DATA RACE in atomic.CompareAndSwapInt32 (4)

Status: fixed on 2021/07/22 02:46
Reported-by: syzbot+59550b48e06cc0d3b638@syzkaller.appspotmail.com
Fix commit: a89b2f005b71 Use atomics when checking for parent setgid in VFS2 tmpfs file creation.
First crash: 1877d, last: 1877d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor DATA RACE in atomic.CompareAndSwapInt32 (2) -1 syz 2 2707d 2707d 0/26 fixed on 2019/04/04 10:15
gvisor DATA RACE in atomic.CompareAndSwapInt32 -1 syz, C 9 2712d 2725d 0/26 fixed on 2019/04/01 09:44

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000a2c888 by goroutine 289:
  sync/atomic.CompareAndSwapInt32()
      src/runtime/race_amd64.s:321 +0xb
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).setStat()
      pkg/sentry/fsimpl/tmpfs/tmpfs.go:624 +0x371
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*fileDescription).SetStat()
      pkg/sentry/fsimpl/tmpfs/tmpfs.go:813 +0xfc
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*directoryFD).SetStat()
      <autogenerated>:1 +0xe4
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).SetStat()
      pkg/sentry/vfs/file_description.go:548 +0x401
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Fchown()
      pkg/sentry/syscalls/linux/vfs2/setstat.go:161 +0x297
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:104 +0x452
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:239 +0xb3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:199 +0x10e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:174 +0x213
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:282 +0x12c6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x392

Previous read at 0x00c000a2c888 by goroutine 317:
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*inode).init()
      pkg/sentry/fsimpl/tmpfs/tmpfs.go:400 +0x289
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).newRegularFile()
      pkg/sentry/fsimpl/tmpfs/regular_file.go:102 +0x172
  gvisor.dev/gvisor/pkg/sentry/fsimpl/tmpfs.(*filesystem).OpenAt()
      pkg/sentry/fsimpl/tmpfs/filesystem.go:391 +0xca6
  gvisor.dev/gvisor/pkg/sentry/vfs.(*VirtualFilesystem).OpenAt()
      pkg/sentry/vfs/vfs.go:445 +0x306
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.openat()
      pkg/sentry/syscalls/linux/vfs2/filesystem.go:180 +0x33c
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Creat()
      pkg/sentry/syscalls/linux/vfs2/filesystem.go:166 +0x66
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:104 +0x452
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:239 +0xb3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:199 +0x10e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:174 +0x213
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:282 +0x12c6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x392

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/07/10 13:57 gvisor d78713e2da53 8f5a7b8c .config console log report syz ci-gvisor-ptrace-1-race DATA RACE in atomic.CompareAndSwapInt32
2021/07/10 11:33 gvisor d78713e2da53 8f5a7b8c .config console log report syz ci-gvisor-ptrace-2-race DATA RACE in atomic.CompareAndSwapInt32
2021/07/10 11:14 gvisor d78713e2da53 8f5a7b8c .config console log report syz ci-gvisor-ptrace-3-race DATA RACE in atomic.CompareAndSwapInt32
2021/07/10 09:51 gvisor d78713e2da53 8f5a7b8c .config console log report info ci-gvisor-ptrace-3-race DATA RACE in atomic.CompareAndSwapInt32
* Struck through repros no longer work on HEAD.