syzbot


KCSAN: data-race in snd_fasync_helper / snd_timer_user_ccallback

Status: moderation: reported on 2024/03/28 17:08
Subsystems: sound
[Documentation on labels]
Reported-by: syzbot+29f860c5b65d73753038@syzkaller.appspotmail.com
First crash: 23d, last: 23d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_fasync_helper / snd_timer_user_ccallback

write to 0xffff888113b968c8 of 8 bytes by task 12923 on cpu 1:
 snd_fasync_helper+0xd2/0x130 sound/core/misc.c:210
 snd_timer_user_fasync+0x3a/0x50 sound/core/timer.c:2066
 ioctl_fioasync fs/ioctl.c:380 [inline]
 do_vfs_ioctl+0xe7c/0x1560 fs/ioctl.c:819
 __do_sys_ioctl fs/ioctl.c:902 [inline]
 __se_sys_ioctl+0x81/0x150 fs/ioctl.c:890
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:890
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

read to 0xffff888113b968c8 of 8 bytes by task 12924 on cpu 0:
 snd_timer_user_ccallback+0x24b/0x290 sound/core/timer.c:1338
 snd_timer_notify1+0x12d/0x240 sound/core/timer.c:514
 snd_timer_start1+0x396/0x3c0 sound/core/timer.c:569
 snd_timer_start sound/core/timer.c:665 [inline]
 snd_timer_user_start+0x10d/0x160 sound/core/timer.c:1915
 __snd_timer_user_ioctl+0x3ee/0x2450
 snd_timer_user_ioctl+0x4b/0x80 sound/core/timer.c:2058
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:904 [inline]
 __se_sys_ioctl+0xd3/0x150 fs/ioctl.c:890
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:890
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x6d/0x75

value changed: 0x0000000000000000 -> 0xffff888138986c40

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 12924 Comm: syz-executor.4 Not tainted 6.9.0-rc1-syzkaller-00061-g8d025e2092e2 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/28 17:07 upstream 8d025e2092e2 e91187ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in snd_fasync_helper / snd_timer_user_ccallback
* Struck through repros no longer work on HEAD.