block/blk-core.c:1464
scsi_end_request+0x6b/0x360 drivers/scsi/scsi_lib.c:576
scsi_io_completion+0x11d/0xc80 drivers/scsi/scsi_lib.c:960
scsi_finish_command+0x283/0x380 drivers/scsi/scsi.c:228
scsi_softirq_done+0x259/0x280 drivers/scsi/scsi_lib.c:1476
blk_done_softirq+0x1eb/0x250 block/blk-softirq.c:37
__do_softirq+0x115/0x33f kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0xbb/0xe0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
do_IRQ+0x81/0x130 arch/x86/kernel/irq.c:263
ret_from_intr+0x0/0x21
arch_local_irq_restore arch/x86/include/asm/paravirt.h:752 [inline]
kcsan_setup_watchpoint+0x1d4/0x460 kernel/kcsan/core.c:429
check_access kernel/kcsan/core.c:459 [inline]
__tsan_read8+0xc6/0x100 kernel/kcsan/core.c:589
compound_head include/linux/page-flags.h:174 [inline]
PageAnon include/linux/page-flags.h:463 [inline]
page_remove_rmap+0x56/0x7a0 mm/rmap.c:1329
zap_pte_range mm/memory.c:1080 [inline]
zap_pmd_range mm/memory.c:1184 [inline]
zap_pud_range mm/memory.c:1213 [inline]
zap_p4d_range mm/memory.c:1234 [inline]
unmap_page_range+0xb31/0x1940 mm/memory.c:1255
unmap_single_vma+0x144/0x200 mm/memory.c:1300
unmap_vmas+0xda/0x1a0 mm/memory.c:1332
exit_mmap+0x13e/0x300 mm/mmap.c:3140
__mmput kernel/fork.c:1082 [inline]
mmput+0xea/0x280 kernel/fork.c:1103
exit_mm kernel/exit.c:485 [inline]
do_exit+0x4ac/0x18c0 kernel/exit.c:784
do_group_exit+0xb4/0x1c0 kernel/exit.c:895
__do_sys_exit_group kernel/exit.c:906 [inline]
__se_sys_exit_group kernel/exit.c:904 [inline]
__x64_sys_exit_group+0x2e/0x30 kernel/exit.c:904
do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888128d46fb0 of 8 bytes by task 8284 on cpu 0:
xas_find_chunk include/linux/xarray.h:1590 [inline]
xas_next_marked include/linux/xarray.h:1620 [inline]
find_get_pages_range_tag+0x1c2/0x670 mm/filemap.c:1925
pagevec_lookup_range_tag+0x45/0x70 mm/swap.c:1073
__filemap_fdatawait_range+0xdc/0x1d0 mm/filemap.c:518
filemap_fdatawait_range mm/filemap.c:553 [inline]
filemap_write_and_wait_range mm/filemap.c:685 [inline]
filemap_write_and_wait_range+0xd9/0x150 mm/filemap.c:675
iomap_dio_rw+0x3a2/0x9a0 fs/iomap/direct-io.c:471
ext4_dio_read_iter fs/ext4/file.c:77 [inline]
ext4_file_read_iter fs/ext4/file.c:128 [inline]
ext4_file_read_iter+0x2e4/0x380 fs/ext4/file.c:113
call_read_iter include/linux/fs.h:1896 [inline]
generic_file_splice_read+0x35c/0x500 fs/splice.c:313
do_splice_to+0xf2/0x130 fs/splice.c:892
splice_direct_to_actor+0x1b6/0x540 fs/splice.c:971
do_splice_direct+0x161/0x1e0 fs/splice.c:1080
do_sendfile+0x384/0x7f0 fs/read_write.c:1464
__do_sys_sendfile64 fs/read_write.c:1519 [inline]
__se_sys_sendfile64 fs/read_write.c:1511 [inline]
__x64_sys_sendfile64+0xbe/0x140 fs/read_write.c:1511
do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8284 Comm: syz-executor.5 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.