syzbot


KCSAN: data-race in hrtimer_interrupt / print_tickdevice (15)

Status: moderation: reported on 2025/02/09 02:11
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+82c16afe4c8d9e71876e@syzkaller.appspotmail.com
First crash: 12d, last: 4d18h
Similar bugs (14)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (6) kernel 5 943d 967d 0/28 auto-closed as invalid on 2022/08/27 09:49
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (13) kernel 2 190d 196d 0/28 auto-obsoleted due to no activity on 2024/09/19 01:50
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (8) kernel 3 815d 838d 0/28 auto-obsoleted due to no activity on 2023/01/03 04:47
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (4) kernel 14 1079d 1244d 0/28 auto-closed as invalid on 2022/04/13 14:16
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (2) kernel 3 1380d 1384d 0/28 auto-closed as invalid on 2021/06/16 18:46
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (10) kernel 1 540d 540d 0/28 auto-obsoleted due to no activity on 2023/10/04 07:33
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (5) kernel 2 1017d 1017d 0/28 auto-closed as invalid on 2022/06/15 02:31
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (14) kernel 8 70d 140d 0/28 auto-obsoleted due to no activity on 2025/02/06 20:55
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (7) kernel 1 887d 887d 0/28 auto-obsoleted due to no activity on 2022/10/22 07:07
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (11) kernel 2 425d 438d 0/28 auto-obsoleted due to no activity on 2024/01/28 02:00
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (3) kernel 2 1294d 1329d 0/28 auto-closed as invalid on 2021/09/10 15:52
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice kernel 1 1496d 1496d 0/28 auto-closed as invalid on 2021/02/20 21:54
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (12) kernel 1 295d 295d 0/28 auto-obsoleted due to no activity on 2024/06/05 19:29
upstream KCSAN: data-race in hrtimer_interrupt / print_tickdevice (9) kernel 20 607d 756d 0/28 auto-obsoleted due to no activity on 2023/07/30 02:27

Sample crash report:
==================================================================
BUG: KCSAN: data-race in hrtimer_interrupt / print_tickdevice

write to 0xffff888237d1c218 of 8 bytes by interrupt on cpu 1:
 hrtimer_interrupt+0x80/0x4a0 kernel/time/hrtimer.c:1906
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x3d/0x60 kernel/locking/spinlock.c:194
 unlock_hrtimer_base kernel/time/hrtimer.c:1032 [inline]
 hrtimer_start_range_ns+0x6ca/0x720 kernel/time/hrtimer.c:1346
 qdisc_watchdog_schedule_range_ns+0xd8/0xf0 net/sched/sch_api.c:657
 qdisc_watchdog_schedule_ns include/net/pkt_sched.h:81 [inline]
 tbf_dequeue+0x3e6/0x5c0 net/sched/sch_tbf.c:316
 dequeue_skb net/sched/sch_generic.c:293 [inline]
 qdisc_restart net/sched/sch_generic.c:398 [inline]
 __qdisc_run+0x1a5/0x1130 net/sched/sch_generic.c:416
 qdisc_run+0xcc/0x2c0 include/net/pkt_sched.h:127
 net_tx_action+0x2f7/0x370 net/core/dev.c:5484
 handle_softirqs+0xbf/0x280 kernel/softirq.c:561
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:950
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888237d1c218 of 8 bytes by task 9867 on cpu 0:
 print_tickdevice+0x144/0x340 kernel/time/timer_list.c:208
 timer_list_show+0x79/0x180 kernel/time/timer_list.c:300
 seq_read_iter+0x2d1/0x930 fs/seq_file.c:230
 proc_reg_read_iter+0x118/0x190 fs/proc/inode.c:299
 copy_splice_read+0x383/0x5b0 fs/splice.c:365
 do_splice_read fs/splice.c:985 [inline]
 splice_direct_to_actor+0x269/0x670 fs/splice.c:1089
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0xd7/0x150 fs/splice.c:1233
 do_sendfile+0x398/0x660 fs/read_write.c:1363
 __do_sys_sendfile64 fs/read_write.c:1424 [inline]
 __se_sys_sendfile64 fs/read_write.c:1410 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1410
 x64_sys_call+0xfbd/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000cd06ad1e9a -> 0x000000cd06dabf9e

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9867 Comm: syz.2.13900 Not tainted 6.14.0-rc2-syzkaller-00303-gad1b832bf1cf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/16 10:53 upstream ad1b832bf1cf 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_interrupt / print_tickdevice
2025/02/09 02:10 upstream 9946eaf552b1 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_interrupt / print_tickdevice
* Struck through repros no longer work on HEAD.