syzbot

 sign-in | mailing list | source | docs
🐞 Open [1517]
≡ Subsystems
🐞 Fixed [6639]
🐞 Invalid [17010]
⬇ Missing Backports [214]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KCSAN: data-race in direct_page_fault / kvm_mmu_notifier_invalidate_range_end

Status: closed as invalid on 2020/06/18 14:24
Subsystems: kvm
[Documentation on labels]
First crash: 2049d, last: 1941d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in direct_page_fault / kvm_mmu_notifier_invalidate_range_end (2) kvm 6 42 1705d 1769d 0/29 auto-closed as invalid on 2021/03/16 01:35
upstream KCSAN: data-race in direct_page_fault / kvm_mmu_notifier_invalidate_range_end (3) kvm 6 5 1642d 1665d 0/29 auto-closed as invalid on 2021/05/17 12:39

Sample crash report:
==================================================================
BUG: KCSAN: data-race in direct_page_fault / kvm_mmu_notifier_invalidate_range_end

write to 0xffffc90014e9a158 of 8 bytes by task 13449 on cpu 1:
 kvm_mmu_notifier_invalidate_range_end+0x43/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:441
 mn_hlist_invalidate_end mm/mmu_notifier.c:560 [inline]
 __mmu_notifier_invalidate_range_end+0x19e/0x250 mm/mmu_notifier.c:580
 mmu_notifier_invalidate_range_end include/linux/mmu_notifier.h:472 [inline]
 change_pmd_range mm/mprotect.c:277 [inline]
 change_pud_range mm/mprotect.c:297 [inline]
 change_p4d_range mm/mprotect.c:317 [inline]
 change_protection_range mm/mprotect.c:342 [inline]
 change_protection+0x1a86/0x1a90 mm/mprotect.c:365
 mprotect_fixup+0x2f6/0x530 mm/mprotect.c:487
 do_mprotect_pkey+0x3da/0x640 mm/mprotect.c:613
 __do_sys_mprotect mm/mprotect.c:638 [inline]
 __se_sys_mprotect mm/mprotect.c:635 [inline]
 __x64_sys_mprotect+0x4d/0x60 mm/mprotect.c:635
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffc90014e9a158 of 8 bytes by task 13453 on cpu 0:
 direct_page_fault+0x1ac/0x15e0 arch/x86/kvm/mmu/mmu.c:4143
 kvm_tdp_page_fault+0xa9/0xd0 arch/x86/kvm/mmu/mmu.c:4230
 kvm_mmu_do_page_fault arch/x86/kvm/mmu.h:115 [inline]
 kvm_mmu_page_fault+0xd1/0xac0 arch/x86/kvm/mmu/mmu.c:5446
 handle_ept_violation+0x1ce/0x430 arch/x86/kvm/vmx/vmx.c:5196
 vmx_handle_exit+0x1de/0xfe0 arch/x86/kvm/vmx/vmx.c:5980
 vcpu_enter_guest+0xc00/0x3740 arch/x86/kvm/x86.c:8481
 vcpu_run arch/x86/kvm/x86.c:8544 [inline]
 kvm_arch_vcpu_ioctl_run+0x281/0xd60 arch/x86/kvm/x86.c:8766
 kvm_vcpu_ioctl+0x70b/0x9d0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3138
 vfs_ioctl fs/ioctl.c:47 [inline]
 ksys_ioctl+0x101/0x150 fs/ioctl.c:763
 __do_sys_ioctl fs/ioctl.c:772 [inline]
 __se_sys_ioctl fs/ioctl.c:770 [inline]
 __x64_sys_ioctl+0x47/0x60 fs/ioctl.c:770
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13453 Comm: syz-executor.2 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/18 04:30 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 d45a4d69 .config console log report ci2-upstream-kcsan-gce
2020/06/07 10:08 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 2c2b926c .config console log report ci2-upstream-kcsan-gce
2020/06/06 19:00 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 e6b89e4e .config console log report ci2-upstream-kcsan-gce
2020/05/31 14:52 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 a0331e89 .config console log report ci2-upstream-kcsan-gce
2020/05/29 02:21 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 d19ed305 .config console log report ci2-upstream-kcsan-gce
2020/05/14 23:15 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 2d572622 .config console log report ci2-upstream-kcsan-gce
2020/04/14 12:54 https://github.com/google/ktsan.git kcsan 40959e34d670 3f3c5574 .config console log report ci2-upstream-kcsan-gce
2020/04/02 11:39 https://github.com/google/ktsan.git kcsan 40959e34d670 a34e2c33 .config console log report ci2-upstream-kcsan-gce
2020/03/30 13:29 https://github.com/google/ktsan.git kcsan 40959e34d670 c8d1cc20 .config console log report ci2-upstream-kcsan-gce
2020/03/01 14:37 https://github.com/google/ktsan.git kcsan 766d004d1b85 c88c7b75 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.