syzbot


DATA RACE in fs.(*Dirent).IncRef

Status: fixed on 2020/02/27 21:02
Reported-by: syzbot+4fc127b0a9a855509eb3@syzkaller.appspotmail.com
Fix commit: 53504e29ca27 Fix mount refcount issue.
First crash: 1759d, last: 1759d

Sample crash report:
WARNING: DATA RACE
Read at 0x00c0008f4470 by goroutine 334:
  gvisor.dev/gvisor/pkg/sentry/fs.(*Dirent).IncRef()
      pkg/sentry/fs/dirent.go:1308 +0x47
  gvisor.dev/gvisor/pkg/sentry/fs/proc.forEachMount()
      pkg/sentry/fs/mounts.go:106 +0x2e8
  gvisor.dev/gvisor/pkg/sentry/fs/proc.(*mountsFile).ReadSeqFileData()
      pkg/sentry/fs/proc/mounts.go:198 +0xd0
  gvisor.dev/gvisor/pkg/sentry/fs/proc/seqfile.(*SeqFile).updateSourceLocked()
      pkg/sentry/fs/proc/seqfile/seqfile.go:180 +0x12c
  gvisor.dev/gvisor/pkg/sentry/fs/proc/seqfile.(*seqFileOperations).Read()
      pkg/sentry/fs/proc/seqfile/seqfile.go:229 +0xf03
  gvisor.dev/gvisor/pkg/sentry/fs.(*File).Readv()
      pkg/sentry/fs/file.go:270 +0x22f
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.readv()
      pkg/sentry/syscalls/linux/sys_read.go:290 +0xe0
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Read()
      pkg/sentry/syscalls/linux/sys_read.go:70 +0x2ab
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:170 +0x455
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:291 +0xb4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:252 +0x109
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:227 +0x1b3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:232 +0x1aaf
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:92 +0x308

Previous write at 0x00c0008f4470 by goroutine 267:
  gvisor.dev/gvisor/pkg/sentry/fs.(*Dirent).destroy()
      pkg/sentry/fs/dirent.go:1295 +0x298
  gvisor.dev/gvisor/pkg/sentry/fs.(*Dirent).destroy-fm()
      pkg/sentry/fs/dirent.go:1262 +0x41
  gvisor.dev/gvisor/pkg/refs.(*AtomicRefCount).DecRefWithDestructor()
      pkg/refs/refcounter.go:459 +0x299
  gvisor.dev/gvisor/pkg/sentry/fs.(*Dirent).DecRef()
      pkg/sentry/fs/dirent.go:1330 +0xfe
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.fileOpOn()
      pkg/sentry/syscalls/linux/sys_file.go:112 +0x267
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Umount2()
      pkg/sentry/syscalls/linux/sys_mount.go:151 +0x1af
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:170 +0x455
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:291 +0xb4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:252 +0x109
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:227 +0x1b3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:232 +0x1aaf
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:92 +0x308

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/01 17:30 https://gvisor.googlesource.com/gvisor master 02997af5abd6 326d4c78 .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
* Struck through repros no longer work on HEAD.