syzbot


KCSAN: data-race in clockevents_program_event / print_tickdevice (9)

Status: moderation: reported on 2024/04/08 19:49
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+df0ad1bf7b1069f8a358@syzkaller.appspotmail.com
First crash: 21d, last: 21d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (8) kernel 1 133d 133d 0/26 auto-obsoleted due to no activity on 2024/01/23 08:37
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (6) kernel 28 319d 611d 0/26 auto-obsoleted due to no activity on 2023/07/21 02:50
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (7) kernel 2 186d 187d 0/26 auto-obsoleted due to no activity on 2023/11/30 21:56
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (5) kernel 7 658d 684d 0/26 auto-closed as invalid on 2022/08/15 19:00
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (2) kernel 1 1019d 1019d 0/26 auto-closed as invalid on 2021/08/19 20:40
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (4) kernel 1 808d 808d 0/26 auto-closed as invalid on 2022/03/19 14:36
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice kernel 1 1103d 1099d 0/26 auto-closed as invalid on 2021/05/28 09:07
upstream KCSAN: data-race in clockevents_program_event / print_tickdevice (3) kernel 5 909d 939d 0/26 auto-closed as invalid on 2021/12/08 10:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in clockevents_program_event / print_tickdevice

write to 0xffff888237d1c218 of 8 bytes by interrupt on cpu 1:
 clockevents_program_event+0x36/0x1f0 kernel/time/clockevents.c:313
 tick_program_event+0x7c/0xd0 kernel/time/tick-oneshot.c:44
 hrtimer_interrupt+0x254/0x7b0 kernel/time/hrtimer.c:1831
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
 ma_dead_node lib/maple_tree.c:560 [inline]
 mtree_lookup_walk lib/maple_tree.c:3714 [inline]
 mtree_load+0x2b7/0x4e0 lib/maple_tree.c:6336
 vma_lookup include/linux/mm.h:3478 [inline]
 do_pages_stat_array mm/migrate.c:2295 [inline]
 do_pages_stat mm/migrate.c:2366 [inline]
 kernel_move_pages mm/migrate.c:2453 [inline]
 __do_sys_move_pages mm/migrate.c:2464 [inline]
 __se_sys_move_pages+0xff1/0x1560 mm/migrate.c:2459
 __x64_sys_move_pages+0x78/0x90 mm/migrate.c:2459
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x72/0x7a

read to 0xffff888237d1c218 of 8 bytes by task 29078 on cpu 0:
 print_tickdevice+0x144/0x340 kernel/time/timer_list.c:208
 timer_list_show+0x79/0x180 kernel/time/timer_list.c:300
 seq_read_iter+0x65b/0x940 fs/seq_file.c:272
 proc_reg_read_iter+0x11e/0x190 fs/proc/inode.c:299
 call_read_iter include/linux/fs.h:2104 [inline]
 copy_splice_read+0x3a4/0x5d0 fs/splice.c:365
 do_splice_read fs/splice.c:985 [inline]
 splice_direct_to_actor+0x26c/0x670 fs/splice.c:1089
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0xd7/0x150 fs/splice.c:1233
 do_sendfile+0x3b9/0x970 fs/read_write.c:1295
 __do_sys_sendfile64 fs/read_write.c:1362 [inline]
 __se_sys_sendfile64 fs/read_write.c:1348 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1348
 do_syscall_64+0xd3/0x1d0
 entry_SYSCALL_64_after_hwframe+0x72/0x7a

value changed: 0x7fffffffffffffff -> 0x0000011a1c444545

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 29078 Comm: syz-executor.3 Tainted: G        W          6.9.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/08 19:49 upstream fec50db7033e 53df08b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in clockevents_program_event / print_tickdevice
* Struck through repros no longer work on HEAD.