syzbot


KCSAN: data-race in __futex_wait / hrtimer_wakeup

Status: moderation: reported on 2024/06/07 01:51
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+7e78a9974d48a87903ad@syzkaller.appspotmail.com
First crash: 8d03h, last: 4d00h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __futex_wait / hrtimer_wakeup

read-write to 0xffffc90001307d90 of 8 bytes by interrupt on cpu 0:
 hrtimer_wakeup+0x1c/0x50 kernel/time/hrtimer.c:1921
 __run_hrtimer kernel/time/hrtimer.c:1687 [inline]
 __hrtimer_run_queues+0x20d/0x5e0 kernel/time/hrtimer.c:1751
 hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1813
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 preempt_count arch/x86/include/asm/preempt.h:26 [inline]
 get_ctx kernel/kcsan/core.c:206 [inline]
 check_access kernel/kcsan/core.c:750 [inline]
 __tsan_unaligned_write1+0xb5/0x180 kernel/kcsan/core.c:1022
 icmpv6_flow_init+0x6c/0xb0 net/ipv6/icmp.c:1045
 mld_sendpack+0x2e2/0x6d0 net/ipv6/mcast.c:1804
 mld_send_initial_cr+0x12f/0x1e0 net/ipv6/mcast.c:2236
 ipv6_mc_dad_complete+0x5f/0x2c0 net/ipv6/mcast.c:2244
 addrconf_dad_completed+0x4da/0x8a0 net/ipv6/addrconf.c:4339
 addrconf_dad_work+0x891/0xbd0
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
 worker_thread+0x526/0x730 kernel/workqueue.c:3393
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffffc90001307d90 of 8 bytes by task 7148 on cpu 1:
 __futex_wait+0x17f/0x290 kernel/futex/waitwake.c:675
 futex_wait+0x99/0x1c0 kernel/futex/waitwake.c:697
 do_futex+0x276/0x370 kernel/futex/syscalls.c:102
 __do_sys_futex kernel/futex/syscalls.c:179 [inline]
 __se_sys_futex+0x25d/0x3a0 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:160
 x64_sys_call+0x28c1/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:203
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff888103046300 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7148 Comm: syz-executor.3 Not tainted 6.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/11 05:36 upstream 83a7eefedc9b b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __futex_wait / hrtimer_wakeup
2024/06/10 02:22 upstream 83a7eefedc9b 82c05ab8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __futex_wait / hrtimer_wakeup
2024/06/07 01:51 upstream d30d0e49da71 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __futex_wait / hrtimer_wakeup
2024/06/07 01:50 upstream d30d0e49da71 121701b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __futex_wait / hrtimer_wakeup
* Struck through repros no longer work on HEAD.