KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (12)

Status: fixed on 2025/05/06 15:33
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+3c750be01dab672c513d@syzkaller.appspotmail.com
Fix commit: a13030fd194c io_uring: simplify the SQPOLL thread check when cancelling requests
First crash: 594d, last: 563d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH v2] io_uring: simplify the SQPOLL thread check when cancelling requests 3 (3) 2025/01/13 22:30
[PATCH] io_uring: simplify the SQPOLL thread check when cancelling requests 7 (7) 2025/01/13 15:33
[PATCH] io_uring: annotate sqd->thread access with data race in cancel path 6 (6) 2025/01/12 11:34
[PATCH] io_uring/sqpoll: annotate data race for access in debug check 3 (3) 2025/01/08 16:42
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (3) fs 6 2 1729d 1737d 0/29 auto-closed as invalid on 2021/12/05 08:50
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (5) fs 6 2 1569d 1573d 0/29 auto-closed as invalid on 2022/05/14 09:20
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (10) io-uring 6 1 815d 815d 0/29 auto-obsoleted due to no activity on 2024/06/06 09:26
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (2) fs 6 1 1836d 1836d 0/29 auto-closed as invalid on 2021/08/20 00:41
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (4) fs 6 3 1619d 1648d 0/29 auto-closed as invalid on 2022/03/25 11:59
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests fs 6 1 1904d 1904d 0/29 auto-closed as invalid on 2021/06/13 15:29
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (9) io-uring 6 2 888d 906d 0/29 auto-obsoleted due to no activity on 2024/03/25 07:41
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (8) io-uring 6 1 977d 957d 0/29 auto-obsoleted due to no activity on 2023/12/27 04:40
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (11) io-uring 6 1 757d 757d 0/29 auto-obsoleted due to no activity on 2024/08/03 17:56
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (7) io-uring 6 1 1046d 1041d 0/29 auto-obsoleted due to no activity on 2023/10/18 23:09
upstream KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests (6) io-uring 6 2 1443d 1466d 0/29 auto-closed as invalid on 2022/09/17 04:56

Sample crash report:
==================================================================
BUG: KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests

write to 0xffff888116bd30f8 of 8 bytes by task 22779 on cpu 1:
 io_sq_thread+0xe68/0x10b0 io_uring/sqpoll.c:378
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888116bd30f8 of 8 bytes by task 3431 on cpu 0:
 io_uring_try_cancel_requests+0x18d/0x340 io_uring/io_uring.c:3099
 io_ring_exit_work+0x148/0x500 io_uring/io_uring.c:2901
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0xffff888138eea100 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3431 Comm: kworker/u8:7 Not tainted 6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: iou_exit io_ring_exit_work
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/09 13:22 upstream eea6e4b4dfb8 9220929f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests
2024/12/25 22:09 upstream 9b2ffa6148b1 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests
2024/12/09 09:07 upstream fac04efc5c79 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests
2024/12/09 02:33 upstream 62b5a46999c7 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_sq_thread / io_uring_try_cancel_requests
* Struck through repros no longer work on HEAD.