syzbot


KCSAN: data-race in io_sq_thread / io_sq_thread_park (9)

Status: upstream: reported on 2024/08/13 08:50
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+2b946a3fd80caf971b21@syzkaller.appspotmail.com
Fix commit: e4956dc7a84d io_uring/sqpoll: annotate debug task == current with data_race()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 37d, last: 37d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9) 2 (4) 2024/08/13 12:17
[PATCH] io_uring/sqpoll: annotate debug task == current with data_race() 1 (1) 2024/08/13 12:16
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (5) io-uring 1 503d 503d 0/28 auto-obsoleted due to no activity on 2023/06/04 19:25
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park fs 13 832d 999d 0/28 auto-closed as invalid on 2022/07/10 14:43
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (4) io-uring 4 555d 597d 0/28 auto-obsoleted due to no activity on 2023/04/20 22:18
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (8) io-uring 2 218d 244d 0/28 auto-obsoleted due to no activity on 2024/03/15 14:43
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (2) io-uring 5 760d 796d 0/28 auto-closed as invalid on 2022/09/20 09:21
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (6) io-uring 4 404d 450d 0/28 auto-obsoleted due to no activity on 2023/09/11 04:02
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (7) io-uring 2 296d 278d 0/28 auto-obsoleted due to no activity on 2023/12/28 08:55
upstream KCSAN: data-race in io_sq_thread / io_sq_thread_park (3) io-uring 2 692d 720d 0/28 auto-obsoleted due to no activity on 2022/11/26 22:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in io_sq_thread / io_sq_thread_park

write to 0xffff888111459638 of 8 bytes by task 10761 on cpu 1:
 io_sq_thread+0xdab/0xff0 io_uring/sqpoll.c:383
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888111459638 of 8 bytes by task 10329 on cpu 0:
 io_sq_thread_park+0x1b/0x80 io_uring/sqpoll.c:47
 io_ring_exit_work+0x197/0x500 io_uring/io_uring.c:2786
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
 worker_thread+0x526/0x700 kernel/workqueue.c:3390
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0xffff8881223d0000 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10329 Comm: kworker/u8:8 Not tainted 6.11.0-rc2-syzkaller-00027-g6a0e38264012 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: iou_exit io_ring_exit_work
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/08 16:34 upstream 6a0e38264012 61405512 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_sq_thread / io_sq_thread_park
* Struck through repros no longer work on HEAD.