syzbot


KCSAN: data-race in pollwake / pollwake (2)

Status: auto-closed as invalid on 2020/03/29 13:20
Subsystems: fs
[Documentation on labels]
First crash: 1598d, last: 1557d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in pollwake / pollwake (4) ext4 200 17d 138d 0/26 moderation: reported on 2023/12/08 00:04
upstream KCSAN: data-race in pollwake / pollwake (3) fs 4 1265d 1234d 0/26 auto-closed as invalid on 2020/12/21 11:54
upstream KCSAN: data-race in pollwake / pollwake fs 1 1643d 1643d 0/26 closed as invalid on 2019/11/19 13:44

Sample crash report:
==================================================================
BUG: KCSAN: data-race in pollwake / pollwake

write to 0xffffc9000246ba20 of 4 bytes by interrupt on cpu 1:
 __pollwake fs/select.c:197 [inline]
 pollwake+0xe3/0x140 fs/select.c:217
 __wake_up_common+0x7b/0x180 kernel/sched/wait.c:93
 __wake_up_common_lock+0x77/0xb0 kernel/sched/wait.c:123
 __wake_up+0xe/0x10 kernel/sched/wait.c:142
 snd_pcm_update_state+0x29e/0x330 sound/core/pcm_lib.c:198
 snd_pcm_update_hw_ptr0+0xa05/0x1280 sound/core/pcm_lib.c:453
 snd_pcm_period_elapsed+0x10d/0x1a0 sound/core/pcm_lib.c:1794
 dummy_hrtimer_callback+0x9e/0x110 sound/drivers/dummy.c:378
 __run_hrtimer kernel/time/hrtimer.c:1517 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1579
 hrtimer_run_softirq+0x10e/0x150 kernel/time/hrtimer.c:1596
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 start_secondary+0x168/0x1b0 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

write to 0xffffc9000246ba20 of 4 bytes by interrupt on cpu 0:
 __pollwake fs/select.c:197 [inline]
 pollwake+0xe3/0x140 fs/select.c:217
 __wake_up_common+0x7b/0x180 kernel/sched/wait.c:93
 __wake_up_common_lock+0x77/0xb0 kernel/sched/wait.c:123
 __wake_up+0xe/0x10 kernel/sched/wait.c:142
 ring_buffer_wakeup kernel/events/core.c:5617 [inline]
 perf_event_wakeup+0x8c/0x160 kernel/events/core.c:6039
 perf_pending_event+0x12d/0x170 kernel/events/core.c:6098
 irq_work_run_list+0x136/0x190 kernel/irq_work.c:156
 irq_work_run+0x48/0xa0 kernel/irq_work.c:172
 smp_irq_work_interrupt+0x3f/0x100 arch/x86/kernel/irq_work.c:21
 irq_work_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:860
 write_comp_data+0x0/0x70 kernel/kcov.c:197
 __read_once_size+0x25/0xe0 include/linux/compiler.h:232
 pipe_poll+0x9c/0x230 fs/pipe.c:635
 vfs_poll include/linux/poll.h:90 [inline]
 do_select+0x7d0/0x1020 fs/select.c:534
 core_sys_select+0x312/0x650 fs/select.c:677
 do_pselect.constprop.0+0x11d/0x160 fs/select.c:759
 __do_sys_pselect6 fs/select.c:784 [inline]
 __se_sys_pselect6 fs/select.c:769 [inline]
 __x64_sys_pselect6+0x12e/0x170 fs/select.c:769
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 29164 Comm: syz-executor.4 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/19 13:13 https://github.com/google/ktsan.git kcsan 245a43005292 bc8bc756 .config console log report ci2-upstream-kcsan-gce
2019/12/08 21:46 https://github.com/google/ktsan.git kcsan ef798c30ba4e 1508f453 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.