KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / tdp_page_fault

Status: auto-closed as invalid on 2020/04/20 23:54
Subsystems: kvm
[Documentation on labels]
First crash: 2490d, last: 2380d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kvm_mmu_notifier_invalidate_range_end / tdp_page_fault

write to 0xffffc900087ee150 of 8 bytes by task 25263 on cpu 0:
 kvm_mmu_notifier_invalidate_range_end+0x47/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:446
 mn_hlist_invalidate_end mm/mmu_notifier.c:526 [inline]
 __mmu_notifier_invalidate_range_end+0x19c/0x250 mm/mmu_notifier.c:544
 mmu_notifier_invalidate_range_end include/linux/mmu_notifier.h:466 [inline]
 page_mkclean_one+0x429/0x430 mm/rmap.c:973
 rmap_walk_file+0x23c/0x590 mm/rmap.c:1920
 rmap_walk+0x118/0x190 mm/rmap.c:1938
 page_mkclean+0x153/0x180 mm/rmap.c:1005
 clear_page_dirty_for_io+0x1ce/0x580 mm/page-writeback.c:2690
 mpage_submit_page+0x6d/0x1a0 fs/ext4/inode.c:2055
 mpage_process_page_bufs+0x3e5/0x400 fs/ext4/inode.c:2189
 mpage_prepare_extent_to_map+0x48b/0x760 fs/ext4/inode.c:2596
 ext4_writepages+0x974/0x2500 fs/ext4/inode.c:2724
 do_writepages+0x6b/0x170 mm/page-writeback.c:2344
 __writeback_single_inode+0xaf/0x8e0 fs/fs-writeback.c:1452
 writeback_sb_inodes+0x4ba/0xa50 fs/fs-writeback.c:1716
 __writeback_inodes_wb+0xe8/0x1b0 fs/fs-writeback.c:1785
 wb_writeback+0x557/0x6a0 fs/fs-writeback.c:1894
 wb_check_old_data_flush fs/fs-writeback.c:1996 [inline]
 wb_do_writeback fs/fs-writeback.c:2049 [inline]
 wb_workfn+0x7bb/0x970 fs/fs-writeback.c:2078
 process_one_work+0x40b/0x8d0 kernel/workqueue.c:2264
 worker_thread+0xa0/0x800 kernel/workqueue.c:2410
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffffc900087ee150 of 8 bytes by task 4703 on cpu 1:
 tdp_page_fault+0x204/0x570 arch/x86/kvm/mmu/mmu.c:4299
 kvm_mmu_page_fault+0xf9/0xbc0 arch/x86/kvm/mmu/mmu.c:5539
 handle_ept_violation+0x1e5/0x340 arch/x86/kvm/vmx/vmx.c:5163
 vmx_handle_exit+0x1c2/0xdb0 arch/x86/kvm/vmx/vmx.c:5921
 vcpu_enter_guest+0xc25/0x3860 arch/x86/kvm/x86.c:8290
 vcpu_run arch/x86/kvm/x86.c:8354 [inline]
 kvm_arch_vcpu_ioctl_run+0x2a8/0xdf0 arch/x86/kvm/x86.c:8561
 kvm_vcpu_ioctl+0x758/0xa30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2847
 vfs_ioctl fs/ioctl.c:47 [inline]
 file_ioctl fs/ioctl.c:545 [inline]
 do_vfs_ioctl+0x84f/0xcf0 fs/ioctl.c:732
 ksys_ioctl+0xbd/0xe0 fs/ioctl.c:749
 __do_sys_ioctl fs/ioctl.c:756 [inline]
 __se_sys_ioctl fs/ioctl.c:754 [inline]
 __x64_sys_ioctl+0x4c/0x60 fs/ioctl.c:754
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 4703 Comm: syz-executor.4 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (28):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/10 23:52 https://github.com/google/ktsan.git kcsan f60f0f543333 d9e55b05 .config console log report ci2-upstream-kcsan-gce
2020/02/10 03:56 https://github.com/google/ktsan.git kcsan f60f0f543333 35f5e45e .config console log report ci2-upstream-kcsan-gce
2020/01/25 00:53 https://github.com/google/ktsan.git kcsan 245a43005292 2e95ab33 .config console log report ci2-upstream-kcsan-gce
2020/01/22 19:10 https://github.com/google/ktsan.git kcsan 245a43005292 3334d684 .config console log report ci2-upstream-kcsan-gce
2020/01/19 00:35 https://github.com/google/ktsan.git kcsan 245a43005292 bc8bc756 .config console log report ci2-upstream-kcsan-gce
2020/01/18 10:51 https://github.com/google/ktsan.git kcsan 245a43005292 3de7aabb .config console log report ci2-upstream-kcsan-gce
2020/01/13 14:16 https://github.com/google/ktsan.git kcsan 245a43005292 99565c1a .config console log report ci2-upstream-kcsan-gce
2020/01/12 05:56 https://github.com/google/ktsan.git kcsan 245a43005292 4c04afaa .config console log report ci2-upstream-kcsan-gce
2020/01/08 11:38 https://github.com/google/ktsan.git kcsan 245a43005292 ddc3e859 .config console log report ci2-upstream-kcsan-gce
2020/01/06 18:32 https://github.com/google/ktsan.git kcsan 245a43005292 438e1227 .config console log report ci2-upstream-kcsan-gce
2019/12/31 18:29 https://github.com/google/ktsan.git kcsan 245a43005292 25a0186e .config console log report ci2-upstream-kcsan-gce
2019/12/29 08:44 https://github.com/google/ktsan.git kcsan 245a43005292 af6b8ef8 .config console log report ci2-upstream-kcsan-gce
2019/12/24 03:25 https://github.com/google/ktsan.git kcsan 245a43005292 be5c2c81 .config console log report ci2-upstream-kcsan-gce
2019/12/21 09:29 https://github.com/google/ktsan.git kcsan 245a43005292 bc586918 .config console log report ci2-upstream-kcsan-gce
2019/12/19 11:42 https://github.com/google/ktsan.git kcsan 245a43005292 79b211f7 .config console log report ci2-upstream-kcsan-gce
2019/12/15 11:07 https://github.com/google/ktsan.git kcsan 245a43005292 eef6e580 .config console log report ci2-upstream-kcsan-gce
2019/12/09 21:36 https://github.com/google/ktsan.git kcsan ef798c30ba4e b31eda3d .config console log report ci2-upstream-kcsan-gce
2019/12/08 00:18 https://github.com/google/ktsan.git kcsan ef798c30ba4e 1508f453 .config console log report ci2-upstream-kcsan-gce
2019/11/30 06:58 https://github.com/google/ktsan.git kcsan ef798c30ba4e 3a75be00 .config console log report ci2-upstream-kcsan-gce
2019/11/27 13:17 https://github.com/google/ktsan.git kcsan ef798c30ba4e 1048481f .config console log report ci2-upstream-kcsan-gce
2019/11/21 10:59 https://github.com/google/ktsan.git kcsan 5863cc791e4c 8098ea0f .config console log report ci2-upstream-kcsan-gce
2019/11/20 07:49 https://github.com/google/ktsan.git kcsan 5863cc791e4c 432c7650 .config console log report ci2-upstream-kcsan-gce
2019/11/16 09:42 https://github.com/google/ktsan.git kcsan 5863cc791e4c cdac920b .config console log report ci2-upstream-kcsan-gce
2019/11/09 14:59 https://github.com/google/ktsan.git kcsan 94c006602e13 1e35461e .config console log report ci2-upstream-kcsan-gce
2019/11/06 23:58 https://github.com/google/ktsan.git kcsan 94c006602e13 da505f84 .config console log report ci2-upstream-kcsan-gce
2019/11/05 03:39 https://github.com/google/ktsan.git kcsan 94c006602e13 76630fc9 .config console log report ci2-upstream-kcsan-gce
2019/11/04 20:26 https://github.com/google/ktsan.git kcsan 94c006602e13 18e12644 .config console log report ci2-upstream-kcsan-gce
2019/10/24 14:04 https://github.com/google/ktsan.git kcsan 05f2236801fe d01bb02a .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.