syzbot


KCSAN: data-race in mas_state_walk / mas_wmb_replace (3)

Status: moderation: reported on 2025/04/25 22:31
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+2b197cc5ae2316e142b4@syzkaller.appspotmail.com
First crash: 45d, last: 22h18m
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace mm 1 743d 743d 0/28 auto-obsoleted due to no activity on 2023/07/03 09:03
upstream KCSAN: data-race in mas_state_walk / mas_wmb_replace (2) mm 199 517d 550d 0/28 auto-obsoleted due to no activity on 2024/02/06 14:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in mas_state_walk / mas_wmb_replace

write to 0xffff8881047a6500 of 8 bytes by task 14215 on cpu 1:
 mte_set_node_dead lib/maple_tree.c:337 [inline]
 mas_put_in_tree lib/maple_tree.c:1736 [inline]
 mas_topiary_replace lib/maple_tree.c:2553 [inline]
 mas_wmb_replace+0x20d/0x14a0 lib/maple_tree.c:2645
 mas_split lib/maple_tree.c:3384 [inline]
 mas_commit_b_node lib/maple_tree.c:3404 [inline]
 mas_wr_bnode lib/maple_tree.c:4073 [inline]
 mas_wr_store_entry+0x1773/0x2b50 lib/maple_tree.c:4105
 mas_store_prealloc+0x74d/0x9e0 lib/maple_tree.c:5506
 vma_iter_store_overwrite mm/vma.h:455 [inline]
 vma_iter_store_new+0x1c5/0x200 mm/vma.h:462
 vma_complete+0x125/0x580 mm/vma.c:351
 __split_vma+0x591/0x650 mm/vma.c:565
 split_vma mm/vma.c:595 [inline]
 vma_modify+0x21e/0xca0 mm/vma.c:1632
 vma_modify_flags+0x101/0x130 mm/vma.c:1658
 mprotect_fixup+0x2cc/0x570 mm/mprotect.c:658
 do_mprotect_pkey+0x6d6/0x980 mm/mprotect.c:832
 __do_sys_mprotect mm/mprotect.c:853 [inline]
 __se_sys_mprotect mm/mprotect.c:850 [inline]
 __x64_sys_mprotect+0x48/0x60 mm/mprotect.c:850
 x64_sys_call+0x2794/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:11
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881047a6500 of 8 bytes by task 14222 on cpu 0:
 ma_dead_node lib/maple_tree.c:575 [inline]
 mte_dead_node lib/maple_tree.c:590 [inline]
 mas_start lib/maple_tree.c:1378 [inline]
 mas_state_walk+0x119/0x650 lib/maple_tree.c:3623
 mas_walk+0x30/0x120 lib/maple_tree.c:4936
 lock_vma_under_rcu+0xa2/0x2f0 mm/mmap_lock.c:143
 do_user_addr_fault+0x233/0x1090 arch/x86/mm/fault.c:1327
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0xffff88810461e201 -> 0xffff8881047a6500

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14222 Comm: syz.4.4006 Not tainted 6.16.0-rc1-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (45):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/09 11:56 upstream 19272b37aa4f 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/06/07 05:34 upstream c0c9379f235d 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/06/06 12:43 upstream e271ed52b344 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/06/05 23:06 upstream ec7714e49479 6b6b5f21 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/06/05 11:26 upstream 1af80d00e1e0 6b6b5f21 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/06/03 04:06 upstream fe4281644c62 a30356b7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/31 02:26 upstream 8477ab143069 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/30 15:50 upstream f66bc387efbe 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/30 02:47 upstream e0797d3b91de 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/29 15:54 upstream 90b83efa6701 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/29 01:41 upstream 3d413f0cfd7e 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/27 08:02 upstream 785cdec46e92 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/27 07:57 upstream 785cdec46e92 874a1386 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/26 03:51 upstream 0f8c0258bf04 2d4582d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/22 06:27 upstream d608703fcdd9 0919b50b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/21 23:00 upstream 4a95bc121ccd dc5d3808 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/21 04:40 upstream b36ddb9210e6 b47f9e02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/20 18:13 upstream a5806cd506af b47f9e02 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/19 22:39 upstream a5806cd506af b84f0537 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/17 21:13 upstream 172a9d94339c f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/17 02:35 upstream 3c21441eeffc f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/15 09:53 upstream c94d59a126cb d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/14 18:50 upstream 9f35e33144ae a4fa04ef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/14 05:55 upstream 405e6c37c89e 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/13 20:10 upstream e9565e23cd89 7344edeb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/13 08:22 upstream e9565e23cd89 f6671af7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/11 12:45 upstream 3ce9925823c7 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/09 22:54 upstream 9c69f8884904 77908e5f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/09 10:39 upstream 2c89c1b655c0 bb813bcc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/08 08:03 upstream d76bb1ebb558 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/07 22:47 upstream 707df3375124 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/06 06:04 upstream 01f95500a162 ae98e6b9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/06 00:32 upstream 01f95500a162 6ca47dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/05 19:07 upstream 92a09c47464d 6ca47dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/05 09:46 upstream 92a09c47464d b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/04 14:20 upstream e8ab83e34bdc b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/04 06:03 upstream 2a239ffbebb5 b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/03 19:41 upstream 95d3481af6dc b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/02 07:53 upstream ebd297a2affa 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/01 17:17 upstream 4f79eaa2ceac 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/05/01 09:48 upstream 7a13c14ee59d ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/30 02:08 upstream ca91b9500108 85a5a23f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/28 01:28 upstream b4432656b36e c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/26 11:40 upstream f1a3944c860b c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
2025/04/25 22:31 upstream 02ddfb981de8 c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in mas_state_walk / mas_wmb_replace
* Struck through repros no longer work on HEAD.