syzbot


KCSAN: data-race in __io_uring_register / unix_notinflight

Status: auto-closed as invalid on 2020/01/27 21:46
Subsystems: fs
[Documentation on labels]
First crash: 1619d, last: 1619d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __io_uring_register / unix_notinflight

read to 0xffffffff85a76528 of 8 bytes by task 27116 on cpu 0:
 __io_sqe_files_scm fs/io_uring.c:3008 [inline]
 io_sqe_files_scm fs/io_uring.c:3059 [inline]
 io_sqe_files_register fs/io_uring.c:3136 [inline]
 __io_uring_register+0x10f8/0x1490 fs/io_uring.c:3942
 __do_sys_io_uring_register fs/io_uring.c:3991 [inline]
 __se_sys_io_uring_register fs/io_uring.c:3973 [inline]
 __x64_sys_io_uring_register+0x11b/0x140 fs/io_uring.c:3973
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffffffff85a76528 of 8 bytes by task 27101 on cpu 1:
 unix_notinflight+0x127/0x220 net/unix/scm.c:84
 unix_detach_fds+0xc0/0xf0 net/unix/scm.c:133
 unix_destruct_scm+0x83/0x100 net/unix/scm.c:144
 io_destruct_skb+0x98/0xb0 fs/io_uring.c:2992
 skb_release_head_state+0xb8/0x180 net/core/skbuff.c:652
 skb_release_all+0x1f/0x60 net/core/skbuff.c:663
 __kfree_skb net/core/skbuff.c:679 [inline]
 kfree_skb net/core/skbuff.c:697 [inline]
 kfree_skb+0x98/0x1d0 net/core/skbuff.c:691
 __io_sqe_files_unregister fs/io_uring.c:2931 [inline]
 io_sqe_files_unregister+0x80/0x100 fs/io_uring.c:2946
 io_ring_ctx_free fs/io_uring.c:3536 [inline]
 io_ring_ctx_wait_and_kill+0x253/0x410 fs/io_uring.c:3594
 io_uring_release+0x4b/0x60 fs/io_uring.c:3602
 __fput+0x1e1/0x520 fs/file_table.c:280
 ____fput+0x1f/0x30 fs/file_table.c:313
 task_work_run+0xf6/0x130 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x2b4/0x2c0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x353/0x370 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 27101 Comm: syz-executor.1 Not tainted 5.4.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/18 21:43 https://github.com/google/ktsan.git kcsan 5863cc791e4c d5696d51 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.