syzbot


KCSAN: data-race in __io_fill_cqe_req / io_timeout

Status: auto-obsoleted due to no activity on 2023/05/08 13:11
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+cb265db2f3f3468ef436@syzkaller.appspotmail.com
First crash: 409d, last: 406d
Discussions (5)
Title Replies (including bot) Last reply
[PATCH AUTOSEL 6.1 02/12] io_uring: annotate offset timeout races 1 (1) 2023/07/02 19:41
[PATCH AUTOSEL 6.3 02/14] io_uring: annotate offset timeout races 1 (1) 2023/07/02 19:40
[PATCH AUTOSEL 6.4 03/15] io_uring: annotate offset timeout races 1 (1) 2023/07/02 19:40
[PATCH 1/1] io_uring: annotate offset timeout races 2 (2) 2023/05/20 01:57
[syzbot] [io-uring?] KCSAN: data-race in __io_fill_cqe_req / io_timeout 2 (3) 2023/04/24 13:01

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __io_fill_cqe_req / io_timeout

read-write to 0xffff888108bf8310 of 4 bytes by task 20447 on cpu 0:
 io_get_cqe_overflow io_uring/io_uring.h:112 [inline]
 io_get_cqe io_uring/io_uring.h:124 [inline]
 __io_fill_cqe_req+0x6c/0x4d0 io_uring/io_uring.h:137
 io_fill_cqe_req io_uring/io_uring.h:165 [inline]
 __io_req_complete_post+0x67/0x790 io_uring/io_uring.c:969
 io_req_complete_post io_uring/io_uring.c:1006 [inline]
 io_req_task_complete+0xb9/0x110 io_uring/io_uring.c:1654
 handle_tw_list io_uring/io_uring.c:1184 [inline]
 tctx_task_work+0x1fe/0x4d0 io_uring/io_uring.c:1246
 task_work_run+0x123/0x160 kernel/task_work.c:179
 get_signal+0xe5c/0xfe0 kernel/signal.c:2635
 arch_do_signal_or_restart+0x89/0x2b0 arch/x86/kernel/signal.c:306
 exit_to_user_mode_loop+0x6d/0xe0 kernel/entry/common.c:168
 exit_to_user_mode_prepare+0x6a/0xa0 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
 syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:297
 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff888108bf8310 of 4 bytes by task 20448 on cpu 1:
 io_timeout+0x88/0x270 io_uring/timeout.c:546
 io_issue_sqe+0x147/0x660 io_uring/io_uring.c:1907
 io_queue_sqe io_uring/io_uring.c:2079 [inline]
 io_submit_sqe io_uring/io_uring.c:2340 [inline]
 io_submit_sqes+0x689/0xfe0 io_uring/io_uring.c:2450
 __do_sys_io_uring_enter io_uring/io_uring.c:3458 [inline]
 __se_sys_io_uring_enter+0x1e5/0x1b70 io_uring/io_uring.c:3392
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3392
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000c75 -> 0x00000c76

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 20448 Comm: syz-executor.2 Not tainted 6.3.0-rc4-syzkaller-00025-g3a93e40326c8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/03/28 14:51 upstream 3a93e40326c8 47f3aaf1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __io_fill_cqe_req / io_timeout
2023/03/25 11:03 upstream 65aca32efdcb fbf0499a .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __io_fill_cqe_req / io_timeout
* Struck through repros no longer work on HEAD.