syzbot


KCSAN: data-race in __perf_event_overflow / fasync_remove_entry (3)

Status: moderation: reported on 2024/06/01 01:23
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+dd48357de58aaffad087@syzkaller.appspotmail.com
First crash: 25d, last: 21d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __perf_event_overflow / fasync_remove_entry fs 76 1473d 1597d 0/27 auto-closed as invalid on 2020/07/18 23:20
upstream KCSAN: data-race in __perf_event_overflow / fasync_remove_entry (2) fs 1 203d 202d 0/27 auto-obsoleted due to no activity on 2024/01/09 23:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __perf_event_overflow / fasync_remove_entry

write to 0xffff88811979f918 of 8 bytes by task 16700 on cpu 1:
 fasync_remove_entry+0xd2/0x130 fs/fcntl.c:909
 fasync_helper+0x96/0xc0 fs/fcntl.c:1008
 perf_fasync+0x64/0x90 kernel/events/core.c:6679
 __fput+0x5fa/0x660 fs/file_table.c:419
 __fput_sync+0x44/0x60 fs/file_table.c:507
 __do_sys_close fs/open.c:1555 [inline]
 __se_sys_close+0x101/0x1b0 fs/open.c:1540
 __x64_sys_close+0x1f/0x30 fs/open.c:1540
 x64_sys_call+0x25f1/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:4
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811979f918 of 8 bytes by interrupt on cpu 0:
 __perf_event_overflow+0x44a/0x570 kernel/events/core.c:9726
 perf_swevent_hrtimer+0x240/0x2f0 kernel/events/core.c:11079
 __run_hrtimer kernel/time/hrtimer.c:1687 [inline]
 __hrtimer_run_queues+0x20d/0x5e0 kernel/time/hrtimer.c:1751
 hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1813
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock_irqrestore+0x3d/0x60 kernel/locking/spinlock.c:194
 class_raw_spinlock_irqsave_destructor include/linux/spinlock.h:553 [inline]
 try_to_wake_up+0x3e5/0x630 kernel/sched/core.c:4262
 wake_up_process kernel/sched/core.c:4510 [inline]
 wake_up_q+0x3f/0x80 kernel/sched/core.c:1029
 futex_wake+0x2d2/0x330 kernel/futex/waitwake.c:199
 do_futex+0x2ab/0x370 kernel/futex/syscalls.c:107
 __do_sys_futex kernel/futex/syscalls.c:179 [inline]
 __se_sys_futex+0x25d/0x3a0 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:160
 x64_sys_call+0x28c1/0x2d70 arch/x86/include/generated/asm/syscalls_64.h:203
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff888118dbb5a0 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 16701 Comm: syz-executor.3 Not tainted 6.10.0-rc2-syzkaller-00010-g2ab795141095 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/04 18:21 upstream 2ab795141095 11f2afa5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __perf_event_overflow / fasync_remove_entry
2024/06/01 01:23 upstream d8ec19857b09 3113787f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __perf_event_overflow / fasync_remove_entry
* Struck through repros no longer work on HEAD.