DATA RACE in safemem.Copy (7)

Status: fixed on 2023/12/29 10:22
Fix commit: de71aae89aed `seccomp`: Use dedicated input buffer for populating seccomp cache.
First crash: 976d, last: 976d
▶ ▼ Duplicate bugs (1)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
DATA RACE in binary.littleEndian.Uint32 -1 syz, C 1 976d 976d 26/26 closed as dup on 2023/12/27 16:41
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor DATA RACE in safemem.Copy (3) -1 syz, C 3 1801d 1801d 14/26 fixed on 2021/09/28 10:18
gvisor DATA RACE in safemem.Copy -1 syz, C 4 2044d 2044d 14/26 fixed on 2021/01/26 10:37
gvisor DATA RACE in safemem.Copy (6) -1 syz, C 121 1368d 1368d 26/26 fixed on 2023/10/05 23:05
gvisor DATA RACE in safemem.Copy (2) -1 syz, C 9 1848d 1848d 14/26 fixed on 2021/08/16 21:45
gvisor DATA RACE in safemem.Copy (4) -1 syz, C 1019 1477d 1480d 14/26 fixed on 2022/11/18 03:22
gvisor DATA RACE in safemem.Copy (5) -1 syz, C 3153 1368d 1378d 14/26 fixed on 2022/11/29 11:04

Sample crash report:
WARNING: DATA RACE
Write at 0x00c001ccfe40 by goroutine 6663:
  runtime.slicecopy()
      GOROOT/src/runtime/slice.go:310 +0x0
  gvisor.dev/gvisor/pkg/safemem.Copy()
      pkg/safemem/block_unsafe.go:195 +0x2a8
  gvisor.dev/gvisor/pkg/safemem.CopySeq()
      pkg/safemem/seq_unsafe.go:279 +0x227
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).CopyIn.func1()
      pkg/sentry/mm/io.go:164 +0xad
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).withInternalMappings()
      pkg/sentry/mm/io.go:522 +0x186
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).CopyIn()
      pkg/sentry/mm/io.go:163 +0x264
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).CopyInBytes()
      pkg/sentry/kernel/task_usermem.go:57 +0x91
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.copyTimespecIn()
      pkg/sentry/syscalls/linux/timespec.go:32 +0x84
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.ClockNanosleep()
      pkg/sentry/syscalls/linux/sys_time.go:206 +0x6a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:142 +0x8b4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:322 +0x6b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:282 +0x86
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:257 +0x4ef
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x1e07
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x43a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
      pkg/sentry/kernel/task_start.go:392 +0x44

Previous read at 0x00c001ccfe46 by goroutine 6691:
  encoding/binary.littleEndian.Uint32()
      GOROOT/src/encoding/binary/binary.go:81 +0x34d
  gvisor.dev/gvisor/pkg/bpf.load32[go.shape.uint32]()
      pkg/bpf/input_bytes.go:64 +0x29d
  gvisor.dev/gvisor/pkg/bpf.InstrumentedExec[go.shape.uint32]()
      pkg/bpf/interpreter.go:535 +0x649
  gvisor.dev/gvisor/pkg/sentry/kernel.checkFilterCacheability()
      pkg/sentry/kernel/seccomp.go:212 +0x2f6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*taskSeccomp).populateCache()
      pkg/sentry/kernel/seccomp.go:248 +0x2a4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).AppendSyscallFilter()
      pkg/sentry/kernel/seccomp.go:301 +0x7f3
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.seccomp()
      pkg/sentry/syscalls/linux/sys_seccomp.go:76 +0x3c4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Seccomp()
      pkg/sentry/syscalls/linux/sys_seccomp.go:81 +0x35
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:142 +0x8b4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:322 +0x6b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:282 +0x86
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:257 +0x4ef
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x1e07
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x43a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
      pkg/sentry/kernel/task_start.go:392 +0x44

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/12/26 06:46 gvisor 149350e5c428 fb427a07 .config console log report syz C ci-gvisor-ptrace-2-race DATA RACE in safemem.Copy
2023/12/26 06:46 gvisor 149350e5c428 fb427a07 .config console log report syz C ci-gvisor-ptrace-1-race DATA RACE in safemem.Copy
2023/12/26 06:31 gvisor 149350e5c428 fb427a07 .config console log report syz C ci-gvisor-systrap-1-race DATA RACE in safemem.Copy
2023/12/26 06:23 gvisor 149350e5c428 fb427a07 .config console log report info ci-gvisor-systrap-1-race DATA RACE in safemem.Copy
* Struck through repros no longer work on HEAD.