syzbot


KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (5)

Status: moderation: reported on 2024/12/03 07:27
Subsystems: rtc
[Documentation on labels]
Reported-by: syzbot+7623b588d2f48190bb96@syzkaller.appspotmail.com
First crash: 208d, last: 22d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (2) rtc 1 1264d 1264d 0/29 auto-closed as invalid on 2022/02/16 06:16
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (4) rtc 1 360d 360d 0/29 auto-obsoleted due to no activity on 2024/08/09 01:42
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq rtc 1 1388d 1388d 0/29 auto-closed as invalid on 2021/10/16 01:04
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (3) rtc 1 428d 428d 0/29 auto-obsoleted due to no activity on 2024/06/01 19:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq

read-write to 0xffff88810331bb80 of 8 bytes by interrupt on cpu 1:
 rtc_handle_legacy_irq drivers/rtc/interface.c:624 [inline]
 rtc_pie_update_irq+0x93/0xf0 drivers/rtc/interface.c:672
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x20c/0x5a0 kernel/time/hrtimer.c:1825
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1887
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1056
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 mod_delayed_work_on+0xcc/0x130 kernel/workqueue.c:2600
 kblockd_mod_delayed_work_on+0x35/0x50 block/blk-core.c:1115
 blk_mq_delay_run_hw_queue+0x325/0x350 block/blk-mq.c:2290
 blk_mq_run_hw_queue+0x19b/0x220 block/blk-mq.c:2352
 blk_mq_dispatch_list+0x840/0xa10 arch/x86/include/asm/bitops.h:-1
 blk_mq_flush_plug_list+0x2d8/0x330 block/blk-mq.c:2965
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1220
 blk_flush_plug include/linux/blkdev.h:1118 [inline]
 io_schedule_prepare kernel/sched/core.c:7692 [inline]
 io_schedule+0x37/0x60 kernel/sched/core.c:7722
 bit_wait_io+0xc/0x60 kernel/sched/wait_bit.c:247
 __wait_on_bit+0x45/0xe0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x8d/0xb0 kernel/sched/wait_bit.c:64
 wait_on_bit_io include/linux/wait_bit.h:105 [inline]
 __wait_on_buffer+0x4d/0x60 fs/buffer.c:123
 wait_on_buffer include/linux/buffer_head.h:422 [inline]
 fat_sync_bhs+0xa3/0x130 fs/fat/misc.c:370
 fat_alloc_clusters+0x93f/0xa80 fs/fat/fatent.c:541
 fat_add_cluster fs/fat/inode.c:107 [inline]
 __fat_get_block fs/fat/inode.c:154 [inline]
 fat_get_block+0x258/0x5e0 fs/fat/inode.c:189
 __block_write_begin_int+0x3fd/0xf90 fs/buffer.c:2151
 block_write_begin fs/buffer.c:2262 [inline]
 cont_write_begin+0x5fc/0x970 fs/buffer.c:2601
 fat_write_begin+0x4f/0xe0 fs/fat/inode.c:228
 generic_perform_write+0x181/0x490 mm/filemap.c:4112
 __generic_file_write_iter+0x9e/0x120 mm/filemap.c:4229
 generic_file_write_iter+0x8d/0x2f0 mm/filemap.c:4255
 aio_write+0x2e5/0x410 fs/aio.c:1634
 __io_submit_one fs/aio.c:-1 [inline]
 io_submit_one+0xacd/0x11d0 fs/aio.c:2053
 __do_sys_io_submit fs/aio.c:2112 [inline]
 __se_sys_io_submit+0xfb/0x280 fs/aio.c:2082
 __x64_sys_io_submit+0x43/0x50 fs/aio.c:2082
 x64_sys_call+0xfc4/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:210
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810331bb80 of 8 bytes by task 5058 on cpu 0:
 rtc_dev_poll+0x78/0xb0 drivers/rtc/dev.c:198
 vfs_poll include/linux/poll.h:82 [inline]
 io_poll_check_events io_uring/poll.c:262 [inline]
 io_poll_task_func+0x142/0x9e0 io_uring/poll.c:319
 io_handle_tw_list+0xcc/0x1c0 io_uring/io_uring.c:1062
 tctx_task_work_run+0x6d/0x1a0 io_uring/io_uring.c:1127
 tctx_task_work+0x3f/0x80 io_uring/io_uring.c:1145
 task_work_run+0x12e/0x1a0 kernel/task_work.c:227
 get_signal+0xe13/0xf70 kernel/signal.c:2807
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x7a/0x100 kernel/entry/common.c:111
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x1d6/0x200 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000004afc0 -> 0x000000000004b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 5058 Comm: syz.0.614 Not tainted 6.15.0-syzkaller-13473-gc0c9379f235d #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/07 02:55 upstream c0c9379f235d 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/06/06 23:39 upstream c0c9379f235d 9fa58bba .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/05/25 17:02 upstream d0c22de9995b ed351ea7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/05/05 09:43 upstream 92a09c47464d b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/05/03 07:37 upstream 95d3481af6dc b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/05/02 17:05 upstream ebd297a2affa b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/05/02 03:44 upstream ebd297a2affa 51b137cd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/04/28 00:11 upstream b4432656b36e c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/04/28 00:11 upstream b4432656b36e c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/03/13 04:26 upstream 0fed89a961ea 1a5d9317 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/03/13 04:25 upstream 0fed89a961ea 1a5d9317 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/01/30 03:04 upstream ebbb8be421ee afe4eff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/01/05 21:49 upstream 9244696b34f2 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/11 21:34 upstream f92f4749861b ff949d25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/09 01:52 upstream 62b5a46999c7 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/07 19:08 upstream b5f217084ab3 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/03 07:26 upstream cdd30ebb1b9f 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
* Struck through repros no longer work on HEAD.