KCSAN: data-race in p9_conn_cancel / p9_write

KCSAN: data-race in p9_conn_cancel / p9_write_work (7)

Status: upstream: reported on 2025/02/11 20:11
Subsystems: v9fs
[Documentation on labels]
Reported-by: syzbot+d69a7cc8c683c2cb7506@syzkaller.appspotmail.com
Fix commit: fbc0283fbeae 9p/trans_fd: mark concurrent read and writes to p9_conn->err
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-arm32 ci-qemu2-riscv64]
First crash: 66d, last: 41d

▶ ▼ Discussions (7)

Title	Replies (including bot)	Last reply
[PATCH AUTOSEL 6.12 5/7] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	1 (1)	2025/04/07 18:17
[PATCH AUTOSEL 6.13 5/8] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	1 (1)	2025/04/07 18:16
[PATCH AUTOSEL 6.14 6/9] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	1 (1)	2025/04/07 18:16
[PATCH v3] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	2 (2)	2025/03/18 22:01
[PATCH v2] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	3 (3)	2025/03/17 17:01
[PATCH] 9p/trans_fd: mark concurrent read and writes to p9_conn->err	3 (3)	2025/03/09 07:35
[syzbot] [v9fs?] KCSAN: data-race in p9_conn_cancel / p9_write_work (7)	0 (1)	2025/02/11 20:11

▶ ▼ Similar bugs (6)

Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work (5) v9fs	3	336d	377d	0/28	auto-obsoleted due to no activity on 2024/06/21 12:43
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work (4) v9fs	2	508d	531d	0/28	auto-obsoleted due to no activity on 2024/01/02 07:46
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work (6) v9fs	4	196d	269d	0/28	auto-obsoleted due to no activity on 2024/11/08 10:55
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work v9fs	1	1606d	1589d	0/28	auto-closed as invalid on 2020/12/30 07:04
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work (3) v9fs	1	1095d	1095d	0/28	auto-closed as invalid on 2022/05/24 19:24
upstream	KCSAN: data-race in p9_conn_cancel / p9_write_work (2) v9fs	2	1537d	1549d	0/28	auto-closed as invalid on 2021/03/08 14:39

Sample crash report:

==================================================================
BUG: KCSAN: data-race in p9_conn_cancel / p9_write_work

write to 0xffff888117ec8a28 of 4 bytes by task 3378 on cpu 1:
 p9_conn_cancel+0x89/0x400 net/9p/trans_fd.c:199
 p9_read_work+0x765/0x8c0 net/9p/trans_fd.c:406
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4db/0xa20 kernel/workqueue.c:3319
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3400
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888117ec8a28 of 4 bytes by task 3381 on cpu 0:
 p9_write_work+0x26/0x750 net/9p/trans_fd.c:453
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4db/0xa20 kernel/workqueue.c:3319
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3400
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x00000000 -> 0xfffffffb

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3381 Comm: kworker/0:4 Not tainted 6.14.0-rc5-syzkaller-00214-g21e4543a2e2f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events p9_write_work
==================================================================

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/03/08 12:59	upstream	21e4543a2e2f	7e3bd60d	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-kcsan-gce	KCSAN: data-race in p9_conn_cancel / p9_write_work
2025/02/11 18:38	upstream	febbc555cf0f	f2baddf5	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-kcsan-gce	KCSAN: data-race in p9_conn_cancel / p9_write_work

* ~~Struck through~~ repros no longer work on HEAD.