syzbot


KCSAN: data-race in unix_inflight / wait_for_unix_gc (2)

Status: auto-closed as invalid on 2021/10/30 17:17
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 471d, last: 436d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in unix_inflight / wait_for_unix_gc 5 540d 588d 0/24 auto-closed as invalid on 2021/07/19 11:30
upstream KCSAN: data-race in unix_inflight / wait_for_unix_gc (3) 1 339d 326d 22/24 fixed on 2022/03/08 16:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc

write to 0xffffffff8419f114 of 4 bytes by task 12238 on cpu 1:
 unix_inflight+0x1e8/0x280 net/unix/scm.c:63
 __io_sqe_files_scm+0x1cf/0x3c0 fs/io_uring.c:8031
 io_sqe_files_scm fs/io_uring.c:8068 [inline]
 io_sqe_files_register+0x49f/0x8f0 fs/io_uring.c:8267
 __do_sys_io_uring_register+0x6f1/0x21a0 fs/io_uring.c:10873
 __se_sys_io_uring_register fs/io_uring.c:10853 [inline]
 __x64_sys_io_uring_register+0x4f/0x60 fs/io_uring.c:10853
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffffffff8419f114 of 4 bytes by task 12239 on cpu 0:
 wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196
 unix_dgram_sendmsg+0x8e/0x1650 net/unix/af_unix.c:1735
 unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2221
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
 __sys_sendmsg_sock+0x25/0x30 net/socket.c:2475
 io_sendmsg fs/io_uring.c:4772 [inline]
 io_issue_sqe+0x2660/0x6300 fs/io_uring.c:6666
 __io_queue_sqe+0x34/0x460 fs/io_uring.c:6952
 io_queue_sqe fs/io_uring.c:7003 [inline]
 io_submit_sqe+0x88b/0x3e90 fs/io_uring.c:7179
 io_submit_sqes+0x505/0xde0 fs/io_uring.c:7285
 __do_sys_io_uring_enter fs/io_uring.c:9943 [inline]
 __se_sys_io_uring_enter+0x20d/0xb30 fs/io_uring.c:9885
 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:9885
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000001 -> 0x00000002

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 12239 Comm: syz-executor.0 Not tainted 5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/09/25 17:16 upstream 7d42e9818258 8cac236e .config log report info KCSAN: data-race in unix_inflight / wait_for_unix_gc
ci2-upstream-kcsan-gce 2021/09/15 02:08 upstream 1619b69edce1 07e953c1 .config log report info KCSAN: data-race in unix_inflight / wait_for_unix_gc
ci2-upstream-kcsan-gce 2021/08/21 19:07 upstream 002c0aef1090 b599f2fc .config log report info KCSAN: data-race in unix_inflight / wait_for_unix_gc
* Struck through repros no longer work on HEAD.