linux-kernel - BUG: KCSAN: data-race in folio_batch_move_lru / mpage_read_end

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <cbb9d596-43ac-bad4-b6f6-8c13f95d244e@alu.unizg.hr>
Date:   Mon, 28 Aug 2023 23:14:23 +0200
From:   Mirsad Todorovac <mirsad.todorovac@....unizg.hr>
To:     linux-kernel@...r.kernel.org
Cc:     Andrew Morton <akpm@...ux-foundation.org>, linux-mm@...ck.org,
        Keith Busch <kbusch@...nel.org>, Jens Axboe <axboe@...nel.dk>,
        Christoph Hellwig <hch@....de>,
        Sagi Grimberg <sagi@...mberg.me>,
        linux-nvme@...ts.infradead.org
Subject: BUG: KCSAN: data-race in folio_batch_move_lru / mpage_read_end_io

Hi,

In the vanilla torvalds tree 6.5 kernel on the Ubuntu 22.04 system, KCSAN found another data race:

[   34.082749] ==================================================================
[   34.089209] BUG: KCSAN: data-race in folio_batch_move_lru / mpage_read_end_io

[   34.102069] write (marked) to 0xffffef9a44978bc0 of 8 bytes by interrupt on cpu 28:
[   34.108569] mpage_read_end_io (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/bitops.h:55 /home/marvin/linux/kernel/linux_torvalds/./include/asm-generic/bitops/instrumented-atomic.h:29 /home/marvin/linux/kernel/linux_torvalds/./include/linux/page-flags.h:739 /home/marvin/linux/kernel/linux_torvalds/fs/mpage.c:55)
[   34.108581] bio_endio (/home/marvin/linux/kernel/linux_torvalds/block/bio.c:1617)
[   34.108590] blk_mq_end_request_batch (/home/marvin/linux/kernel/linux_torvalds/block/blk-mq.c:850 /home/marvin/linux/kernel/linux_torvalds/block/blk-mq.c:1088)
[   34.108601] nvme_pci_complete_batch (/home/marvin/linux/kernel/linux_torvalds/drivers/nvme/host/pci.c:986) nvme
[   34.108644] nvme_irq (/home/marvin/linux/kernel/linux_torvalds/drivers/nvme/host/pci.c:1086) nvme
[   34.108686] __handle_irq_event_percpu (/home/marvin/linux/kernel/linux_torvalds/kernel/irq/handle.c:158)
[   34.108698] handle_irq_event (/home/marvin/linux/kernel/linux_torvalds/kernel/irq/handle.c:195 /home/marvin/linux/kernel/linux_torvalds/kernel/irq/handle.c:210)
[   34.108710] handle_edge_irq (/home/marvin/linux/kernel/linux_torvalds/kernel/irq/chip.c:836)
[   34.108722] __common_interrupt (/home/marvin/linux/kernel/linux_torvalds/./include/linux/irqdesc.h:161 /home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/irq.c:238 /home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/irq.c:257)
[   34.108731] common_interrupt (/home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/irq.c:247 (discriminator 14))
[   34.108743] asm_common_interrupt (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/idtentry.h:636)
[   34.108754] cpuidle_enter_state (/home/marvin/linux/kernel/linux_torvalds/drivers/cpuidle/cpuidle.c:291)
[   34.108766] cpuidle_enter (/home/marvin/linux/kernel/linux_torvalds/drivers/cpuidle/cpuidle.c:390)
[   34.108776] call_cpuidle (/home/marvin/linux/kernel/linux_torvalds/kernel/sched/idle.c:135)
[   34.108787] do_idle (/home/marvin/linux/kernel/linux_torvalds/kernel/sched/idle.c:219 /home/marvin/linux/kernel/linux_torvalds/kernel/sched/idle.c:282)
[   34.108795] cpu_startup_entry (/home/marvin/linux/kernel/linux_torvalds/kernel/sched/idle.c:378 (discriminator 1))
[   34.108803] start_secondary (/home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/smpboot.c:210 /home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/smpboot.c:294)
[   34.108814] secondary_startup_64_no_verify (/home/marvin/linux/kernel/linux_torvalds/arch/x86/kernel/head_64.S:441)

[   34.115221] read to 0xffffef9a44978bc0 of 8 bytes by task 348 on cpu 12:
[   34.121702] folio_batch_move_lru (/home/marvin/linux/kernel/linux_torvalds/./include/linux/mm.h:1814 /home/marvin/linux/kernel/linux_torvalds/./include/linux/mm.h:1824 /home/marvin/linux/kernel/linux_torvalds/./include/linux/memcontrol.h:1636 /home/marvin/linux/kernel/linux_torvalds/./include/linux/memcontrol.h:1659 /home/marvin/linux/kernel/linux_torvalds/mm/swap.c:216)
[   34.121713] folio_batch_add_and_move (/home/marvin/linux/kernel/linux_torvalds/mm/swap.c:235)
[   34.121724] folio_add_lru (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/preempt.h:95 /home/marvin/linux/kernel/linux_torvalds/mm/swap.c:518)
[   34.121735] folio_add_lru_vma (/home/marvin/linux/kernel/linux_torvalds/mm/swap.c:538)
[   34.121746] do_anonymous_page (/home/marvin/linux/kernel/linux_torvalds/mm/memory.c:4146)
[   34.121757] __handle_mm_fault (/home/marvin/linux/kernel/linux_torvalds/mm/memory.c:3662 /home/marvin/linux/kernel/linux_torvalds/mm/memory.c:4939 /home/marvin/linux/kernel/linux_torvalds/mm/memory.c:5079)
[   34.121770] handle_mm_fault (/home/marvin/linux/kernel/linux_torvalds/mm/memory.c:5233)
[   34.121782] do_user_addr_fault (/home/marvin/linux/kernel/linux_torvalds/arch/x86/mm/fault.c:1392)
[   34.121794] exc_page_fault (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/paravirt.h:695 /home/marvin/linux/kernel/linux_torvalds/arch/x86/mm/fault.c:1494 /home/marvin/linux/kernel/linux_torvalds/arch/x86/mm/fault.c:1542)
[   34.121804] asm_exc_page_fault (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/idtentry.h:570)
[   34.121815] copyout (/home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/uaccess_64.h:112 /home/marvin/linux/kernel/linux_torvalds/./arch/x86/include/asm/uaccess_64.h:133 /home/marvin/linux/kernel/linux_torvalds/lib/iov_iter.c:168)
[   34.121827] _copy_to_iter (/home/marvin/linux/kernel/linux_torvalds/lib/iov_iter.c:316 (discriminator 5))
[   34.121835] copy_page_to_iter (/home/marvin/linux/kernel/linux_torvalds/lib/iov_iter.c:483 /home/marvin/linux/kernel/linux_torvalds/lib/iov_iter.c:468)
[   34.121843] filemap_read (/home/marvin/linux/kernel/linux_torvalds/mm/filemap.c:2712)
[   34.121854] blkdev_read_iter (/home/marvin/linux/kernel/linux_torvalds/block/fops.c:620)
[   34.121866] vfs_read (/home/marvin/linux/kernel/linux_torvalds/./include/linux/fs.h:1871 /home/marvin/linux/kernel/linux_torvalds/fs/read_write.c:389 /home/marvin/linux/kernel/linux_torvalds/fs/read_write.c:470)
[   34.121877] ksys_read (/home/marvin/linux/kernel/linux_torvalds/fs/read_write.c:613)
[   34.121887] __x64_sys_read (/home/marvin/linux/kernel/linux_torvalds/fs/read_write.c:621)
[   34.121898] do_syscall_64 (/home/marvin/linux/kernel/linux_torvalds/arch/x86/entry/common.c:50 /home/marvin/linux/kernel/linux_torvalds/arch/x86/entry/common.c:80)
[   34.121907] entry_SYSCALL_64_after_hwframe (/home/marvin/linux/kernel/linux_torvalds/arch/x86/entry/entry_64.S:120)

[   34.128249] value changed: 0x0017ffffc0020001 -> 0x0017ffffc0020004

[   34.141197] Reported by Kernel Concurrency Sanitizer on:
[   34.147749] CPU: 12 PID: 348 Comm: systemd-udevd Not tainted 6.5.0-kcsan-00001-g7b800ecbe71c #5
[   34.147760] Hardware name: ASRock X670E PG Lightning/X670E PG Lightning, BIOS 1.21 04/26/2023
[   34.147766] ==================================================================

Please find attached config.

Best regards,
Mirsad Todorovac
Download attachment "config-6.5.0-kcsan-00001-g7b800ecbe71c.xz" of type "application/x-xz" (57816 bytes)