[moderation] [fs?] [mm?] KCSAN: data-race in ondemand_readahead / page_cache_ra_order (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 305230142ae0 Merge tag 'pm-6.7-rc1-2' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12da4527680000
kernel config: https://syzkaller.appspot.com/x/.config?x=f89e9ee49649fd75
dashboard link: https://syzkaller.appspot.com/bug?extid=933efea6300c7767f83a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org linux-...@vger.kernel.org linu...@kvack.org wi...@infradead.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/87da8f49101d/disk-30523014.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6df363b647ac/vmlinux-30523014.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4801dddb18bf/bzImage-30523014.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+933efe...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in ondemand_readahead / page_cache_ra_order

write to 0xffff888146050684 of 4 bytes by task 29589 on cpu 0:
ondemand_readahead+0x364/0x690
page_cache_async_ra+0x94/0xa0 mm/readahead.c:717
do_async_mmap_readahead mm/filemap.c:3169 [inline]
filemap_fault+0x3da/0xc30 mm/filemap.c:3223
__do_fault mm/memory.c:4265 [inline]
do_read_fault mm/memory.c:4628 [inline]
do_fault mm/memory.c:4762 [inline]
do_pte_missing mm/memory.c:3730 [inline]
handle_pte_fault mm/memory.c:5038 [inline]
__handle_mm_fault mm/memory.c:5179 [inline]
handle_mm_fault+0x13bd/0x2dd0 mm/memory.c:5344
faultin_page mm/gup.c:956 [inline]
__get_user_pages+0x402/0xe40 mm/gup.c:1239
populate_vma_page_range mm/gup.c:1677 [inline]
__mm_populate+0x216/0x330 mm/gup.c:1786
mm_populate include/linux/mm.h:3379 [inline]
vm_mmap_pgoff+0x1a7/0x240 mm/util.c:551
ksys_mmap_pgoff+0x2b8/0x330 mm/mmap.c:1425
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffff888146050684 of 4 bytes by task 29604 on cpu 1:
page_cache_ra_order+0x5a/0xf0 mm/readahead.c:546
do_sync_mmap_readahead+0x410/0x450 mm/filemap.c:3141
filemap_fault+0x426/0xc30 mm/filemap.c:3233
__do_fault mm/memory.c:4265 [inline]
do_read_fault mm/memory.c:4628 [inline]
do_fault mm/memory.c:4762 [inline]
do_pte_missing mm/memory.c:3730 [inline]
handle_pte_fault mm/memory.c:5038 [inline]
__handle_mm_fault mm/memory.c:5179 [inline]
handle_mm_fault+0x13bd/0x2dd0 mm/memory.c:5344
do_user_addr_fault arch/x86/mm/fault.c:1413 [inline]
handle_page_fault arch/x86/mm/fault.c:1505 [inline]
exc_page_fault+0x2f7/0x6c0 arch/x86/mm/fault.c:1561
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570
rep_movs_alternative+0x30/0x70 arch/x86/lib/copy_user_64.S:50
copy_user_generic arch/x86/include/asm/uaccess_64.h:112 [inline]
raw_copy_from_user arch/x86/include/asm/uaccess_64.h:127 [inline]
_copy_from_user+0x80/0xd0 lib/usercopy.c:23
copy_from_user include/linux/uaccess.h:183 [inline]
vlan_ioctl_handler+0x4d/0x4f0 net/8021q/vlan.c:546
sock_ioctl+0x4be/0x630 net/socket.c:1303
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xcf/0x140 fs/ioctl.c:857
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x00000008 -> 0x00000020

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 29604 Comm: syz-executor.5 Not tainted 6.6.0-syzkaller-15365-g305230142ae0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.