syzbot


KCSAN: data-race in clockevents_program_event / print_tickdevice (11)

Status: moderation: reported on 2025/04/01 18:27
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+ba24ce4936841ba0eea6@syzkaller.appspotmail.com
First crash: 22d, last: 22d
Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (8) kernel 1 491d 491d 0/28 auto-obsoleted due to no activity on 2024/01/23 08:37
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (6) kernel 28 678d 970d 0/28 auto-obsoleted due to no activity on 2023/07/21 02:50
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (7) kernel 2 545d 546d 0/28 auto-obsoleted due to no activity on 2023/11/30 21:56
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (5) kernel 7 1017d 1043d 0/28 auto-closed as invalid on 2022/08/15 19:00
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (2) kernel 1 1378d 1378d 0/28 auto-closed as invalid on 2021/08/19 20:40
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (10) kernel 2 236d 243d 0/28 auto-obsoleted due to no activity on 2024/10/04 08:26
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (9) kernel 1 380d 380d 0/28 auto-obsoleted due to no activity on 2024/05/13 19:49
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (4) kernel 1 1166d 1166d 0/28 auto-closed as invalid on 2022/03/19 14:36
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice kernel 1 1461d 1458d 0/28 auto-closed as invalid on 2021/05/28 09:07
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (3) kernel 5 1267d 1298d 0/28 auto-closed as invalid on 2021/12/08 10:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in clockevents_program_event / print_tickdevice

write to 0xffff888237d17318 of 8 bytes by interrupt on cpu 1:
 clockevents_program_event+0x36/0x1f0 kernel/time/clockevents.c:313
 tick_program_event+0x7c/0xd0 kernel/time/tick-oneshot.c:44
 hrtimer_interrupt+0x27c/0x4a0 kernel/time/hrtimer.c:1930
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 __tsan_read8+0x12/0x180 kernel/kcsan/core.c:1025
 __netif_receive_skb_core+0x2063/0x2580 net/core/dev.c:5850
 __netif_receive_skb_list_core+0x117/0x520 net/core/dev.c:5966
 __netif_receive_skb_list net/core/dev.c:6033 [inline]
 netif_receive_skb_list_internal+0x4e6/0x670 net/core/dev.c:6124
 netif_receive_skb_list+0x31/0x230 net/core/dev.c:6176
 xdp_recv_frames net/bpf/test_run.c:280 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0xe17/0x1050 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0x526/0x8e0 net/bpf/test_run.c:1316
 bpf_prog_test_run+0x20e/0x3a0 kernel/bpf/syscall.c:4427
 __sys_bpf+0x440/0x800 kernel/bpf/syscall.c:5852
 __do_sys_bpf kernel/bpf/syscall.c:5941 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5939 [inline]
 __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5939
 x64_sys_call+0x23da/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237d17318 of 8 bytes by task 3483 on cpu 0:
 print_tickdevice+0x144/0x340 kernel/time/timer_list.c:208
 timer_list_show+0x79/0x180 kernel/time/timer_list.c:300
 traverse+0x155/0x3c0 fs/seq_file.c:111
 seq_read_iter+0x89f/0x970 fs/seq_file.c:195
 proc_reg_read_iter+0x118/0x190 fs/proc/inode.c:299
 new_sync_read fs/read_write.c:489 [inline]
 vfs_read+0x5e6/0x710 fs/read_write.c:570
 ksys_pread64 fs/read_write.c:761 [inline]
 __do_sys_pread64 fs/read_write.c:769 [inline]
 __se_sys_pread64 fs/read_write.c:766 [inline]
 __x64_sys_pread64+0xfb/0x150 fs/read_write.c:766
 x64_sys_call+0x26ad/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:18
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x7fffffffffffffff -> 0x000000096795b7e4

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3483 Comm: syz.4.12 Not tainted 6.14.0-syzkaller-11270-g08733088b566 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/01 18:27 upstream 08733088b566 b8645499 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in clockevents_program_event / print_tickdevice
* Struck through repros no longer work on HEAD.