syzbot


KCSAN: data-race in tick_nohz_handler / tick_nohz_idle_stop_tick

Status: moderation: reported on 2024/04/06 12:46
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+0a160723683a406a5d65@syzkaller.appspotmail.com
First crash: 24d, last: 19d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in tick_nohz_handler / tick_nohz_idle_stop_tick

write to 0xffffffff865332f0 of 4 bytes by interrupt on cpu 0:
 tick_sched_do_timer kernel/time/tick-sched.c:224 [inline]
 tick_nohz_handler+0x2bc/0x2d0 kernel/time/tick-sched.c:287
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
 hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1818
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 is_atomic kernel/kcsan/core.c:260 [inline]
 should_watch kernel/kcsan/core.c:277 [inline]
 check_access kernel/kcsan/core.c:752 [inline]
 __tsan_read4+0xf8/0x180 kernel/kcsan/core.c:1024
 p9_client_rpc+0x327/0x710 net/9p/client.c:721
 p9_client_flush+0x15a/0x220 net/9p/client.c:606
 p9_client_rpc+0x59e/0x710 net/9p/client.c:738
 p9_client_create+0x6d8/0xa80 net/9p/client.c:1031
 v9fs_session_init+0xf9/0xda0 fs/9p/v9fs.c:410
 v9fs_mount+0x69/0x560 fs/9p/vfs_super.c:122
 legacy_get_tree+0x77/0xd0 fs/fs_context.c:662
 vfs_get_tree+0x56/0x1d0 fs/super.c:1779
 do_new_mount+0x227/0x690 fs/namespace.c:3352
 path_mount+0x49b/0xb30 fs/namespace.c:3679
 do_mount fs/namespace.c:3692 [inline]
 __do_sys_mount fs/namespace.c:3898 [inline]
 __se_sys_mount+0x27f/0x2d0 fs/namespace.c:3875
 __x64_sys_mount+0x67/0x80 fs/namespace.c:3875
 x64_sys_call+0x2591/0x2d30 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff865332f0 of 4 bytes by task 0 on cpu 1:
 tick_nohz_stop_tick kernel/time/tick-sched.c:1010 [inline]
 tick_nohz_idle_stop_tick+0x19e/0x640 kernel/time/tick-sched.c:1218
 cpuidle_idle_call kernel/sched/idle.c:232 [inline]
 do_idle+0x178/0x230 kernel/sched/idle.c:332
 cpu_startup_entry+0x25/0x30 kernel/sched/idle.c:430
 start_secondary+0x94/0xa0 arch/x86/kernel/smpboot.c:313
 common_startup_64+0x12c/0x137

value changed: 0xffffffff -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G        W          6.9.0-rc3-syzkaller-00023-g2c71fdf02a95 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/10 21:39 upstream 2c71fdf02a95 4320ec32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in tick_nohz_handler / tick_nohz_idle_stop_tick
2024/04/06 12:46 upstream 104db052b62d ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in tick_nohz_handler / tick_nohz_idle_stop_tick
* Struck through repros no longer work on HEAD.