syzbot


KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (10)

Status: moderation: reported on 2024/08/28 10:09
Subsystems: kernfs
[Documentation on labels]
Reported-by: syzbot+ea4711a436cc262245da@syzkaller.appspotmail.com
First crash: 17d, last: 17d
Similar bugs (9)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (8) kernfs 3 265d 276d 0/28 auto-obsoleted due to no activity on 2024/01/28 04:07
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir kernfs 2 1456d 1474d 0/28 auto-closed as invalid on 2020/10/24 11:06
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (4) kernfs 1 1255d 1255d 0/28 auto-closed as invalid on 2021/05/13 08:58
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (6) kernfs 3 885d 914d 0/28 auto-closed as invalid on 2022/05/18 10:42
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (2) kernfs 2 1360d 1373d 0/28 auto-closed as invalid on 2021/01/28 08:27
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (7) kernfs 1 803d 803d 0/28 auto-closed as invalid on 2022/08/08 13:27
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (5) kernfs 1 1060d 1060d 0/28 auto-closed as invalid on 2021/11/24 14:49
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (3) kernfs 1 1324d 1324d 0/28 auto-closed as invalid on 2021/03/05 09:25
upstream KCSAN: data-race in __kernfs_remove / cleanup_glue_dir (9) kernfs 1 105d 105d 0/28 auto-obsoleted due to no activity on 2024/07/05 21:54

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __kernfs_remove / cleanup_glue_dir

read-write to 0xffff88810d3ed948 of 8 bytes by task 5750 on cpu 0:
 kernfs_unlink_sibling fs/kernfs/dir.c:415 [inline]
 __kernfs_remove+0x2ff/0x480 fs/kernfs/dir.c:1492
 kernfs_remove+0x4e/0x70 fs/kernfs/dir.c:1528
 sysfs_remove_dir+0x7e/0xa0 fs/sysfs/dir.c:101
 __kobject_del+0x9d/0x1a0 lib/kobject.c:604
 kobject_del+0x2e/0x50 lib/kobject.c:627
 device_del+0x70f/0x780 drivers/base/core.c:3891
 device_unregister+0x15/0x40 drivers/base/core.c:3912
 wakeup_source_sysfs_remove+0x25/0x30 drivers/base/power/wakeup_stats.c:208
 wakeup_source_unregister+0xee/0x110 drivers/base/power/wakeup.c:244
 ep_free fs/eventpoll.c:791 [inline]
 ep_clear_and_put+0x1ff/0x260 fs/eventpoll.c:908
 ep_eventpoll_release+0x32/0x50 fs/eventpoll.c:937
 __fput+0x192/0x6f0 fs/file_table.c:422
 ____fput+0x15/0x20 fs/file_table.c:450
 task_work_run+0x13a/0x1a0 kernel/task_work.c:228
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xbe/0x130 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810d3ed948 of 8 bytes by task 5756 on cpu 1:
 kobject_has_children drivers/base/core.c:3340 [inline]
 cleanup_glue_dir+0xe5/0x160 drivers/base/core.c:3406
 device_del+0x71a/0x780 drivers/base/core.c:3892
 device_unregister+0x15/0x40 drivers/base/core.c:3912
 wakeup_source_sysfs_remove+0x25/0x30 drivers/base/power/wakeup_stats.c:208
 wakeup_source_unregister+0xee/0x110 drivers/base/power/wakeup.c:244
 ep_free fs/eventpoll.c:791 [inline]
 ep_clear_and_put+0x1ff/0x260 fs/eventpoll.c:908
 ep_eventpoll_release+0x32/0x50 fs/eventpoll.c:937
 __fput+0x192/0x6f0 fs/file_table.c:422
 ____fput+0x15/0x20 fs/file_table.c:450
 task_work_run+0x13a/0x1a0 kernel/task_work.c:228
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xbe/0x130 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000001 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 5756 Comm: syz.1.407 Not tainted 6.11.0-rc5-syzkaller-00057-g86987d84b968 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/28 10:08 upstream 86987d84b968 6c853ff9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __kernfs_remove / cleanup_glue_dir
* Struck through repros no longer work on HEAD.