syzbot


DATA RACE in futex.(*waiterList).PushBack

Status: fixed on 2024/06/14 00:33
Fix commit: b58e8a129d62 futex: add missing locking in lockBuckets()
First crash: 173d, last: 173d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000226e60 by goroutine 273:
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*waiterList).PushBack()
      bazel-out/k8-fastbuild/bin/pkg/sentry/kernel/futex/waiter_list.go:117 +0xdc
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).WaitPrepare()
      pkg/sentry/kernel/futex/futex.go:599 +0x2c4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.futexWaitDuration()
      pkg/sentry/syscalls/linux/sys_futex.go:85 +0x10f
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Futex()
      pkg/sentry/syscalls/linux/sys_futex.go:192 +0x8aa
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:263 +0x22f4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x39a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:393 +0x44

Previous read at 0x00c000226e60 by goroutine 271:
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*waiterList).Front()
      bazel-out/k8-fastbuild/bin/pkg/sentry/kernel/futex/waiter_list.go:52 +0x33
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*bucket).requeueLocked()
      pkg/sentry/kernel/futex/futex.go:303 +0x87
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).doRequeue()
      pkg/sentry/kernel/futex/futex.go:514 +0x4bd
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).Requeue()
      pkg/sentry/kernel/futex/futex.go:522 +0xab
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Futex()
      pkg/sentry/syscalls/linux/sys_futex.go:224 +0x224
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:263 +0x22f4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x39a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:393 +0x44

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/06 10:20 gvisor e8ccc27cdf4b 121701b6 .config console log report syz / log C ci-gvisor-systrap-1-race-cover DATA RACE in futex.(*waiterList).PushBack
2024/06/06 06:06 gvisor e8ccc27cdf4b 121701b6 .config console log report syz / log C ci-gvisor-ptrace-2-race-cover DATA RACE in futex.(*waiterList).PushBack
2024/06/06 05:39 gvisor e8ccc27cdf4b 121701b6 .config console log report syz / log C ci-gvisor-ptrace-1-race-cover DATA RACE in futex.(*waiterList).PushBack
* Struck through repros no longer work on HEAD.