syzbot


KCSAN: data-race in setattr_copy / vfs_getattr_nosec (3)

Status: auto-closed as invalid on 2021/09/29 03:05
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 467d, last: 467d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in setattr_copy / vfs_getattr_nosec (2) 1 547d 547d 0/24 auto-closed as invalid on 2021/07/10 19:21
upstream KCSAN: data-race in setattr_copy / vfs_getattr_nosec 3 583d 587d 0/24 auto-closed as invalid on 2021/06/05 13:09
upstream KCSAN: data-race in setattr_copy / vfs_getattr_nosec (4) 1 355d 355d 0/24 auto-closed as invalid on 2022/01/18 19:17

Sample crash report:
loop5: detected capacity change from 0 to 1
 loop5: p1 p2 p3 p4
loop5: p1 start 10 is beyond EOD, truncated
loop5: p2 size 1073872896 extends beyond EOD, truncated
loop5: p3 start 225 is beyond EOD, truncated
loop5: p4 start 2415919104 is beyond EOD, truncated
==================================================================
BUG: KCSAN: data-race in setattr_copy / vfs_getattr_nosec

write to 0xffff888152475d90 of 2 bytes by task 19 on cpu 1:
 setattr_copy+0x1af/0x1c0 fs/attr.c:247
 shmem_setattr+0xb0/0x450 mm/shmem.c:1118
 notify_change+0x8a3/0xa80 fs/attr.c:398
 handle_remove drivers/base/devtmpfs.c:333 [inline]
 handle drivers/base/devtmpfs.c:382 [inline]
 devtmpfs_work_loop+0x783/0x8d0 drivers/base/devtmpfs.c:395
 devtmpfsd+0x3f/0x40 drivers/base/devtmpfs.c:437
 kthread+0x262/0x280 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

read to 0xffff888152475d90 of 2 bytes by task 13012 on cpu 0:
 generic_fillattr fs/stat.c:48 [inline]
 vfs_getattr_nosec+0x1a5/0x2f0 fs/stat.c:108
 vfs_getattr fs/stat.c:142 [inline]
 vfs_statx+0x128/0x290 fs/stat.c:207
 vfs_fstatat fs/stat.c:225 [inline]
 vfs_stat include/linux/fs.h:3382 [inline]
 __do_sys_newstat fs/stat.c:367 [inline]
 __se_sys_newstat+0x46/0x250 fs/stat.c:363
 __x64_sys_newstat+0x2d/0x40 fs/stat.c:363
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x6180 -> 0x6000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13012 Comm: syz-executor.5 Tainted: G        W         5.14.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
loop5: detected capacity change from 0 to 1
 loop5: p1 p2 p3 p4
loop5: p1 start 10 is beyond EOD, truncated
loop5: p2 size 1073872896 extends beyond EOD, truncated
loop5: p3 start 225 is beyond EOD, truncated
loop5: p4 start 2415919104 is beyond EOD, truncated

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/08/25 02:56 upstream 6e764bcd1cf7 b599f2fc .config log report info KCSAN: data-race in setattr_copy / vfs_getattr_nosec
* Struck through repros no longer work on HEAD.