syzbot

 sign-in | mailing list | source | docs
🐞 Open [1300]
≡ Subsystems
🐞 Fixed [5494]
🐞 Invalid [13049]
⬇ Missing Backports [117]
Kernel Health Bugs/Month Bug Lifetimes Fuzzing Crashes
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KCSAN: data-race in __fput / __tty_hangup (4)

Status: upstream: reported on 2023/04/21 08:18
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+b7c3ba8cdc2f6cf83c21@syzkaller.appspotmail.com
Fix commit: tty: tty_io: fix race between tty_fops and hung_up_tty_fops
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-net-next-test-gce ci2-upstream-usb]
First crash: 485d, last: 41d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH] tty: tty_io: fix race between tty_fops and hung_up_tty_fops 3 (3) 2024/07/22 16:10
[fs] Are you OK with updating "struct file"->f_op value dynamically? 1 (1) 2024/05/12 13:45
[PATCH] tty: tty_io: remove hung_up_tty_fops 44 (44) 2024/05/04 22:17
[syzbot] [kernel?] KCSAN: data-race in __fput / __tty_hangup (4) 14 (15) 2023/04/25 22:09
▶ ▼ Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __fput / __tty_hangup (3) serial 2 739d 757d 0/27 auto-closed as invalid on 2022/08/23 04:41
upstream KCSAN: data-race in __fput / __tty_hangup (2) serial 1 794d 794d 0/27 auto-closed as invalid on 2022/06/29 01:31
upstream KCSAN: data-race in __fput / __tty_hangup serial 1 1460d 1460d 0/27 auto-closed as invalid on 2020/08/31 10:07

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __fput / __tty_hangup

write to 0xffff8881132633b0 of 8 bytes by task 11276 on cpu 1:
 __tty_hangup+0x1e8/0x540 drivers/tty/tty_io.c:621
 tty_vhangup+0x17/0x20 drivers/tty/tty_io.c:700
 pty_close+0x262/0x280 drivers/tty/pty.c:79
 tty_release+0x20c/0x940 drivers/tty/tty_io.c:1760
 __fput+0x2c2/0x660 fs/file_table.c:422
 ____fput+0x15/0x20 fs/file_table.c:450
 task_work_run+0x13a/0x1a0 kernel/task_work.c:180
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xbe/0x130 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881132633b0 of 8 bytes by task 11279 on cpu 0:
 __fput+0x298/0x660 fs/file_table.c:421
 ____fput+0x15/0x20 fs/file_table.c:450
 task_work_run+0x13a/0x1a0 kernel/task_work.c:180
 get_signal+0xeee/0x1080 kernel/signal.c:2681
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x59/0x130 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffffffff85298eb8 -> 0xffffffff85298d50

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11279 Comm: syz-executor.0 Not tainted 6.10.0-rc3-syzkaller-00164-g44ef20baed8e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/15 14:19 upstream 44ef20baed8e f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __fput / __tty_hangup
2024/02/29 15:32 upstream 805d849d7c3c 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __fput / __tty_hangup
2023/08/07 04:39 upstream f0ab9f34e59e 4ffcc9ef .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __fput / __tty_hangup
2023/03/29 08:37 upstream fcd476ea6a88 fc067f05 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __fput / __tty_hangup
* Struck through repros no longer work on HEAD.