From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0F1E8C77B61 for ; Mon, 24 Apr 2023 13:21:26 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 65D546B0071; Mon, 24 Apr 2023 09:21:26 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 60E676B0074; Mon, 24 Apr 2023 09:21:26 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4FD7B6B0075; Mon, 24 Apr 2023 09:21:26 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 424B86B0071 for ; Mon, 24 Apr 2023 09:21:26 -0400 (EDT) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id E4695160125 for ; Mon, 24 Apr 2023 13:21:25 +0000 (UTC) X-FDA: 80716346130.10.E4B7CB9 Received: from casper.infradead.org (casper.infradead.org [90.155.50.34]) by imf25.hostedemail.com (Postfix) with ESMTP id 4D17AA0033 for ; Mon, 24 Apr 2023 13:21:22 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=rpLSG38k; spf=none (imf25.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682342484; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=tO4JNHQLVQVuoKsDjBtbTMPAx+2bd2jzQfdk7G2t26M=; b=WrpOQ7UvBjsBfqdCYdbu5FjM5Y5rdOGAQLw9RdEPpT+7QxHVMzZCKFZF92yiVZnaLiJ+tW 0sDx6zIHYkxAOeToEAqSrnh6Uyhfs7yhNlpS4fYjlxQfy5RLOEDDJpHC0TqZP1G1khxMNv Q3iRTH8JFCRlxSEDjBtm5Rjk/RU8c1Q= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=infradead.org header.s=casper.20170209 header.b=rpLSG38k; spf=none (imf25.hostedemail.com: domain of willy@infradead.org has no SPF policy when checking 90.155.50.34) smtp.mailfrom=willy@infradead.org; dmarc=none ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1682342484; a=rsa-sha256; cv=none; b=ZOaOWLrSwVR8V/MtWrkcpyvUSbp8cpDtEdDZWsry32flZN3+WkA2dlqsWl/BZn1aPSL5Yg AQWUwoOfjqv8HL3WM8cQbqOpVcGBCUO06k66W8UKHDJzRHvB+Ow3i82LNMk+nXihLlmw0O zG0CotvsJABtSMUoS+35ky/0fkxhEKU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=tO4JNHQLVQVuoKsDjBtbTMPAx+2bd2jzQfdk7G2t26M=; b=rpLSG38kag+bEQnWP1v8wMz1+A LVbvLapSdQCAHXV7K0Yh5Bz+4/27DgRw8/XygDxiwxj119Df4qS1AFGgbNJ2+4x16NpihFJuUMCBa vYSSxWAaStQi34MAUGeOnLZ525S6moQui93HP0NmV/UAQ41G42rjM0+lVdUnSExrT5b6VMcqzODYg qLa3mo/haylcWppPSSvWCslZOW1egkN9ggDnVhL2BTCYqGL8KP/Ry/xi1LZqfhn1/cak1LQ1rQ7ST eDIKX/6jnlnPQ9diREUKx++smyRq/tkvEnJ1moozUN3Q+P19rqiFgmi+qXlGZwErAboJdB9qlROiR GXqrw5MA==; Received: from willy by casper.infradead.org with local (Exim 4.94.2 #2 (Red Hat Linux)) id 1pqw81-000TyJ-EG; Mon, 24 Apr 2023 13:21:13 +0000 Date: Mon, 24 Apr 2023 14:21:13 +0100 From: Matthew Wilcox To: Dmitry Vyukov Cc: syzbot , djwong@kernel.org, hch@infradead.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-xfs@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [fs?] [mm?] KCSAN: data-race in __filemap_remove_folio / folio_mapping (2) Message-ID: References: <000000000000d0737c05fa0fd499@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspam-User: X-Rspamd-Server: rspam03 X-Stat-Signature: 7g51qarosa5n6cejgffats1544k14btk X-Rspamd-Queue-Id: 4D17AA0033 X-HE-Tag: 1682342482-224802 X-HE-Meta: U2FsdGVkX19sYjxj+PhCzhB+1+niCTRM2vINn7GJv1xo9WltxmZ3hReNPzUNzR2ZBq1oH2s1EAEaH7kFleQdgy4kYD7LgY0JIXXruIu2ZTniu2iF+Iz6JJCy1qykZ1ARH1vLX/4XUBvzcZp3D/AquJAGwPFd7WCZOaDC/9w0gNi/ZyYnQOsFvLqWTZ1pqhHK9QOMnq4LLlYcn5+Qhv+QNh9vAJXHhzvm6QdgXz/JyWJG6geIzH+l1KqvWRFJ11cF/82dGQLvLUdhSDkvmPE2+2/MMppAHM+KNwFN9YpO/Zu9nFsLo37E/XFTn55rFOPdO7xK5Tzpq5MBHqpyfnFENz6vJ1TGQUAUu8cWQWYkass2v4BiyNfw2KiBohW0a12TqqLA+LdtzyascyBIebqJ9vLqYI7u2+elM1nzzHTrD75yD+m4YnHh7m+EBPZE1MenCd+BEe23/kG6hIKCTyWBbG9gKVvXlq3bQBpFucq6RSM+EJolDahpw7U1lBNWnwbSOrIKx/cBz9TiF5WlYOHMtQHB1/j6+Xxa9am84K+PzpeHbiIS1hBPwMzwTKOe/xS0pj6ZpWeQSj2u2vBkWoAR1JCt5VXynHaoMbafc0YMUaCWPyWFloNIZG6joHARvz6GNBvH3FlaSJier2mn7qAJZ7I6dO6AbxwzR664pG62C2cjrr+qu6BTg33FZpZ+GNwpLMfFPAxmTZ/51wy95+b+1t2SMWtyGYOcGv61dHUM5E7ojsMPtmbc0mZS4uifgFH/tzlriTRnAjkRDkmJjq+PPNRTxvf4QD1lldCR3K1F9Rre7vrhFLFaXrHmf/QWcTTS8eyGNubT395oUJm6J5+KKurm+wTBkWcRCPFfbj/MvO+tVO3qz8sbIT0pF61ptfV9em0Kxzv1zEZY9LeT8lrtQw+CDUES+vdH6+bcun4doCu92Lr3oLfHJ0VkUPF6IeZVDoNwKQdN4sCeo3OoOx6 5rVJf0fa MLWeR408ioBTCvYZeCRaDS1qqqBEE6z6S+YkXoZZ5opNMYaEeO0NIfMsSZK6p5DCgFGgFUXq1X/6bKM2t/pTyBS+Vqk+kFHIM6OENg6/TXvZGF+MCR75LhVesAeXzyOZdk0wHesc4CkWOfzJiFCmOlys9/a+XL7aqAR7nnCb5DrLSHCH55kme0suEv5Bqucu85JR737Q3PwF7uBnBwAiUEqao2FIJrBklRcCm3M4FDT9IPcL6ZM9oytOP+mjgcYWr4lUzIXg6MVBhM0MUIGqFI3/Q49Fju4/wIyqZdEOEODj5UuCy3fomV8BU9tkyPtI5ZkJxrXTWGXYKS3Jc1TKUrG8HgF5bf4+nJPgbCCf4FZ+JFTPAndr+0gQdGwj//Ahx00cx X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Apr 24, 2023 at 09:38:43AM +0200, Dmitry Vyukov wrote: > On Mon, 24 Apr 2023 at 09:19, syzbot > wrote: > If I am reading this correctly, it can lead to NULL derefs in > folio_mapping() if folio->mapping is read twice. I think > folio->mapping reads/writes need to use READ/WRITE_ONCE if racy. You aren't reading it correctly. mapping = folio->mapping; if ((unsigned long)mapping & PAGE_MAPPING_FLAGS) return NULL; return mapping; The racing write is storing NULL. So it might return NULL or it might return the old mapping, or it might return NULL. Either way, the caller has to be prepared for NULL to be returned. It's a false posiive, but probably worth silencing with a READ_ONCE().