Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
Date:   Mon, 24 Apr 2023 00:19:45 -0700
Message-ID: <000000000000d0737c05fa0fd499@google.com>
Subject: [syzbot] [fs?] [mm?] KCSAN: data-race in __filemap_remove_folio /
 folio_mapping (2)
From:   syzbot <syzbot+606f94dfeaaa45124c90@syzkaller.appspotmail.com>
To:     djwong@kernel.org, hch@infradead.org,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-mm@kvack.org, linux-xfs@vger.kernel.org,
        syzkaller-bugs@googlegroups.com
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Hello,

syzbot found the following issue on:

HEAD commit:    622322f53c6d Merge tag 'mips-fixes_6.3_2' of git://git.ker..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12342880280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=fa4baf7c6b35b5d5
dashboard link: https://syzkaller.appspot.com/bug?extid=606f94dfeaaa45124c90
compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8b5f31d96315/disk-622322f5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/adca7dc8daae/vmlinux-622322f5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/ed78ddc31ccb/bzImage-622322f5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+606f94dfeaaa45124c90@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __filemap_remove_folio / folio_mapping

write to 0xffffea0004958618 of 8 bytes by task 17586 on cpu 1:
 page_cache_delete mm/filemap.c:145 [inline]
 __filemap_remove_folio+0x210/0x330 mm/filemap.c:225
 invalidate_complete_folio2 mm/truncate.c:586 [inline]
 invalidate_inode_pages2_range+0x506/0x790 mm/truncate.c:673
 iomap_dio_complete+0x383/0x470 fs/iomap/direct-io.c:115
 iomap_dio_rw+0x62/0x90 fs/iomap/direct-io.c:687
 ext4_dio_write_iter fs/ext4/file.c:597 [inline]
 ext4_file_write_iter+0x9e6/0x10e0 fs/ext4/file.c:708
 do_iter_write+0x418/0x700 fs/read_write.c:861
 vfs_iter_write+0x50/0x70 fs/read_write.c:902
 iter_file_splice_write+0x456/0x7d0 fs/splice.c:778
 do_splice_from fs/splice.c:856 [inline]
 direct_splice_actor+0x84/0xa0 fs/splice.c:1022
 splice_direct_to_actor+0x2ee/0x5f0 fs/splice.c:977
 do_splice_direct+0x104/0x180 fs/splice.c:1065
 do_sendfile+0x3b8/0x950 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffffea0004958618 of 8 bytes by task 17568 on cpu 0:
 folio_mapping+0x92/0x110 mm/util.c:774
 folio_evictable mm/internal.h:156 [inline]
 lru_add_fn+0x92/0x450 mm/swap.c:181
 folio_batch_move_lru+0x21e/0x2f0 mm/swap.c:217
 folio_batch_add_and_move mm/swap.c:234 [inline]
 folio_add_lru+0xc9/0x130 mm/swap.c:517
 filemap_add_folio+0xfc/0x150 mm/filemap.c:954
 page_cache_ra_unbounded+0x15e/0x2e0 mm/readahead.c:251
 do_page_cache_ra mm/readahead.c:300 [inline]
 page_cache_ra_order mm/readahead.c:560 [inline]
 ondemand_readahead+0x550/0x6c0 mm/readahead.c:682
 page_cache_sync_ra+0x284/0x2a0 mm/readahead.c:709
 page_cache_sync_readahead include/linux/pagemap.h:1214 [inline]
 filemap_get_pages+0x257/0xea0 mm/filemap.c:2598
 filemap_read+0x223/0x680 mm/filemap.c:2693
 generic_file_read_iter+0x76/0x320 mm/filemap.c:2840
 ext4_file_read_iter+0x1cc/0x290
 call_read_iter include/linux/fs.h:1845 [inline]
 generic_file_splice_read+0xe3/0x290 fs/splice.c:402
 do_splice_to fs/splice.c:885 [inline]
 splice_direct_to_actor+0x25a/0x5f0 fs/splice.c:956
 do_splice_direct+0x104/0x180 fs/splice.c:1065
 do_sendfile+0x3b8/0x950 fs/read_write.c:1255
 __do_sys_sendfile64 fs/read_write.c:1323 [inline]
 __se_sys_sendfile64 fs/read_write.c:1309 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1309
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0xffff88810a98f7b0 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 17568 Comm: syz-executor.2 Not tainted 6.3.0-rc7-syzkaller-00191-g622322f53c6d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.