syzbot


KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (5)

Status: moderation: reported on 2024/12/03 07:27
Subsystems: rtc
[Documentation on labels]
Reported-by: syzbot+7623b588d2f48190bb96@syzkaller.appspotmail.com
First crash: 72d, last: 14d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (2) rtc 1 1128d 1128d 0/28 auto-closed as invalid on 2022/02/16 06:16
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (4) rtc 1 223d 223d 0/28 auto-obsoleted due to no activity on 2024/08/09 01:42
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq rtc 1 1251d 1251d 0/28 auto-closed as invalid on 2021/10/16 01:04
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (3) rtc 1 292d 292d 0/28 auto-obsoleted due to no activity on 2024/06/01 19:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq

read-write to 0xffff88810303db80 of 8 bytes by interrupt on cpu 1:
 rtc_handle_legacy_irq drivers/rtc/interface.c:624 [inline]
 rtc_pie_update_irq+0x95/0xf0 drivers/rtc/interface.c:672
 __run_hrtimer kernel/time/hrtimer.c:1738 [inline]
 __hrtimer_run_queues+0x20d/0x5e0 kernel/time/hrtimer.c:1802
 hrtimer_interrupt+0x235/0x4a0 kernel/time/hrtimer.c:1864
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 arch_atomic64_read arch/x86/include/asm/atomic64_64.h:15 [inline]
 raw_atomic64_read include/linux/atomic/atomic-arch-fallback.h:2583 [inline]
 raw_atomic_long_read include/linux/atomic/atomic-long.h:38 [inline]
 atomic_long_read include/linux/atomic/atomic-instrumented.h:3189 [inline]
 find_watchpoint kernel/kcsan/core.c:131 [inline]
 check_access kernel/kcsan/core.c:737 [inline]
 __tsan_read8+0x2c/0x180 kernel/kcsan/core.c:1025
 __tlb_adjust_range include/asm-generic/tlb.h:382 [inline]
 tlb_flush_pte_range include/asm-generic/tlb.h:593 [inline]
 tlb_remove_tlb_entries include/asm-generic/tlb.h:647 [inline]
 zap_present_folio_ptes mm/memory.c:1529 [inline]
 zap_present_ptes mm/memory.c:1596 [inline]
 do_zap_pte_range mm/memory.c:1698 [inline]
 zap_pte_range mm/memory.c:1740 [inline]
 zap_pmd_range mm/memory.c:1823 [inline]
 zap_pud_range mm/memory.c:1852 [inline]
 zap_p4d_range mm/memory.c:1873 [inline]
 unmap_page_range+0x1044/0x26c0 mm/memory.c:1894
 unmap_single_vma+0x142/0x1d0 mm/memory.c:1940
 unmap_vmas+0x18d/0x2b0 mm/memory.c:1984
 exit_mmap+0x1ae/0x6d0 mm/mmap.c:1284
 __mmput+0x28/0x1d0 kernel/fork.c:1345
 mmput+0x4c/0x60 kernel/fork.c:1367
 exit_mm+0xe4/0x190 kernel/exit.c:570
 do_exit+0x559/0x17f0 kernel/exit.c:925
 do_group_exit+0x102/0x150 kernel/exit.c:1087
 get_signal+0xeb9/0x1000 kernel/signal.c:3036
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x62/0x120 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810303db80 of 8 bytes by task 4826 on cpu 0:
 rtc_dev_poll+0x77/0xb0 drivers/rtc/dev.c:198
 vfs_poll include/linux/poll.h:82 [inline]
 __io_arm_poll_handler+0x1e5/0xd50 io_uring/poll.c:578
 io_arm_poll_handler+0x3e1/0x5b0 io_uring/poll.c:703
 io_queue_async+0x89/0x320 io_uring/io_uring.c:1923
 io_queue_sqe io_uring/io_uring.c:1952 [inline]
 io_req_task_submit+0xb9/0xc0 io_uring/io_uring.c:1371
 io_poll_task_func+0x5fa/0x7c0
 io_handle_tw_list+0xe3/0x200 io_uring/io_uring.c:1057
 tctx_task_work_run+0x6e/0x1c0 io_uring/io_uring.c:1121
 tctx_task_work+0x40/0x80 io_uring/io_uring.c:1139
 task_work_run+0x13a/0x1a0 kernel/task_work.c:227
 get_signal+0xe78/0x1000 kernel/signal.c:2809
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x62/0x120 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0x00000000000001c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4826 Comm: syz.4.509 Not tainted 6.13.0-syzkaller-09383-gebbb8be421ee #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/30 03:04 upstream ebbb8be421ee afe4eff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2025/01/05 21:49 upstream 9244696b34f2 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/11 21:34 upstream f92f4749861b ff949d25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/09 01:52 upstream 62b5a46999c7 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/07 19:08 upstream b5f217084ab3 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2024/12/03 07:26 upstream cdd30ebb1b9f 578925bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
* Struck through repros no longer work on HEAD.