syzbot


KCSAN: data-race in hrtimer_interrupt / print_tickdevice (13)

Status: moderation: reported on 2024/08/08 20:03
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+448eec3607c33220e0fb@syzkaller.appspotmail.com
First crash: 34d, last: 28d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (6) kernel 5 782d 805d 0/27 auto-closed as invalid on 2022/08/27 09:49
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (8) kernel 3 653d 676d 0/27 auto-obsoleted due to no activity on 2023/01/03 04:47
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (4) kernel 14 917d 1083d 0/27 auto-closed as invalid on 2022/04/13 14:16
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (2) kernel 3 1218d 1223d 0/27 auto-closed as invalid on 2021/06/16 18:46
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (10) kernel 1 379d 379d 0/27 auto-obsoleted due to no activity on 2023/10/04 07:33
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (5) kernel 2 855d 855d 0/27 auto-closed as invalid on 2022/06/15 02:31
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (7) kernel 1 726d 726d 0/27 auto-obsoleted due to no activity on 2022/10/22 07:07
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (11) kernel 2 263d 276d 0/27 auto-obsoleted due to no activity on 2024/01/28 02:00
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (3) kernel 2 1132d 1168d 0/27 auto-closed as invalid on 2021/09/10 15:52
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice kernel 1 1334d 1334d 0/27 auto-closed as invalid on 2021/02/20 21:54
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (12) kernel 1 133d 133d 0/27 auto-obsoleted due to no activity on 2024/06/05 19:29
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (9) kernel 20 445d 594d 0/27 auto-obsoleted due to no activity on 2023/07/30 02:27

Sample crash report:
==================================================================
BUG: KCSAN: data-race in hrtimer_interrupt / print_tickdevice

write to 0xffff888237c1c218 of 8 bytes by interrupt on cpu 0:
 hrtimer_interrupt+0x80/0x7b0 kernel/time/hrtimer.c:1794
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 should_watch kernel/kcsan/core.c:280 [inline]
 check_access kernel/kcsan/core.c:752 [inline]
 __tsan_read4+0x114/0x180 kernel/kcsan/core.c:1024
 map_id_up kernel/user_namespace.c:381 [inline]
 from_kuid+0x2f/0x340 kernel/user_namespace.c:433
 i_uid_read include/linux/fs.h:1366 [inline]
 ext4_fill_raw_inode+0x1bc/0xe80 fs/ext4/inode.c:4315
 ext4_do_update_inode fs/ext4/inode.c:5151 [inline]
 ext4_mark_iloc_dirty+0x2e9/0xe10 fs/ext4/inode.c:5781
 __ext4_mark_inode_dirty+0x314/0x440 fs/ext4/inode.c:5985
 ext4_dirty_inode+0x91/0xb0 fs/ext4/inode.c:6014
 __mark_inode_dirty+0x16d/0x7e0 fs/fs-writeback.c:2486
 mark_inode_dirty_sync include/linux/fs.h:2436 [inline]
 dquot_free_space include/linux/quotaops.h:380 [inline]
 dquot_free_block include/linux/quotaops.h:390 [inline]
 ext4_xattr_block_set+0xd2b/0x1ca0 fs/ext4/xattr.c:2081
 ext4_xattr_set_handle+0x8ac/0xbf0 fs/ext4/xattr.c:2458
 ext4_initxattrs+0x60/0xb0 fs/ext4/xattr_security.c:44
 security_inode_init_security+0x19d/0x290 security/security.c:1744
 ext4_init_security+0x34/0x40 fs/ext4/xattr_security.c:58
 __ext4_new_inode+0x2000/0x2200 fs/ext4/ialloc.c:1326
 ext4_create+0x172/0x2f0 fs/ext4/namei.c:2832
 lookup_open fs/namei.c:3578 [inline]
 open_last_lookups fs/namei.c:3647 [inline]
 path_openat+0xdbc/0x1f10 fs/namei.c:3883
 do_filp_open+0xf7/0x200 fs/namei.c:3913
 do_sys_openat2+0xab/0x120 fs/open.c:1416
 do_sys_open fs/open.c:1431 [inline]
 __do_sys_creat fs/open.c:1507 [inline]
 __se_sys_creat fs/open.c:1501 [inline]
 __x64_sys_creat+0x66/0x90 fs/open.c:1501
 x64_sys_call+0x2cbf/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:86
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c1c218 of 8 bytes by task 9424 on cpu 1:
 print_tickdevice+0x144/0x340 kernel/time/timer_list.c:208
 timer_list_show+0x79/0x180 kernel/time/timer_list.c:300
 seq_read_iter+0x65b/0x940 fs/seq_file.c:272
 proc_reg_read_iter+0x11e/0x190 fs/proc/inode.c:299
 copy_splice_read+0x3a4/0x5d0 fs/splice.c:365
 do_splice_read fs/splice.c:985 [inline]
 splice_direct_to_actor+0x26c/0x670 fs/splice.c:1089
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0xd7/0x150 fs/splice.c:1233
 do_sendfile+0x3ab/0x950 fs/read_write.c:1295
 __do_sys_sendfile64 fs/read_write.c:1362 [inline]
 __se_sys_sendfile64 fs/read_write.c:1348 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1348
 x64_sys_call+0xed5/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000028cd7b02da -> 0x7fffffffffffffff

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9424 Comm: syz.3.1237 Not tainted 6.11.0-rc3-syzkaller-00060-gd07b43284ab3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
==================================================================
netlink: 16 bytes leftover after parsing attributes in process `syz.3.1237'.

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/15 01:50 upstream d07b43284ab3 e6b88e20 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_interrupt / print_tickdevice
2024/08/08 20:03 upstream cf6d429eb656 61405512 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_interrupt / print_tickdevice
* Struck through repros no longer work on HEAD.