syzbot


KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu (2)

Status: auto-closed as invalid on 2021/09/10 01:57
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+db891a54585229971137@syzkaller.appspotmail.com
First crash: 1058d, last: 999d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu (4) kernel 4 851d 889d 0/26 auto-closed as invalid on 2022/02/04 19:38
upstream KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu kernel 1 1280d 1280d 0/26 auto-closed as invalid on 2020/12/02 11:50
upstream KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu (3) kernel 3 945d 963d 0/26 auto-closed as invalid on 2021/11/02 20:29

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu

write to 0xffff888137120150 of 8 bytes by interrupt on cpu 1:
 percpu_ref_call_confirm_rcu lib/percpu-refcount.c:156 [inline]
 percpu_ref_switch_to_atomic_rcu+0x188/0x360 lib/percpu-refcount.c:205
 rcu_do_batch kernel/rcu/tree.c:2550 [inline]
 rcu_core+0xb95/0xd50 kernel/rcu/tree.c:2785
 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2798
 __do_softirq+0x12c/0x26e kernel/softirq.c:558
 run_ksoftirqd+0x13/0x20 kernel/softirq.c:920
 smpboot_thread_fn+0x22f/0x330 kernel/smpboot.c:164
 kthread+0x262/0x280 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

read to 0xffff888137120150 of 8 bytes by task 8321 on cpu 0:
 __percpu_ref_switch_mode+0xe6/0x3b0 lib/percpu-refcount.c:275
 percpu_ref_resurrect+0xc2/0x110 lib/percpu-refcount.c:473
 io_refs_resurrect fs/io_uring.c:1116 [inline]
 __io_uring_register fs/io_uring.c:10116 [inline]
 __do_sys_io_uring_register+0xd27/0x1ea0 fs/io_uring.c:10248
 __se_sys_io_uring_register fs/io_uring.c:10228 [inline]
 __x64_sys_io_uring_register+0x4f/0x60 fs/io_uring.c:10228
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffffffff818acaf0 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8321 Comm: syz-executor.2 Not tainted 5.14.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/06 01:57 upstream e04480920d1e d2d6e680 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/08/04 07:28 upstream d5ad8ec3cfb5 6c236867 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/08/02 16:02 upstream c500bee1c5b2 6c236867 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/07/24 17:54 upstream f0fddcec6b62 4d1b57d4 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/07/21 03:39 upstream 8cae8cd89f05 1b201b48 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/07/08 05:18 upstream 3dbdb38e2869 95793bce .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/06/17 23:25 upstream 70585216fe77 aba2b2fb .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
2021/06/07 19:35 upstream 614124bea77e b718257f .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __percpu_ref_switch_mode / percpu_ref_switch_to_atomic_rcu
* Struck through repros no longer work on HEAD.