From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BF73C3ABC3 for ; Mon, 12 May 2025 13:51:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D76546B013F; Mon, 12 May 2025 09:51:14 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D00EA6B0140; Mon, 12 May 2025 09:51:14 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B9FD56B0141; Mon, 12 May 2025 09:51:14 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 955256B013F for ; Mon, 12 May 2025 09:51:14 -0400 (EDT) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 356E21CFCA6 for ; Mon, 12 May 2025 13:51:15 +0000 (UTC) X-FDA: 83434392510.23.4D0EF6C Received: from mail-il1-f171.google.com (mail-il1-f171.google.com [209.85.166.171]) by imf22.hostedemail.com (Postfix) with ESMTP id 17F56C0004 for ; Mon, 12 May 2025 13:51:12 +0000 (UTC) Authentication-Results: imf22.hostedemail.com; dkim=pass header.d=kernel-dk.20230601.gappssmtp.com header.s=20230601 header.b=FCYMj77g; spf=pass (imf22.hostedemail.com: domain of axboe@kernel.dk designates 209.85.166.171 as permitted sender) smtp.mailfrom=axboe@kernel.dk; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1747057873; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=wbHfL50ZIpw0AwwIWTOCCssdnZ8GxKKWCXgL835qDjY=; b=WVlVMc1xf7p6qAVp7NZ3/O98hasF6/gpBckdRFG0CJyocxAETHL0mY3GyJQUtX9Q8Sj+3a pHXLixojD+7T9uInjh329HqWpYRPeYuh2EpicKtTy4MjlTwbWvPejCq/hLb/WLd/z0bdKq k4Bof+zd1yMkIExDywa1CuhFGRHfCWU= ARC-Authentication-Results: i=1; imf22.hostedemail.com; dkim=pass header.d=kernel-dk.20230601.gappssmtp.com header.s=20230601 header.b=FCYMj77g; spf=pass (imf22.hostedemail.com: domain of axboe@kernel.dk designates 209.85.166.171 as permitted sender) smtp.mailfrom=axboe@kernel.dk; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1747057873; a=rsa-sha256; cv=none; b=6lr5nMF0xxG6N+VM6tctQI2RoeUWq2v04mA4A6r+uOyzCxafQp/4SGHqHJkWnGXlewd0iV 7wFk+CqbX+aTPz7eZJomoXIXnZliR0V8Ni03Gu2tiIC7izy5qhhZ0Xd9qz+bZ4iaXY1vy2 OLHuutQ/gIJfJLwUatBqrDwmnc6IUGI= Received: by mail-il1-f171.google.com with SMTP id e9e14a558f8ab-3d93f4fe5baso16453455ab.2 for ; Mon, 12 May 2025 06:51:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel-dk.20230601.gappssmtp.com; s=20230601; t=1747057872; x=1747662672; darn=kvack.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id:from :to:cc:subject:date:message-id:reply-to; bh=wbHfL50ZIpw0AwwIWTOCCssdnZ8GxKKWCXgL835qDjY=; b=FCYMj77gxWIkN8vKJbP3k4sjz0/XCK3YpnMQ5tCqW2z/31T6B+pZKinaEdgch7y9j5 FdhZh68Oaru0fzCFZNPWo/iwQ2ocNaRKZb1E+5LZuNI6XsgdbBTSw0eJQw0lwx4yR4KE ddooVvreL4QDn4v4pXJq2u9pvRGZjSSDPX31LlwxQHiB+BtU4pRBA352aRoqpuDc2z9K MgeVHS4ofmo15sQ9b0K3isSjGyWzKISjM6IlRmucaS1aKEoAxuAtIK9/s2aLBQhBMG0F uVn2jVqsElmEhMYDVlZO54PyrGMUQeXTyzW+9g3OfRjMt4xzEO6GxXL6PIoCiQJN/yvU mVvw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1747057872; x=1747662672; h=content-transfer-encoding:in-reply-to:from:content-language :references:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=wbHfL50ZIpw0AwwIWTOCCssdnZ8GxKKWCXgL835qDjY=; b=K960vep9iucJM21GToSWuYK4l2awfa2GkRSzmSmJ6R1iAgXlr5FuqWyhKldPU9WD6+ QjbhQPAkQkciuetDchEzbgvXNHr1N/QT+E2YlhfRGWVvfBIjfOFm/wAbQyIBOGFCcGnW dYBW5kB+0xYws9U62xwCCzssFdVxEPrSnnwEeeDKMZUHk+/6D/Hf9u6/HXUo83Hc4i4K pkoil/olAwMlmm8NE+0wcBaQc+NlOQezxPMSp9rlTfscaNnYx529fI9r9a/79CZigK2J fOi75eSSKmqLyKnwPzYuljRwcvJJXVrwfcg0EhbBgUV8/Ep4Nfv3/sxVg80muuVNZVXg P0Tw== X-Forwarded-Encrypted: i=1; AJvYcCU3UsHTifbX9EhcLeAdlUvNQ/B5ya0209uKl/8jHJ2ba2lgEwODO1SCpCCuUFno/Z+rwv/z9Zyk2g==@kvack.org X-Gm-Message-State: AOJu0YxtFX1dsYQwryIlbEnMV3wIzsx1BB/ATGQrjizsimhgFdyv+pDe a/T3wq0Ruh3VjG5Cp5em7i57zkQDizLvlOJQ4G+qDPMnTRi4OUfWUtXdN5L8byE= X-Gm-Gg: ASbGncvT0+k4NWFv+8ZAURTgKGB6cpeNeAnny67p2vmX0b/n0SO8ncsQ5LH46ojignq JUzFPqsVipv/unyEwgN1GnURiPWUVdLkKcErwBRjvtjNx1dV/Ed3MEQw6OM9sPNVYyKTB5Nvj5z ZLmAbKq9OkFfc2iOyU00GSYAKMsd1IHGvRqPIfoQ0CBaGDfuCaJZP1+WAwzfEcLS7vQ38gInkFG f1PRAd94eqMOIZZfSZPx3hDLO1ltypUnneCIBmfiPSV8pGdtMb7b7JUwBCto0jH+GgVJawGOmBH dbw5xGH8tnSzUSbAE7hvAYV6rWg+4Rjukisxz8SbEs+KEyY= X-Google-Smtp-Source: AGHT+IGe7PYh1BarNM3QwA7lUBGDLJIk/X9Q5I71uCCD1EP/LavNJSCXLZMijyLjXK6KPxsyQurmMA== X-Received: by 2002:a05:6e02:1fc5:b0:3d6:cbed:3305 with SMTP id e9e14a558f8ab-3da7e1e7608mr142451495ab.10.1747057871986; Mon, 12 May 2025 06:51:11 -0700 (PDT) Received: from [192.168.1.116] ([96.43.243.2]) by smtp.gmail.com with ESMTPSA id e9e14a558f8ab-3da7e10472fsm22357855ab.28.2025.05.12.06.51.11 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 12 May 2025 06:51:11 -0700 (PDT) Message-ID: <81a0d2da-d863-4a6e-8d3b-b899d38ea605@kernel.dk> Date: Mon, 12 May 2025 07:51:10 -0600 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [syzbot] [io-uring] KCSAN: data-race in copy_mm / percpu_counter_destroy_many To: syzbot , asml.silence@gmail.com, io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com, Linux-MM , Andrew Morton , dennis@kernel.org References: <682196ed.050a0220.f2294.0053.GAE@google.com> Content-Language: en-US From: Jens Axboe In-Reply-To: <682196ed.050a0220.f2294.0053.GAE@google.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Rspamd-Queue-Id: 17F56C0004 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: qdjx91wjnj5bhmgyzsirhot814gk7bon X-HE-Tag: 1747057872-480708 X-HE-Meta: U2FsdGVkX1+2ujvefSzAoD2VOCPolQgnZjUDZtI6fPOuLuAWI3anm445lk35EOCgVyWw5uf8JnxSrC00aDaxvOp0rNHg2HMs+NMShBr2gZzErAPiBH6EvcaFt44BUw8p/sALm7D8djKSmkfo3XwroklfyOEhBsy4Wm8Ww77dFengPKA++by28yQ/tKwhUPoBxP0wrnWJa82qZ8yJtC1QNGzUgvOaWs54w8/ukm0SXJeqnyF1ypQveAu+uIuRkdk1iw0W3gPhqFaaGXLPxyiEV3w7xCVvX2sHGu4L+SoiVXFzJfbMG3HOmV73sfQhTRRL+J9XlfeG1Xsm8UzvpIPtu8C99co0OzV7MpA+D0GlK+I5TgaEpzYKQL/gLjPKzivN9MooDKwMUMrXc6bAVtqOsboY5B5D8Lc55R/rtNGstKbO51PyEpiAr+h9oXVZumPYPIFLZswpg70aWydNuauD394eF96vsPLPuAccGc9sFAhIOswGalRtqmyap/+qg9JGE6ADCSvQDcVwTmv3jJR68uZs6eARKdurNwOONcAdqp946jcpC2uWOECK5/wzqJr91a0YkVgIjL1EJv+qJ0nWzmBL1pFfLNlNAl/trzuEAW7K1rgf6C5o9Jwp9cpPRnZEwvVwfVziSiSKkQlCr1VWAoRtSHTS6PVbWdnefosLaHCNT7fhiWuS1ltB3ZGAvbgn+bAa3iD1tkUtCU0S8c1OYJhMDR5m6tSFpTSliBkAFaRMDLmwfV3HWK9pWXKIKV364nwIOZdgG+GWn1LI/Hrg3GMDAHh2cqa//+1dZVolKYfjy7a9gMxsFE8IhCMWol/XrlGr3NlqiJK+odXXzdV+KOqWW4A5qdEjixG5zDLPQce5nmBT2AQ2lEtg7XJ9YSZ86ZeFPwS3jmMcJi/WosFix+Y4YRZq6LjY8j6XYGdYU2DWN3svC8JMooKVh4Xvrw+YvdSkVxupuNNt0EIyTYM +Q2VIl0/ 9r6cBT34/P1hYcUmGCnSGOemGR55yq2MCWf7CZQvWVVL8z9ZQikzBxkzj7Z9zv/u5iBDrxtB7vm3IV9o49LNtswwMeIu0fw4bXQXlnmzfvKjgqgaCQGdxF/r//t/WwjvPoNOUpEFe1OiPg6b47hP8tlZSRTGg5JPeC55E9EqN+KniQZBZsrqRoDYZAnaCGChLGcpL6JtqNxvw8FwsE77JVZx4DUnqGTP7PoiACgmoyDK1kKNb+tYi8XNwVrQT/irboSoCLu8peR9vzHlYNqisW7cSEEOf58EBthTgFgmnDgBVkiclcdbm9eNLLtMG2xjlSOGurUx07xCiSRVXpWOhlh2zg6qP3D5WhSotII15nEyFRC8hjJ3vvbCr0qBHYrteQXxJp6c4vzf6YmNdYYXPhRK9GyWOqAMzzqyQ9hmhytCeDCY5I4CPOJGvarL72dGArKEAInVz9Ortd7ugDMj5x50TxxiZkTcyH1ftU/WgOWmYlQfK8xwguBEr8Gn5RwtRbhDcuxOm2pDV+Two1VEplgwVZc8wcZkAM8gLW6vHQFYvCgHv+XwdLOlyiyoDZuScn1+1QPK3up4RrycCfttYNuwCsgeZEmhoJ4KeqnXhMI5GeCp3H4yKorj3gybQh7OT3kq+c9c2IZltLNhKN/EQBFaSQEZwheXU8pICZThbkk8hkk6cyafRe3t3QdJvbfAOPuVWQPQfvbJ7eoY13ko4j0LCjSQUeRLnGhp/OdK/uUP1806gvOQ8ASClR5sHRbLULXnjZk0QVLpENTPctfG2UFyg50sKmJUgXSjGc1Tu5krNE6lnBt5cQP95NQkNAGwrcTWQbkLA5gVMncS2qzgAW99G+SDh1Jkc74p0Do6U8GMej5n8MNR906TYrkIBQl6BHvgCqtCDnptcEAq3aJOWMwKQPi3Lk43e+gl7rFSQPw/4A+OdTBT4g19lhIlZJMVTbeT8g+aA6ih4s/YZENest9MPTQ== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On 5/12/25 12:36 AM, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 3ce9925823c7 Merge tag 'mm-hotfixes-stable-2025-05-10-14-2.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=14ff74d4580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=6154604431d9aaf9 > dashboard link: https://syzkaller.appspot.com/bug?extid=8be9bf36c3cf574426c8 > compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2 > > Unfortunately, I don't have any reproducer for this issue yet. > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/afdc6302fc05/disk-3ce99258.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/fc7f98d3c420/vmlinux-3ce99258.xz > kernel image: https://storage.googleapis.com/syzbot-assets/ea7ca2da2258/bzImage-3ce99258.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+8be9bf36c3cf574426c8@syzkaller.appspotmail.com > > ================================================================== > BUG: KCSAN: data-race in copy_mm / percpu_counter_destroy_many > > write to 0xffff8881045e19d8 of 8 bytes by task 2123 on cpu 0: > __list_del include/linux/list.h:195 [inline] > __list_del_entry include/linux/list.h:218 [inline] > list_del include/linux/list.h:229 [inline] > percpu_counter_destroy_many+0xc7/0x2b0 lib/percpu_counter.c:244 > __mmdrop+0x22e/0x350 kernel/fork.c:947 > mmdrop include/linux/sched/mm.h:55 [inline] > io_ring_ctx_free+0x31e/0x360 io_uring/io_uring.c:2740 > io_ring_exit_work+0x529/0x560 io_uring/io_uring.c:2962 > process_one_work kernel/workqueue.c:3238 [inline] > process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319 > worker_thread+0x582/0x770 kernel/workqueue.c:3400 > kthread+0x486/0x510 kernel/kthread.c:464 > ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:153 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > > read to 0xffff8881045e1600 of 1344 bytes by task 5051 on cpu 1: > dup_mm kernel/fork.c:1728 [inline] > copy_mm+0xfb/0x1310 kernel/fork.c:1786 > copy_process+0xcf1/0x1f90 kernel/fork.c:2429 > kernel_clone+0x16c/0x5b0 kernel/fork.c:2844 > __do_sys_clone kernel/fork.c:2987 [inline] > __se_sys_clone kernel/fork.c:2971 [inline] > __x64_sys_clone+0xe6/0x120 kernel/fork.c:2971 > x64_sys_call+0x2c59/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:57 > do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] > do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > Reported by Kernel Concurrency Sanitizer on: > CPU: 1 UID: 0 PID: 5051 Comm: syz.1.494 Not tainted 6.15.0-rc5-syzkaller-00300-g3ce9925823c7 #0 PREEMPT(voluntary) This doesn't look like an io_uring issue, it's successive setup and teardown of a percpu counter. Adding some relevant folks. #syz set subsystems: kernel -- Jens Axboe