syzbot


KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait (2)

Status: moderation: reported on 2025/09/20 08:17
Subsystems: sound
[Documentation on labels]
Reported-by: syzbot+87f6b42e66967416c189@syzkaller.appspotmail.com
First crash: 4h35m, last: 4h35m
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait sound 6 3 2074d 2097d 0/29 auto-closed as invalid on 2020/03/25 18:32

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait

read-write to 0xffff88811aba7738 of 4 bytes by task 4455 on cpu 1:
 snd_seq_fifo_event_in+0x155/0x200 sound/core/seq/seq_fifo.c:126
 __snd_seq_deliver_single_event sound/core/seq/seq_clientmgr.c:647 [inline]
 snd_seq_deliver_single_event+0x3db/0x590 sound/core/seq/seq_clientmgr.c:714
 snd_seq_deliver_event+0x181/0x470 sound/core/seq/seq_clientmgr.c:850
 snd_seq_kernel_client_dispatch+0x24c/0x260 sound/core/seq/seq_clientmgr.c:2554
 snd_seq_system_notify+0x95/0xb0 sound/core/seq/seq_system.c:101
 snd_seq_client_notify_subscription+0x7f/0xb0 sound/core/seq/seq_clientmgr.c:1518
 subscribe_port sound/core/seq/seq_ports.c:445 [inline]
 check_and_subscribe_port+0x419/0x620 sound/core/seq/seq_ports.c:520
 snd_seq_port_connect+0x188/0x270 sound/core/seq/seq_ports.c:601
 snd_seq_ioctl_subscribe_port+0x22b/0x3b0 sound/core/seq/seq_clientmgr.c:1551
 snd_seq_ioctl+0x17a/0x2e0 sound/core/seq/seq_clientmgr.c:2385
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:598 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:584
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:584
 x64_sys_call+0x1816/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811aba7738 of 4 bytes by task 4439 on cpu 0:
 snd_seq_fifo_poll_wait+0x68/0x90 sound/core/seq/seq_fifo.c:216
 snd_seq_poll+0xa1/0x140 sound/core/seq/seq_clientmgr.c:1160
 vfs_poll include/linux/poll.h:82 [inline]
 __io_arm_poll_handler+0x1ee/0xb70 io_uring/poll.c:581
 io_poll_add+0x69/0xe0 io_uring/poll.c:901
 __io_issue_sqe+0xfb/0x2e0 io_uring/io_uring.c:1771
 io_issue_sqe+0x53/0x970 io_uring/io_uring.c:1794
 io_queue_sqe io_uring/io_uring.c:2023 [inline]
 io_submit_sqe io_uring/io_uring.c:2283 [inline]
 io_submit_sqes+0x675/0x1060 io_uring/io_uring.c:2396
 __do_sys_io_uring_enter io_uring/io_uring.c:3463 [inline]
 __se_sys_io_uring_enter+0x1c1/0x1b70 io_uring/io_uring.c:3397
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3397
 x64_sys_call+0x2de1/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4439 Comm: syz.4.301 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/20 08:17 upstream cd89d487374c 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait
* Struck through repros no longer work on HEAD.