KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (2)

Status: closed as invalid on 2020/06/18 14:24
Subsystems: kvm
[Documentation on labels]
First crash: 2369d, last: 2242d
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (3) kvm 6 1 2219d 2219d 0/29 auto-closed as invalid on 2020/07/30 20:33
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (6) kvm 6 4 1985d 2014d 0/29 auto-closed as invalid on 2021/03/21 16:27
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (4) kvm 6 3 2125d 2159d 0/29 auto-closed as invalid on 2020/11/01 19:43
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (7) kvm 6 1 1932d 1932d 0/29 auto-closed as invalid on 2021/05/17 10:12
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end kvm 6 2 2445d 2446d 0/29 auto-closed as invalid on 2020/01/21 09:46
upstream KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end (5) kvm 6 1 2053d 2053d 0/29 auto-closed as invalid on 2021/01/12 10:00

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / kvm_mmu_notifier_invalidate_range_end

write to 0xffffc900034b9160 of 8 bytes by task 18680 on cpu 1:
 kvm_mmu_notifier_invalidate_range_end+0x63/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:448
 mn_hlist_invalidate_end mm/mmu_notifier.c:560 [inline]
 __mmu_notifier_invalidate_range_end+0x19e/0x250 mm/mmu_notifier.c:580
 mmu_notifier_invalidate_range_only_end include/linux/mmu_notifier.h:479 [inline]
 wp_page_copy+0xe2a/0x1050 mm/memory.c:2766
 do_wp_page+0x224/0xca0 mm/memory.c:2982
 handle_pte_fault mm/memory.c:4231 [inline]
 __handle_mm_fault+0x2d96/0x2da0 mm/memory.c:4345
 handle_mm_fault+0x21c/0x540 mm/memory.c:4382
 do_user_addr_fault arch/x86/mm/fault.c:1464 [inline]
 do_page_fault+0x48a/0xa96 arch/x86/mm/fault.c:1535
 page_fault+0x34/0x40 arch/x86/entry/entry_64.S:1203

read to 0xffffc900034b9160 of 8 bytes by task 18678 on cpu 0:
 kvm_mmu_notifier_invalidate_range_end+0x77/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:451
 mn_hlist_invalidate_end mm/mmu_notifier.c:560 [inline]
 __mmu_notifier_invalidate_range_end+0x19e/0x250 mm/mmu_notifier.c:580
 mmu_notifier_invalidate_range_only_end include/linux/mmu_notifier.h:479 [inline]
 wp_page_copy+0xe2a/0x1050 mm/memory.c:2766
 do_wp_page+0x224/0xca0 mm/memory.c:2982
 handle_pte_fault mm/memory.c:4231 [inline]
 __handle_mm_fault+0x2d96/0x2da0 mm/memory.c:4345
 handle_mm_fault+0x21c/0x540 mm/memory.c:4382
 do_user_addr_fault arch/x86/mm/fault.c:1464 [inline]
 do_page_fault+0x48a/0xa96 arch/x86/mm/fault.c:1535
 page_fault+0x34/0x40 arch/x86/entry/entry_64.S:1203

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 18678 Comm: syz-executor.2 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/02 06:20 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 a0331e89 .config console log report ci2-upstream-kcsan-gce
2020/05/18 04:11 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 37bccd4e .config console log report ci2-upstream-kcsan-gce
2020/05/03 16:56 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 58ae5e18 .config console log report ci2-upstream-kcsan-gce
2020/04/23 15:52 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 b9233cab .config console log report ci2-upstream-kcsan-gce
2020/04/08 04:30 https://github.com/google/ktsan.git kcsan 40959e34d670 db9bcd4b .config console log report ci2-upstream-kcsan-gce
2020/03/30 17:25 https://github.com/google/ktsan.git kcsan 40959e34d670 c8d1cc20 .config console log report ci2-upstream-kcsan-gce
2020/03/28 12:26 https://github.com/google/ktsan.git kcsan 40959e34d670 f1ebdfba .config console log report ci2-upstream-kcsan-gce
2020/01/27 04:25 https://github.com/google/ktsan.git kcsan 245a43005292 dd56146d .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.