syzbot


KCSAN: data-race in kvm_write_tsc / pvclock_gtod_notify

Status: closed as invalid on 2019/11/19 13:54
Subsystems: kvm
[Documentation on labels]
First crash: 1645d, last: 1633d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kvm_write_tsc / pvclock_gtod_notify

write to 0xffffffff85fde628 of 4 bytes by interrupt on cpu 1:
 update_pvclock_gtod arch/x86/kvm/x86.c:1551 [inline]
 pvclock_gtod_notify+0x9f/0x260 arch/x86/kvm/x86.c:7123
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:95
 __raw_notifier_call_chain kernel/notifier.c:396 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:403
 update_pvclock_gtod kernel/time/timekeeping.c:578 [inline]
 timekeeping_update+0x1b5/0x2d0 kernel/time/timekeeping.c:672
 timekeeping_advance+0x87d/0xd80 kernel/time/timekeeping.c:2120
 update_wall_time+0x19/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1a4/0x250 kernel/time/tick-sched.c:94
 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138
 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1292
 __run_hrtimer kernel/time/hrtimer.c:1514 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1576
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1638
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline]
 kcsan_setup_watchpoint+0x205/0x410 kernel/kcsan/core.c:369
 check_access kernel/kcsan/core.c:409 [inline]
 __tsan_read8+0x145/0x1f0 kernel/kcsan/core.c:530
 tomoyo_domain_quota_is_ok+0xce/0x2b0 security/tomoyo/util.c:1031
 tomoyo_supervisor+0x22b/0xd20 security/tomoyo/common.c:2087
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x121/0x160 security/tomoyo/file.c:573
 tomoyo_path_perm+0x23e/0x390 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x26/0x40 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0x9b/0xd0 security/security.c:1222
 vfs_getattr+0x2e/0x70 fs/stat.c:115
 vfs_statx+0x102/0x190 fs/stat.c:191
 vfs_lstat include/linux/fs.h:3247 [inline]
 __do_sys_newlstat+0x51/0xb0 fs/stat.c:354
 __se_sys_newlstat fs/stat.c:348 [inline]
 __x64_sys_newlstat+0x3a/0x50 fs/stat.c:348
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff85fde628 of 4 bytes by task 13528 on cpu 0:
 kvm_track_tsc_matching arch/x86/kvm/x86.c:1766 [inline]
 kvm_write_tsc+0x41f/0xaf0 arch/x86/kvm/x86.c:1942
 kvm_arch_vcpu_postcreate+0xd5/0x160 arch/x86/kvm/x86.c:9068
 kvm_vm_ioctl_create_vcpu arch/x86/kvm/../../../virt/kvm/kvm_main.c:2700 [inline]
 kvm_vm_ioctl+0xe1a/0x1190 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3212
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x991/0xc60 fs/ioctl.c:696
 ksys_ioctl+0xbd/0xe0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x4c/0x60 fs/ioctl.c:718
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13528 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/05 19:28 https://github.com/google/ktsan.git kcsan 94c006602e13 af5c522d .config console log report ci2-upstream-kcsan-gce
2019/11/01 19:40 https://github.com/google/ktsan.git kcsan 05f2236801fe 997ccc67 .config console log report ci2-upstream-kcsan-gce
2019/10/24 15:29 https://github.com/google/ktsan.git kcsan 05f2236801fe d01bb02a .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.