syzbot

 sign-in | mailing list | source | docs
🐞 Open [41]
🐞 Fixed [469]
🐞 Invalid [348]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

DATA RACE in atomic.CompareAndSwapInt32

Status: fixed on 2019/04/01 09:44
Reported-by: syzbot+5b3875602768f4e9102b@syzkaller.appspotmail.com
Fix commit: cea1dd7d21b9 Remove racy access to shm fields.
First crash: 2091d, last: 2070d
▶ ▼ Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor DATA RACE in atomic.CompareAndSwapInt32 (4) syz 4 1235d 1228d 14/26 fixed on 2021/07/22 02:46
gvisor DATA RACE in atomic.CompareAndSwapInt32 (2) syz 2 2065d 2065d 0/26 fixed on 2019/04/04 10:15

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000329718 by goroutine 146:
  sync/atomic.CompareAndSwapInt32()
      bazel-out/k8-fastbuild/bin/external/io_bazel_rules_go/linux_amd64_static_race_stripped/stdlib%/src/runtime/race_amd64.s:293 +0xb
  sync.(*Mutex).Lock()
      GOROOT/src/sync/mutex.go:74 +0x4d
  gvisor.googlesource.com/gvisor/pkg/sentry/kernel/shm.(*Shm).RemoveMapping()
      pkg/sentry/kernel/shm/shm.go:421 +0x47
  gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).removeVMAsLocked()
      pkg/sentry/mm/vma.go:371 +0x51a
  gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).unmapLocked()
      pkg/sentry/mm/vma.go:346 +0x8b
  gvisor.googlesource.com/gvisor/pkg/sentry/mm.(*MemoryManager).DecUsers()
      pkg/sentry/mm/lifecycle.go:226 +0x27e
  gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*runExitMain).execute()
      pkg/sentry/kernel/task_context.go:64 +0x383
  gvisor.googlesource.com/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:91 +0x2e5

Previous read at 0x00c000329718 by goroutine 179:
  reflect.typedmemmove()
      GOROOT/src/runtime/mbarrier.go:177 +0x0
DIAGNOSIS:
I0314 16:34:44.563224   25908 x:0] ***************************
I0314 16:34:44.563440   25908 x:0] Args: [/syzkaller/managers/ptrace-proxy-sandbox-race/current/image -root /syzkaller/managers/ptrace-proxy-sandbox-race/workdir/gvisor_root -watchdog-action=panic -network=none -debug -platform=ptrace -file-access=shared -network=sandbox debug -stacks ci-gvisor-ptrace-proxy-sandbox-race-2]
I0314 16:34:44.563604   25908 x:0] Git Revision: 2512cc561778b096459182b531eae4e0797e4ec5
I0314 16:34:44.563673   25908 x:0] PID: 25908
I0314 16:34:44.563741   25908 x:0] UID: 0, GID: 0
I0314 16:34:44.563834   25908 x:0] Configuration:
I0314 16:34:44.563888   25908 x:0] 		RootDir: /syzkaller/managers/ptrace-proxy-sandbox-race/workdir/gvisor_root
I0314 16:34:44.563908   25908 x:0] 		Platform: ptrace
I0314 16:34:44.563960   25908 x:0] 		FileAccess: shared, overlay: false
I0314 16:34:44.564008   25908 x:0] 		Network: sandbox, logging: false
I0314 16:34:44.564084   25908 x:0] 		Strace: false, max size: 1024, syscalls: []
I0314 16:34:44.564115   25908 x:0] ***************************
D0314 16:34:44.564262   25908 x:0] Load container "/syzkaller/managers/ptrace-proxy-sandbox-race/workdir/gvisor_root" "ci-gvisor-ptrace-proxy-sandbox-race-2"
D0314 16:34:44.574360   25908 x:0] Signal container "ci-gvisor-ptrace-proxy-sandbox-race-2": signal 0
D0314 16:34:44.574580   25908 x:0] Signal sandbox "ci-gvisor-ptrace-proxy-sandbox-race-2"
D0314 16:34:44.574683   25908 x:0] Connecting to sandbox "ci-gvisor-ptrace-proxy-sandbox-race-2"
D0314 16:34:44.576504   25908 x:0] urpc: successfully marshalled 117 bytes.
D0314 16:34:44.577875   25908 x:0] urpc: unmarshal success.
I0314 16:34:44.578020   25908 x:0] Found sandbox "ci-gvisor-ptrace-proxy-sandbox-race-2", PID: 21455
I0314 16:34:44.578079   25908 x:0] Retrieving sandbox stacks
D0314 16:34:44.578106   25908 x:0] Stacks sandbox "ci-gvisor-ptrace-proxy-sandbox-race-2"
D0314 16:34:44.578139   25908 x:0] Connecting to sandbox "ci-gvisor-ptrace-proxy-sandbox-race-2"
D0314 16:34:44.580237   25908 x:0] urpc: successfully marshalled 36 bytes.
D0314 16:34:44.638531   25908 x:0] urpc: unmarshal success.
I0314 16:34:44.641146   25908 x:0]      *** Stack dump ***
goroutine 343 [running]:
gvisor.googlesource.com/gvisor/pkg/log.Stacks(0x45c001, 0xc000356b40, 0xc00072e180, 0xc0001e9180)
	pkg/log/log.go:259 +0xb6
gvisor.googlesource.com/gvisor/runsc/boot.(*debug).Stacks(0x2388a78, 0x2388a78, 0xc0002ae070, 0x0, 0x0)
	runsc/boot/debug.go:26 +0x38
reflect.Value.call(0xc000356b40, 0xc0003701c0, 0x13, 0x10f8a85, 0x4, 0xc00067feb8, 0x3, 0x3, 0x4a765e, 0xfae420, ...)
	GOROOT/src/reflect/value.go:447 +0x63f
reflect.Value.Call(0xc000356b40, 0xc0003701c0, 0x13, 0xc00067feb8, 0x3, 0x3, 0x0, 0x2388a78, 0x16)
	GOROOT/src/reflect/value.go:308 +0xc1
gvisor.googlesource.com/gvisor/pkg/urpc.(*Server).handleOne(0xc00036e090, 0xc00043a420, 0x0, 0x0)
	pkg/urpc/urpc.go:325 +0x63f
gvisor.googlesource.com/gvisor/pkg/urpc.(*Server).handleRegistered(0xc00036e090, 0xc00043a420, 0xc00036e090, 0xc00043a420)
	pkg/urpc/urpc.go:420 +0x43
gvisor.googlesource.com/gvisor/pkg/urpc.(*Server).StartHandling.func1(0xc00036e090, 0xc00043a420)
	pkg/urpc/urpc.go:440 +0x77
created by gvisor.googlesource.com/gvisor/pkg/urpc.(*Server).StartHandling
	pkg/urpc/urpc.go:438 +0x6f

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/14 16:35 https://gvisor.googlesource.com/gvisor master 2512cc561778 d09a902e .config console log report syz C ci-gvisor-ptrace-proxy-sandbox-race
2019/03/14 15:23 https://gvisor.googlesource.com/gvisor master 2512cc561778 d09a902e .config console log report syz ci-gvisor-kvm-direct-overlay-host-race
2019/03/12 02:40 https://gvisor.googlesource.com/gvisor master bc9b979b9412 12365b99 .config console log report syz ci-gvisor-kvm-direct-overlay-host-race
2019/03/07 07:03 https://gvisor.googlesource.com/gvisor master cdd63375d39e 18215b8d .config console log report syz ci-gvisor-kvm-direct-overlay-host-race
2019/03/07 06:48 https://gvisor.googlesource.com/gvisor master cdd63375d39e 18215b8d .config console log report syz ci-gvisor-ptrace-proxy-sandbox-race
2019/03/28 08:23 https://gvisor.googlesource.com/gvisor master cea1dd7d21b9 f94f56fe .config console log report ci-gvisor-kvm-direct-overlay-host-race
2019/03/14 15:10 https://gvisor.googlesource.com/gvisor master 2512cc561778 d09a902e .config console log report ci-gvisor-kvm-direct-overlay-host-race
2019/03/12 00:54 https://gvisor.googlesource.com/gvisor master bc9b979b9412 12365b99 .config console log report ci-gvisor-kvm-direct-overlay-host-race
2019/03/07 06:25 https://gvisor.googlesource.com/gvisor master cdd63375d39e 18215b8d .config console log report ci-gvisor-ptrace-proxy-sandbox-race
* Struck through repros no longer work on HEAD.