syzbot


KCSAN: data-race in copy_process / futex_hash_allocate_default

Status: moderation: reported on 2025/11/15 08:55
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+e2b0566187a4bfc4e388@syzkaller.appspotmail.com
First crash: 3d14h, last: 3d14h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in copy_process / futex_hash_allocate_default

read-write to 0xffff888121ba5688 of 4 bytes by task 6435 on cpu 1:
 copy_process+0x1a8b/0x2000 kernel/fork.c:2403
 create_io_thread+0x71/0xa0 kernel/fork.c:2557
 create_io_worker+0xe0/0x370 io_uring/io-wq.c:910
 io_wq_create_worker io_uring/io-wq.c:339 [inline]
 io_wq_enqueue+0x2c1/0x3a0 io_uring/io-wq.c:1037
 io_queue_iowq+0x201/0x2e0 io_uring/io_uring.c:524
 io_req_task_submit+0xc4/0x100 io_uring/io_uring.c:1464
 __io_run_local_work_loop io_uring/io_uring.c:1379 [inline]
 __io_run_local_work+0x26c/0x4f0 io_uring/io_uring.c:1412
 io_run_local_work io_uring/io_uring.c:1445 [inline]
 io_cqring_wait io_uring/io_uring.c:2727 [inline]
 __do_sys_io_uring_enter io_uring/io_uring.c:3553 [inline]
 __se_sys_io_uring_enter+0x144b/0x1b70 io_uring/io_uring.c:3453
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3453
 x64_sys_call+0x2df0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888121ba5688 of 4 bytes by task 6434 on cpu 0:
 get_nr_threads include/linux/sched/signal.h:701 [inline]
 futex_hash_allocate_default+0x5b/0x190 kernel/futex/core.c:1898
 copy_process+0x151e/0x2000 kernel/fork.c:2302
 kernel_clone+0x16c/0x5c0 kernel/fork.c:2609
 __do_sys_clone3 kernel/fork.c:2911 [inline]
 __se_sys_clone3+0x1c2/0x200 kernel/fork.c:2890
 __x64_sys_clone3+0x31/0x40 kernel/fork.c:2890
 x64_sys_call+0x1fc9/0x3000 arch/x86/include/generated/asm/syscalls_64.h:436
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000003 -> 0x00000004

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6434 Comm: syz.1.1228 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/15 08:54 upstream 7a0892d2836e f7988ea4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in copy_process / futex_hash_allocate_default
* Struck through repros no longer work on HEAD.