From: syzbot <syzbot+606f94dfeaaa45124c90@syzkaller.appspotmail.com>
To: djwong@kernel.org, hch@infradead.org,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-mm@kvack.org, linux-xfs@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: [syzbot] [fs?] [mm?] KCSAN: data-race in __filemap_remove_folio / folio_mapping (2)
Date: Mon, 24 Apr 2023 00:19:45 -0700 [thread overview]
Message-ID: <000000000000d0737c05fa0fd499@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 622322f53c6d Merge tag 'mips-fixes_6.3_2' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12342880280000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa4baf7c6b35b5d5
dashboard link: https://syzkaller.appspot.com/bug?extid=606f94dfeaaa45124c90
compiler: Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8b5f31d96315/disk-622322f5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/adca7dc8daae/vmlinux-622322f5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ed78ddc31ccb/bzImage-622322f5.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+606f94dfeaaa45124c90@syzkaller.appspotmail.com
==================================================================
BUG: KCSAN: data-race in __filemap_remove_folio / folio_mapping
write to 0xffffea0004958618 of 8 bytes by task 17586 on cpu 1:
page_cache_delete mm/filemap.c:145 [inline]
__filemap_remove_folio+0x210/0x330 mm/filemap.c:225
invalidate_complete_folio2 mm/truncate.c:586 [inline]
invalidate_inode_pages2_range+0x506/0x790 mm/truncate.c:673
iomap_dio_complete+0x383/0x470 fs/iomap/direct-io.c:115
iomap_dio_rw+0x62/0x90 fs/iomap/direct-io.c:687
ext4_dio_write_iter fs/ext4/file.c:597 [inline]
ext4_file_write_iter+0x9e6/0x10e0 fs/ext4/file.c:708
do_iter_write+0x418/0x700 fs/read_write.c:861
vfs_iter_write+0x50/0x70 fs/read_write.c:902
iter_file_splice_write+0x456/0x7d0 fs/splice.c:778
do_splice_from fs/splice.c:856 [inline]
direct_splice_actor+0x84/0xa0 fs/splice.c:1022
splice_direct_to_actor+0x2ee/0x5f0 fs/splice.c:977
do_splice_direct+0x104/0x180 fs/splice.c:1065
do_sendfile+0x3b8/0x950 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1309
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffffea0004958618 of 8 bytes by task 17568 on cpu 0:
folio_mapping+0x92/0x110 mm/util.c:774
folio_evictable mm/internal.h:156 [inline]
lru_add_fn+0x92/0x450 mm/swap.c:181
folio_batch_move_lru+0x21e/0x2f0 mm/swap.c:217
folio_batch_add_and_move mm/swap.c:234 [inline]
folio_add_lru+0xc9/0x130 mm/swap.c:517
filemap_add_folio+0xfc/0x150 mm/filemap.c:954
page_cache_ra_unbounded+0x15e/0x2e0 mm/readahead.c:251
do_page_cache_ra mm/readahead.c:300 [inline]
page_cache_ra_order mm/readahead.c:560 [inline]
ondemand_readahead+0x550/0x6c0 mm/readahead.c:682
page_cache_sync_ra+0x284/0x2a0 mm/readahead.c:709
page_cache_sync_readahead include/linux/pagemap.h:1214 [inline]
filemap_get_pages+0x257/0xea0 mm/filemap.c:2598
filemap_read+0x223/0x680 mm/filemap.c:2693
generic_file_read_iter+0x76/0x320 mm/filemap.c:2840
ext4_file_read_iter+0x1cc/0x290
call_read_iter include/linux/fs.h:1845 [inline]
generic_file_splice_read+0xe3/0x290 fs/splice.c:402
do_splice_to fs/splice.c:885 [inline]
splice_direct_to_actor+0x25a/0x5f0 fs/splice.c:956
do_splice_direct+0x104/0x180 fs/splice.c:1065
do_sendfile+0x3b8/0x950 fs/read_write.c:1255
__do_sys_sendfile64 fs/read_write.c:1323 [inline]
__se_sys_sendfile64 fs/read_write.c:1309 [inline]
__x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1309
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0xffff88810a98f7b0 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 17568 Comm: syz-executor.2 Not tainted 6.3.0-rc7-syzkaller-00191-g622322f53c6d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
next reply other threads:[~2023-04-24 7:19 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-04-24 7:19 syzbot [this message]
2023-04-24 7:38 ` [syzbot] [fs?] [mm?] KCSAN: data-race in __filemap_remove_folio / folio_mapping (2) Dmitry Vyukov
2023-04-24 13:21 ` Matthew Wilcox
2023-04-24 13:49 ` Dmitry Vyukov
2023-04-24 14:10 ` Matthew Wilcox
2023-04-24 14:21 ` Dmitry Vyukov
2024-04-18 4:27 ` Jeongjun Park
2024-04-18 4:27 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000d0737c05fa0fd499@google.com \
--to=syzbot+606f94dfeaaa45124c90@syzkaller.appspotmail.com \
--cc=djwong@kernel.org \
--cc=hch@infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-xfs@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).