* [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put @ 2024-10-28 20:26 Daniel Yang 2024-10-29 3:21 ` OGAWA Hirofumi 2024-11-05 2:39 ` kernel test robot 0 siblings, 2 replies; 4+ messages in thread From: Daniel Yang @ 2024-10-28 20:26 UTC (permalink / raw) To: OGAWA Hirofumi, open list; +Cc: Daniel Yang, syzbot+3999cae1c2d59c2cc8b9 Issue is that fat_free() calls fat_get_cluster() and fat_free_clusters() at the same time. If the same fatent gets modified, it can lead to a race condition where fat16_ent_put() and fat16_ent_get() will read/write conflict on fatent->u.ent16_p. To fix: add critical sections in fat_free() on the offending function calls so that they can't both be running at the same time. Since the critical sections are short, a spinlock is used since the overhead is not that high. Signed-off-by: Daniel Yang <danielyangkang@gmail.com> Reported-by: syzbot+3999cae1c2d59c2cc8b9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3999cae1c2d59c2cc8b9 --- fs/fat/file.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/fat/file.c b/fs/fat/file.c index e887e9ab7..d7ae152a9 100644 --- a/fs/fat/file.c +++ b/fs/fat/file.c @@ -7,6 +7,7 @@ * regular file handling primitives for fat-based filesystems */ +#include "linux/spinlock.h" #include <linux/capability.h> #include <linux/module.h> #include <linux/compat.h> @@ -306,6 +307,9 @@ static long fat_fallocate(struct file *file, int mode, return err; } +/* Prevent data race in fat_free. */ +static DEFINE_SPINLOCK(cluster_lock); + /* Free all clusters after the skip'th cluster. */ static int fat_free(struct inode *inode, int skip) { @@ -343,7 +347,10 @@ static int fat_free(struct inode *inode, int skip) struct fat_entry fatent; int ret, fclus, dclus; + /* Ensure fat_get_cluster isn't called while freeing. */ + spin_lock(&cluster_lock); ret = fat_get_cluster(inode, skip - 1, &fclus, &dclus); + spin_unlock(&cluster_lock); if (ret < 0) return ret; else if (ret == FAT_ENT_EOF) @@ -373,7 +380,12 @@ static int fat_free(struct inode *inode, int skip) inode->i_blocks = skip << (MSDOS_SB(sb)->cluster_bits - 9); /* Freeing the remained cluster chain */ - return fat_free_clusters(inode, free_start); + int ret; + + spin_lock(&cluster_lock); + ret = fat_free_clusters(inode, free_start); + spin_unlock(&cluster_lock); + return ret; } void fat_truncate_blocks(struct inode *inode, loff_t offset) -- 2.39.2 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put 2024-10-28 20:26 [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put Daniel Yang @ 2024-10-29 3:21 ` OGAWA Hirofumi 2024-11-05 2:39 ` kernel test robot 1 sibling, 0 replies; 4+ messages in thread From: OGAWA Hirofumi @ 2024-10-29 3:21 UTC (permalink / raw) To: Daniel Yang; +Cc: open list, syzbot+3999cae1c2d59c2cc8b9 Daniel Yang <danielyangkang@gmail.com> writes: > Issue is that fat_free() calls fat_get_cluster() and fat_free_clusters() > at the same time. If the same fatent gets modified, it can lead to a > race condition where fat16_ent_put() and fat16_ent_get() will read/write > conflict on fatent->u.ent16_p. > > To fix: add critical sections in fat_free() on the offending function > calls so that they can't both be running at the same time. Since the > critical sections are short, a spinlock is used since the overhead is > not that high. Which case can read and write a same entry on FAT table with it except corrupted image? And if corrupted image, I think reading invalid data is ok if it didn't become the cause of crash. Thanks. > Signed-off-by: Daniel Yang <danielyangkang@gmail.com> > Reported-by: syzbot+3999cae1c2d59c2cc8b9@syzkaller.appspotmail.com > Closes: https://syzkaller.appspot.com/bug?extid=3999cae1c2d59c2cc8b9 > --- > fs/fat/file.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/fs/fat/file.c b/fs/fat/file.c > index e887e9ab7..d7ae152a9 100644 > --- a/fs/fat/file.c > +++ b/fs/fat/file.c > @@ -7,6 +7,7 @@ > * regular file handling primitives for fat-based filesystems > */ > > +#include "linux/spinlock.h" > #include <linux/capability.h> > #include <linux/module.h> > #include <linux/compat.h> > @@ -306,6 +307,9 @@ static long fat_fallocate(struct file *file, int mode, > return err; > } > > +/* Prevent data race in fat_free. */ > +static DEFINE_SPINLOCK(cluster_lock); > + > /* Free all clusters after the skip'th cluster. */ > static int fat_free(struct inode *inode, int skip) > { > @@ -343,7 +347,10 @@ static int fat_free(struct inode *inode, int skip) > struct fat_entry fatent; > int ret, fclus, dclus; > > + /* Ensure fat_get_cluster isn't called while freeing. */ > + spin_lock(&cluster_lock); > ret = fat_get_cluster(inode, skip - 1, &fclus, &dclus); > + spin_unlock(&cluster_lock); > if (ret < 0) > return ret; > else if (ret == FAT_ENT_EOF) > @@ -373,7 +380,12 @@ static int fat_free(struct inode *inode, int skip) > inode->i_blocks = skip << (MSDOS_SB(sb)->cluster_bits - 9); > > /* Freeing the remained cluster chain */ > - return fat_free_clusters(inode, free_start); > + int ret; > + > + spin_lock(&cluster_lock); > + ret = fat_free_clusters(inode, free_start); > + spin_unlock(&cluster_lock); > + return ret; > } > > void fat_truncate_blocks(struct inode *inode, loff_t offset) -- OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [LTP] [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put 2024-10-28 20:26 [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put Daniel Yang @ 2024-11-05 2:39 ` kernel test robot 2024-11-05 2:39 ` kernel test robot 1 sibling, 0 replies; 4+ messages in thread From: kernel test robot @ 2024-11-05 2:39 UTC (permalink / raw) To: Daniel Yang Cc: lkp, linux-fsdevel, linux-kernel@vger.kernel.org (open list), Daniel Yang, ltp, oe-lkp, oliver.sang, syzbot+3999cae1c2d59c2cc8b9, OGAWA Hirofumi Hello, kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_include/linux/sched/mm.h" on: commit: d83bdef3f16d8ab604c50c6328ebfb439fdc94a2 ("[PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put") url: https://github.com/intel-lab-lkp/linux/commits/Daniel-Yang/Fix-BUG-KCSAN-data-race-in-fat16_ent_get-fat16_ent_put/20241029-043546 base: https://git.kernel.org/cgit/linux/kernel/git/vfs/vfs.git vfs.all patch link: https://lore.kernel.org/all/20241028202645.412589-1-danielyangkang@gmail.com/ patch subject: [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put in testcase: ltp version: ltp-x86_64-14c1f76-1_20241102 with following parameters: disk: 1HDD fs: btrfs test: syscalls-06 config: x86_64-rhel-8.3-ltp compiler: gcc-12 test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory (please refer to attached dmesg/kmsg for entire log/backtrace) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <oliver.sang@intel.com> | Closes: https://lore.kernel.org/oe-lkp/202411051037.304ba029-oliver.sang@intel.com kern :err : [ 377.372938] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:321 kern :err : [ 377.382306] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4784, name: fallocate05 kern :err : [ 377.391362] preempt_count: 1, expected: 0 kern :err : [ 377.396140] RCU nest depth: 0, expected: 0 kern :warn : [ 377.401018] CPU: 1 UID: 0 PID: 4784 Comm: fallocate05 Tainted: G S 6.12.0-rc4-00129-gd83bdef3f16d #1 kern :warn : [ 377.412292] Tainted: [S]=CPU_OUT_OF_SPEC kern :warn : [ 377.416956] Hardware name: Hewlett-Packard HP Pro 3340 MT/17A1, BIOS 8.07 01/24/2013 kern :warn : [ 377.425444] Call Trace: kern :warn : [ 377.428639] <TASK> kern :warn : [ 377.431476] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1)) kern :warn : [ 377.435880] __might_resched (kernel/sched/core.c:8654) kern :warn : [ 377.440575] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.445767] ? __find_get_block (include/linux/buffer_head.h:324 fs/buffer.c:1352 fs/buffer.c:1406 fs/buffer.c:1398) kern :warn : [ 377.450700] __bread_gfp (include/linux/kernel.h:73 include/linux/sched/mm.h:321 fs/buffer.c:1433 fs/buffer.c:1491) kern :warn : [ 377.454958] ? generic_perform_write (mm/filemap.c:4056) kern :warn : [ 377.460334] fat_ent_bread (fs/fat/fatent.c:109 (discriminator 3)) fat kern :warn : [ 377.465379] fat_ent_read (fs/fat/fatent.c:369) fat kern :warn : [ 377.470339] ? __pfx_fat_ent_read (fs/fat/fatent.c:350) fat kern :warn : [ 377.475821] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 377.480406] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 377.485514] fat_get_cluster (fs/fat/cache.c:267) fat kern :warn : [ 377.490800] ? kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) kern :warn : [ 377.495555] ? __pfx_fat_get_cluster (fs/fat/cache.c:226) fat kern :warn : [ 377.501252] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 377.505815] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 377.510897] fat_free+0x47b/0x830 fat kern :warn : [ 377.516070] ? __pfx_fat_free+0x10/0x10 fat kern :warn : [ 377.521767] ? unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.526846] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.532406] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.537943] fat_truncate_blocks (fs/fat/file.c:407 (discriminator 3)) fat kern :warn : [ 377.543467] fat_write_begin (fs/fat/inode.c:218 fs/fat/inode.c:232) fat kern :warn : [ 377.548557] generic_perform_write (mm/filemap.c:4056) kern :warn : [ 377.553723] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.558890] ? __pfx_generic_perform_write (mm/filemap.c:4018) kern :warn : [ 377.564575] ? fat_update_time (fs/fat/misc.c:359) fat kern :warn : [ 377.569774] ? file_update_time (fs/inode.c:2383) kern :warn : [ 377.574729] generic_file_write_iter (include/linux/fs.h:821 mm/filemap.c:4184) kern :warn : [ 377.580005] vfs_write (fs/read_write.c:590 fs/read_write.c:683) kern :warn : [ 377.584135] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.589309] ? __pfx_vfs_write (fs/read_write.c:664) kern :warn : [ 377.593955] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.599121] ? sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049) kern :warn : [ 377.604737] ? asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:702) kern :warn : [ 377.610809] ? fdget_pos (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/file_ref.h:171 fs/file.c:1181 fs/file.c:1189) kern :warn : [ 377.615141] ? up_write (arch/x86/include/asm/atomic64_64.h:87 include/linux/atomic/atomic-arch-fallback.h:2852 include/linux/atomic/atomic-long.h:268 include/linux/atomic/atomic-instrumented.h:3391 kernel/locking/rwsem.c:1372 kernel/locking/rwsem.c:1630) kern :warn : [ 377.619204] ksys_write (fs/read_write.c:736) kern :warn : [ 377.623369] ? __pfx_ksys_write (fs/read_write.c:726) kern :warn : [ 377.628150] ? __rseq_handle_notify_resume (kernel/rseq.c:333) kern :warn : [ 377.633881] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) kern :warn : [ 377.638306] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) kern :warn : [ 377.644094] RIP: 0033:0x7f287cd67240 kern :warn : [ 377.648423] Code: 40 00 48 8b 15 c1 9b 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 23 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 All code ======== 0: 40 00 48 8b rex add %cl,-0x75(%rax) 4: 15 c1 9b 0d 00 adc $0xd9bc1,%eax 9: f7 d8 neg %eax b: 64 89 02 mov %eax,%fs:(%rdx) e: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 15: eb b7 jmp 0xffffffffffffffce 17: 0f 1f 00 nopl (%rax) 1a: 80 3d a1 23 0e 00 00 cmpb $0x0,0xe23a1(%rip) # 0xe23c2 21: 74 17 je 0x3a 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 58 ja 0x8a 32: c3 ret 33: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 3a: 48 83 ec 28 sub $0x28,%rsp 3e: 48 rex.W 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 58 ja 0x60 8: c3 ret 9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 10: 48 83 ec 28 sub $0x28,%rsp 14: 48 rex.W 15: 89 .byte 0x89 kern :warn : [ 377.667929] RSP: 002b:00007ffd8d96db68 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 kern :warn : [ 377.676231] RAX: ffffffffffffffda RBX: 0000000000001000 RCX: 00007f287cd67240 kern :warn : [ 377.684089] RDX: 0000000000001000 RSI: 0000562f0070cf18 RDI: 0000000000000005 kern :warn : [ 377.691953] RBP: 0000562f0070b058 R08: 0000000000000000 R09: 0000000000000075 kern :warn : [ 377.699805] R10: 00000000000001c0 R11: 0000000000000202 R12: 0000562f0070ce08 kern :warn : [ 377.707660] R13: 000000000011f8ec R14: 00007ffd8d96dbf0 R15: 0000000000000005 kern :warn : [ 377.715522] </TASK> kern :err : [ 379.995791] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:321 kern :err : [ 380.005158] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4784, name: fallocate05 kern :err : [ 380.014176] preempt_count: 1, expected: 0 kern :err : [ 380.018931] RCU nest depth: 0, expected: 0 kern :warn : [ 380.023773] CPU: 1 UID: 0 PID: 4784 Comm: fallocate05 Tainted: G S W 6.12.0-rc4-00129-gd83bdef3f16d #1 kern :warn : [ 380.035011] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN kern :warn : [ 380.040515] Hardware name: Hewlett-Packard HP Pro 3340 MT/17A1, BIOS 8.07 01/24/2013 kern :warn : [ 380.048964] Call Trace: kern :warn : [ 380.052128] <TASK> kern :warn : [ 380.054943] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1)) kern :warn : [ 380.059321] __might_resched (kernel/sched/core.c:8654) kern :warn : [ 380.063957] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.069112] ? __find_get_block (include/linux/buffer_head.h:324 fs/buffer.c:1352 fs/buffer.c:1406 fs/buffer.c:1398) kern :warn : [ 380.074008] __bread_gfp (include/linux/kernel.h:73 include/linux/sched/mm.h:321 fs/buffer.c:1433 fs/buffer.c:1491) kern :warn : [ 380.078211] ? generic_perform_write (mm/filemap.c:4056) kern :warn : [ 380.083544] fat_ent_bread (fs/fat/fatent.c:109 (discriminator 3)) fat kern :warn : [ 380.088535] fat_ent_read (fs/fat/fatent.c:369) fat kern :warn : [ 380.093431] ? __pfx_fat_ent_read (fs/fat/fatent.c:350) fat kern :warn : [ 380.098847] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.103396] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 380.108467] fat_get_cluster (fs/fat/cache.c:267) fat kern :warn : [ 380.113714] ? kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) kern :warn : [ 380.118438] ? __pfx_fat_get_cluster (fs/fat/cache.c:226) fat kern :warn : [ 380.124121] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.128669] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.133222] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 380.138290] ? __mark_inode_dirty (fs/fs-writeback.c:2519) kern :warn : [ 380.143358] fat_free+0x47b/0x830 fat kern :warn : [ 380.148518] ? __pfx_fat_free+0x10/0x10 fat kern :warn : [ 380.154205] ? unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.159272] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.164774] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.170279] fat_truncate_blocks (fs/fat/file.c:407 (discriminator 3)) fat kern :warn : [ 380.175792] fat_write_begin (fs/fat/inode.c:218 fs/fat/inode.c:232) fat kern :warn : [ 380.180868] generic_perform_write (mm/filemap.c:4056) kern :warn : [ 380.186024] ? inode_io_list_move_locked (arch/x86/include/asm/bitops.h:206 arch/x86/include/asm/bitops.h:238 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/backing-dev.h:51 fs/fs-writeback.c:87 fs/fs-writeback.c:130) kern :warn : [ 380.191703] ? __pfx_generic_perform_write (mm/filemap.c:4018) kern :warn : [ 380.197379] ? fat_update_time (fs/fat/misc.c:359) fat kern :warn : [ 380.202544] ? file_update_time (fs/inode.c:2383) kern :warn : [ 380.207440] generic_file_write_iter (include/linux/fs.h:821 mm/filemap.c:4184) kern :warn : [ 380.212682] vfs_write (fs/read_write.c:590 fs/read_write.c:683) kern :warn : [ 380.216799] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.221956] ? __pfx_vfs_write (fs/read_write.c:664) kern :warn : [ 380.226592] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.231750] ? fdget_pos (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/file_ref.h:171 fs/file.c:1181 fs/file.c:1189) kern :warn : [ 380.236041] ksys_write (fs/read_write.c:736) kern :warn : [ 380.240156] ? __pfx_ksys_write (fs/read_write.c:726) kern :warn : [ 380.244880] ? switch_fpu_return (arch/x86/include/asm/bitops.h:75 include/asm-generic/bitops/instrumented-atomic.h:42 include/linux/thread_info.h:94 arch/x86/kernel/fpu/context.h:79 arch/x86/kernel/fpu/core.c:787) kern :warn : [ 380.249777] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) kern :warn : [ 380.254159] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) kern :warn : [ 380.259924] RIP: 0033:0x7f287cd67240 kern :warn : [ 380.264217] Code: 40 00 48 8b 15 c1 9b 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 23 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 All code ======== 0: 40 00 48 8b rex add %cl,-0x75(%rax) 4: 15 c1 9b 0d 00 adc $0xd9bc1,%eax 9: f7 d8 neg %eax b: 64 89 02 mov %eax,%fs:(%rdx) e: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 15: eb b7 jmp 0xffffffffffffffce 17: 0f 1f 00 nopl (%rax) 1a: 80 3d a1 23 0e 00 00 cmpb $0x0,0xe23a1(%rip) # 0xe23c2 21: 74 17 je 0x3a 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 58 ja 0x8a 32: c3 ret 33: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 3a: 48 83 ec 28 sub $0x28,%rsp 3e: 48 rex.W 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 58 ja 0x60 8: c3 ret 9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 10: 48 83 ec 28 sub $0x28,%rsp 14: 48 rex.W 15: 89 .byte 0x89 kern :warn : [ 380.283678] RSP: 002b:00007ffd8d96db68 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 kern :warn : [ 380.291958] RAX: ffffffffffffffda RBX: 0000000000001000 RCX: 00007f287cd67240 kern :warn : [ 380.299803] RDX: 0000000000001000 RSI: 0000562f0070cf18 RDI: 0000000000000005 kern :warn : [ 380.307644] RBP: 0000562f0070b058 R08: 00007f287cc6c6c0 R09: 0000000000000075 kern :warn : [ 380.315488] R10: 00007f287cc85b98 R11: 0000000000000202 R12: 0000562f0070ce08 kern :warn : [ 380.323330] R13: 000000000008fc76 R14: 00007ffd8d96dbf0 R15: 0000000000000005 kern :warn : [ 380.331176] </TASK> The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20241105/202411051037.304ba029-oliver.sang@intel.com -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki -- Mailing list info: https://lists.linux.it/listinfo/ltp ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put @ 2024-11-05 2:39 ` kernel test robot 0 siblings, 0 replies; 4+ messages in thread From: kernel test robot @ 2024-11-05 2:39 UTC (permalink / raw) To: Daniel Yang Cc: oe-lkp, lkp, linux-fsdevel, ltp, OGAWA Hirofumi, linux-kernel@vger.kernel.org (open list), Daniel Yang, syzbot+3999cae1c2d59c2cc8b9, oliver.sang Hello, kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_include/linux/sched/mm.h" on: commit: d83bdef3f16d8ab604c50c6328ebfb439fdc94a2 ("[PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put") url: https://github.com/intel-lab-lkp/linux/commits/Daniel-Yang/Fix-BUG-KCSAN-data-race-in-fat16_ent_get-fat16_ent_put/20241029-043546 base: https://git.kernel.org/cgit/linux/kernel/git/vfs/vfs.git vfs.all patch link: https://lore.kernel.org/all/20241028202645.412589-1-danielyangkang@gmail.com/ patch subject: [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put in testcase: ltp version: ltp-x86_64-14c1f76-1_20241102 with following parameters: disk: 1HDD fs: btrfs test: syscalls-06 config: x86_64-rhel-8.3-ltp compiler: gcc-12 test machine: 4 threads 1 sockets Intel(R) Core(TM) i3-3220 CPU @ 3.30GHz (Ivy Bridge) with 8G memory (please refer to attached dmesg/kmsg for entire log/backtrace) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <oliver.sang@intel.com> | Closes: https://lore.kernel.org/oe-lkp/202411051037.304ba029-oliver.sang@intel.com kern :err : [ 377.372938] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:321 kern :err : [ 377.382306] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4784, name: fallocate05 kern :err : [ 377.391362] preempt_count: 1, expected: 0 kern :err : [ 377.396140] RCU nest depth: 0, expected: 0 kern :warn : [ 377.401018] CPU: 1 UID: 0 PID: 4784 Comm: fallocate05 Tainted: G S 6.12.0-rc4-00129-gd83bdef3f16d #1 kern :warn : [ 377.412292] Tainted: [S]=CPU_OUT_OF_SPEC kern :warn : [ 377.416956] Hardware name: Hewlett-Packard HP Pro 3340 MT/17A1, BIOS 8.07 01/24/2013 kern :warn : [ 377.425444] Call Trace: kern :warn : [ 377.428639] <TASK> kern :warn : [ 377.431476] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1)) kern :warn : [ 377.435880] __might_resched (kernel/sched/core.c:8654) kern :warn : [ 377.440575] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.445767] ? __find_get_block (include/linux/buffer_head.h:324 fs/buffer.c:1352 fs/buffer.c:1406 fs/buffer.c:1398) kern :warn : [ 377.450700] __bread_gfp (include/linux/kernel.h:73 include/linux/sched/mm.h:321 fs/buffer.c:1433 fs/buffer.c:1491) kern :warn : [ 377.454958] ? generic_perform_write (mm/filemap.c:4056) kern :warn : [ 377.460334] fat_ent_bread (fs/fat/fatent.c:109 (discriminator 3)) fat kern :warn : [ 377.465379] fat_ent_read (fs/fat/fatent.c:369) fat kern :warn : [ 377.470339] ? __pfx_fat_ent_read (fs/fat/fatent.c:350) fat kern :warn : [ 377.475821] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 377.480406] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 377.485514] fat_get_cluster (fs/fat/cache.c:267) fat kern :warn : [ 377.490800] ? kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) kern :warn : [ 377.495555] ? __pfx_fat_get_cluster (fs/fat/cache.c:226) fat kern :warn : [ 377.501252] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 377.505815] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 377.510897] fat_free+0x47b/0x830 fat kern :warn : [ 377.516070] ? __pfx_fat_free+0x10/0x10 fat kern :warn : [ 377.521767] ? unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.526846] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.532406] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 377.537943] fat_truncate_blocks (fs/fat/file.c:407 (discriminator 3)) fat kern :warn : [ 377.543467] fat_write_begin (fs/fat/inode.c:218 fs/fat/inode.c:232) fat kern :warn : [ 377.548557] generic_perform_write (mm/filemap.c:4056) kern :warn : [ 377.553723] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.558890] ? __pfx_generic_perform_write (mm/filemap.c:4018) kern :warn : [ 377.564575] ? fat_update_time (fs/fat/misc.c:359) fat kern :warn : [ 377.569774] ? file_update_time (fs/inode.c:2383) kern :warn : [ 377.574729] generic_file_write_iter (include/linux/fs.h:821 mm/filemap.c:4184) kern :warn : [ 377.580005] vfs_write (fs/read_write.c:590 fs/read_write.c:683) kern :warn : [ 377.584135] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.589309] ? __pfx_vfs_write (fs/read_write.c:664) kern :warn : [ 377.593955] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 377.599121] ? sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1049) kern :warn : [ 377.604737] ? asm_sysvec_apic_timer_interrupt (arch/x86/include/asm/idtentry.h:702) kern :warn : [ 377.610809] ? fdget_pos (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/file_ref.h:171 fs/file.c:1181 fs/file.c:1189) kern :warn : [ 377.615141] ? up_write (arch/x86/include/asm/atomic64_64.h:87 include/linux/atomic/atomic-arch-fallback.h:2852 include/linux/atomic/atomic-long.h:268 include/linux/atomic/atomic-instrumented.h:3391 kernel/locking/rwsem.c:1372 kernel/locking/rwsem.c:1630) kern :warn : [ 377.619204] ksys_write (fs/read_write.c:736) kern :warn : [ 377.623369] ? __pfx_ksys_write (fs/read_write.c:726) kern :warn : [ 377.628150] ? __rseq_handle_notify_resume (kernel/rseq.c:333) kern :warn : [ 377.633881] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) kern :warn : [ 377.638306] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) kern :warn : [ 377.644094] RIP: 0033:0x7f287cd67240 kern :warn : [ 377.648423] Code: 40 00 48 8b 15 c1 9b 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 23 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 All code ======== 0: 40 00 48 8b rex add %cl,-0x75(%rax) 4: 15 c1 9b 0d 00 adc $0xd9bc1,%eax 9: f7 d8 neg %eax b: 64 89 02 mov %eax,%fs:(%rdx) e: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 15: eb b7 jmp 0xffffffffffffffce 17: 0f 1f 00 nopl (%rax) 1a: 80 3d a1 23 0e 00 00 cmpb $0x0,0xe23a1(%rip) # 0xe23c2 21: 74 17 je 0x3a 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 58 ja 0x8a 32: c3 ret 33: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 3a: 48 83 ec 28 sub $0x28,%rsp 3e: 48 rex.W 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 58 ja 0x60 8: c3 ret 9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 10: 48 83 ec 28 sub $0x28,%rsp 14: 48 rex.W 15: 89 .byte 0x89 kern :warn : [ 377.667929] RSP: 002b:00007ffd8d96db68 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 kern :warn : [ 377.676231] RAX: ffffffffffffffda RBX: 0000000000001000 RCX: 00007f287cd67240 kern :warn : [ 377.684089] RDX: 0000000000001000 RSI: 0000562f0070cf18 RDI: 0000000000000005 kern :warn : [ 377.691953] RBP: 0000562f0070b058 R08: 0000000000000000 R09: 0000000000000075 kern :warn : [ 377.699805] R10: 00000000000001c0 R11: 0000000000000202 R12: 0000562f0070ce08 kern :warn : [ 377.707660] R13: 000000000011f8ec R14: 00007ffd8d96dbf0 R15: 0000000000000005 kern :warn : [ 377.715522] </TASK> kern :err : [ 379.995791] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:321 kern :err : [ 380.005158] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 4784, name: fallocate05 kern :err : [ 380.014176] preempt_count: 1, expected: 0 kern :err : [ 380.018931] RCU nest depth: 0, expected: 0 kern :warn : [ 380.023773] CPU: 1 UID: 0 PID: 4784 Comm: fallocate05 Tainted: G S W 6.12.0-rc4-00129-gd83bdef3f16d #1 kern :warn : [ 380.035011] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN kern :warn : [ 380.040515] Hardware name: Hewlett-Packard HP Pro 3340 MT/17A1, BIOS 8.07 01/24/2013 kern :warn : [ 380.048964] Call Trace: kern :warn : [ 380.052128] <TASK> kern :warn : [ 380.054943] dump_stack_lvl (lib/dump_stack.c:123 (discriminator 1)) kern :warn : [ 380.059321] __might_resched (kernel/sched/core.c:8654) kern :warn : [ 380.063957] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.069112] ? __find_get_block (include/linux/buffer_head.h:324 fs/buffer.c:1352 fs/buffer.c:1406 fs/buffer.c:1398) kern :warn : [ 380.074008] __bread_gfp (include/linux/kernel.h:73 include/linux/sched/mm.h:321 fs/buffer.c:1433 fs/buffer.c:1491) kern :warn : [ 380.078211] ? generic_perform_write (mm/filemap.c:4056) kern :warn : [ 380.083544] fat_ent_bread (fs/fat/fatent.c:109 (discriminator 3)) fat kern :warn : [ 380.088535] fat_ent_read (fs/fat/fatent.c:369) fat kern :warn : [ 380.093431] ? __pfx_fat_ent_read (fs/fat/fatent.c:350) fat kern :warn : [ 380.098847] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.103396] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 380.108467] fat_get_cluster (fs/fat/cache.c:267) fat kern :warn : [ 380.113714] ? kasan_save_track (arch/x86/include/asm/current.h:49 mm/kasan/common.c:60 mm/kasan/common.c:69) kern :warn : [ 380.118438] ? __pfx_fat_get_cluster (fs/fat/cache.c:226) fat kern :warn : [ 380.124121] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.128669] ? _raw_spin_lock (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) kern :warn : [ 380.133222] ? __pfx__raw_spin_lock (kernel/locking/spinlock.c:153) kern :warn : [ 380.138290] ? __mark_inode_dirty (fs/fs-writeback.c:2519) kern :warn : [ 380.143358] fat_free+0x47b/0x830 fat kern :warn : [ 380.148518] ? __pfx_fat_free+0x10/0x10 fat kern :warn : [ 380.154205] ? unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.159272] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.164774] ? __pfx_unmap_mapping_range (mm/memory.c:3860) kern :warn : [ 380.170279] fat_truncate_blocks (fs/fat/file.c:407 (discriminator 3)) fat kern :warn : [ 380.175792] fat_write_begin (fs/fat/inode.c:218 fs/fat/inode.c:232) fat kern :warn : [ 380.180868] generic_perform_write (mm/filemap.c:4056) kern :warn : [ 380.186024] ? inode_io_list_move_locked (arch/x86/include/asm/bitops.h:206 arch/x86/include/asm/bitops.h:238 include/asm-generic/bitops/instrumented-non-atomic.h:142 include/linux/backing-dev.h:51 fs/fs-writeback.c:87 fs/fs-writeback.c:130) kern :warn : [ 380.191703] ? __pfx_generic_perform_write (mm/filemap.c:4018) kern :warn : [ 380.197379] ? fat_update_time (fs/fat/misc.c:359) fat kern :warn : [ 380.202544] ? file_update_time (fs/inode.c:2383) kern :warn : [ 380.207440] generic_file_write_iter (include/linux/fs.h:821 mm/filemap.c:4184) kern :warn : [ 380.212682] vfs_write (fs/read_write.c:590 fs/read_write.c:683) kern :warn : [ 380.216799] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.221956] ? __pfx_vfs_write (fs/read_write.c:664) kern :warn : [ 380.226592] ? __pfx___might_resched (kernel/sched/core.c:8608) kern :warn : [ 380.231750] ? fdget_pos (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/file_ref.h:171 fs/file.c:1181 fs/file.c:1189) kern :warn : [ 380.236041] ksys_write (fs/read_write.c:736) kern :warn : [ 380.240156] ? __pfx_ksys_write (fs/read_write.c:726) kern :warn : [ 380.244880] ? switch_fpu_return (arch/x86/include/asm/bitops.h:75 include/asm-generic/bitops/instrumented-atomic.h:42 include/linux/thread_info.h:94 arch/x86/kernel/fpu/context.h:79 arch/x86/kernel/fpu/core.c:787) kern :warn : [ 380.249777] do_syscall_64 (arch/x86/entry/common.c:52 arch/x86/entry/common.c:83) kern :warn : [ 380.254159] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) kern :warn : [ 380.259924] RIP: 0033:0x7f287cd67240 kern :warn : [ 380.264217] Code: 40 00 48 8b 15 c1 9b 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d a1 23 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 All code ======== 0: 40 00 48 8b rex add %cl,-0x75(%rax) 4: 15 c1 9b 0d 00 adc $0xd9bc1,%eax 9: f7 d8 neg %eax b: 64 89 02 mov %eax,%fs:(%rdx) e: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax 15: eb b7 jmp 0xffffffffffffffce 17: 0f 1f 00 nopl (%rax) 1a: 80 3d a1 23 0e 00 00 cmpb $0x0,0xe23a1(%rip) # 0xe23c2 21: 74 17 je 0x3a 23: b8 01 00 00 00 mov $0x1,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 58 ja 0x8a 32: c3 ret 33: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 3a: 48 83 ec 28 sub $0x28,%rsp 3e: 48 rex.W 3f: 89 .byte 0x89 Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 58 ja 0x60 8: c3 ret 9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 10: 48 83 ec 28 sub $0x28,%rsp 14: 48 rex.W 15: 89 .byte 0x89 kern :warn : [ 380.283678] RSP: 002b:00007ffd8d96db68 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 kern :warn : [ 380.291958] RAX: ffffffffffffffda RBX: 0000000000001000 RCX: 00007f287cd67240 kern :warn : [ 380.299803] RDX: 0000000000001000 RSI: 0000562f0070cf18 RDI: 0000000000000005 kern :warn : [ 380.307644] RBP: 0000562f0070b058 R08: 00007f287cc6c6c0 R09: 0000000000000075 kern :warn : [ 380.315488] R10: 00007f287cc85b98 R11: 0000000000000202 R12: 0000562f0070ce08 kern :warn : [ 380.323330] R13: 000000000008fc76 R14: 00007ffd8d96dbf0 R15: 0000000000000005 kern :warn : [ 380.331176] </TASK> The kernel config and materials to reproduce are available at: https://download.01.org/0day-ci/archive/20241105/202411051037.304ba029-oliver.sang@intel.com -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-11-05 2:39 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2024-10-28 20:26 [PATCH] Fix BUG: KCSAN: data-race in fat16_ent_get / fat16_ent_put Daniel Yang 2024-10-29 3:21 ` OGAWA Hirofumi 2024-11-05 2:39 ` [LTP] " kernel test robot 2024-11-05 2:39 ` kernel test robot
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.