syzbot


KCSAN: data-race in n_tty_poll / pty_unix98_ioctl (2)

Status: moderation: reported on 2025/07/17 15:47
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+7c357b50876920ae945d@syzkaller.appspotmail.com
First crash: 2d16h, last: 2d16h
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in n_tty_poll / pty_unix98_ioctl serial 6 1 1525d 1525d 0/29 auto-closed as invalid on 2021/06/20 20:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in n_tty_poll / pty_unix98_ioctl

write to 0xffff8881049509d5 of 1 bytes by task 6881 on cpu 1:
 pty_set_pktmode drivers/tty/pty.c:-1 [inline]
 pty_unix98_ioctl+0x2c0/0x2e0 drivers/tty/pty.c:651
 tty_ioctl+0x7db/0xb80 drivers/tty/tty_io.c:2792
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:893
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:893
 x64_sys_call+0x19a8/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881049509d5 of 1 bytes by task 6877 on cpu 0:
 n_tty_poll+0x31f/0x450 drivers/tty/n_tty.c:2459
 tty_poll+0x76/0xf0 drivers/tty/tty_io.c:2199
 vfs_poll include/linux/poll.h:82 [inline]
 __io_arm_poll_handler+0x1eb/0xb70 io_uring/poll.c:583
 io_arm_poll_handler+0x427/0x590 io_uring/poll.c:708
 io_queue_async+0x60/0x3a0 io_uring/io_uring.c:1949
 io_queue_sqe io_uring/io_uring.c:1975 [inline]
 io_submit_sqe io_uring/io_uring.c:2224 [inline]
 io_submit_sqes+0xa25/0xfd0 io_uring/io_uring.c:2337
 __do_sys_io_uring_enter io_uring/io_uring.c:3404 [inline]
 __se_sys_io_uring_enter+0x1c1/0x1b70 io_uring/io_uring.c:3338
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3338
 x64_sys_call+0x28c8/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6877 Comm: syz.2.1396 Not tainted 6.16.0-rc6-syzkaller-00037-ge2291551827f #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/17 15:47 upstream e2291551827f 0d1223f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in n_tty_poll / pty_unix98_ioctl
* Struck through repros no longer work on HEAD.