syzbot


KCSAN: data-race in snd_timer_pause / snd_timer_reschedule

Status: auto-closed as invalid on 2020/04/18 19:34
Subsystems: sound
[Documentation on labels]
First crash: 1567d, last: 1538d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_timer_pause / snd_timer_reschedule

write to 0xffff88809c587e10 of 4 bytes by interrupt on cpu 0:
 snd_timer_reschedule+0x9f/0x220 sound/core/timer.c:710
 snd_timer_interrupt sound/core/timer.c:856 [inline]
 snd_timer_interrupt+0x79d/0x930 sound/core/timer.c:794
 snd_hrtimer_callback+0x18f/0x260 sound/core/hrtimer.c:50
 __run_hrtimer kernel/time/hrtimer.c:1517 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1579
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1641
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 __read_once_size include/linux/compiler.h:232 [inline]
 check_kcov_mode kernel/kcov.c:155 [inline]
 write_comp_data+0x1e/0x70 kernel/kcov.c:208
 tomoyo_domain_quota_is_ok+0x234/0x2b0 security/tomoyo/util.c:1069
 tomoyo_supervisor+0x22b/0xd20 security/tomoyo/common.c:2087
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x121/0x160 security/tomoyo/file.c:573
 tomoyo_check_open_permission+0x2fd/0x320 security/tomoyo/file.c:777
 tomoyo_file_open security/tomoyo/tomoyo.c:319 [inline]
 tomoyo_file_open+0x75/0x90 security/tomoyo/tomoyo.c:314
 security_file_open+0x69/0x210 security/security.c:1497
 do_dentry_open+0x211/0x970 fs/open.c:784
 vfs_open+0x62/0x80 fs/open.c:914
 do_last fs/namei.c:3420 [inline]
 path_openat+0xf9f/0x3580 fs/namei.c:3537
 do_filp_open+0x11e/0x1b0 fs/namei.c:3567
 do_sys_open+0x3b3/0x4f0 fs/open.c:1097
 __do_sys_openat fs/open.c:1124 [inline]
 __se_sys_openat fs/open.c:1118 [inline]
 __x64_sys_openat+0x62/0x80 fs/open.c:1118
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88809c587e10 of 4 bytes by task 11395 on cpu 1:
 snd_timer_pause+0x22/0x70 sound/core/timer.c:689
 seq_timer_stop sound/core/seq/seq_timer.c:331 [inline]
 snd_seq_timer_stop+0x88/0xc0 sound/core/seq/seq_timer.c:341
 snd_seq_queue_process_event sound/core/seq/seq_queue.c:673 [inline]
 snd_seq_control_queue+0x24f/0x350 sound/core/seq/seq_queue.c:724
 event_input_timer+0x2f/0x50 sound/core/seq/seq_system.c:103
 snd_seq_deliver_single_event.constprop.0+0x3e8/0x4d0 sound/core/seq/seq_clientmgr.c:638
 snd_seq_deliver_event+0x2e9/0x4c0 sound/core/seq/seq_clientmgr.c:839
 snd_seq_kernel_client_dispatch+0xef/0x110 sound/core/seq/seq_clientmgr.c:2323
 send_timer_event.isra.0+0xbf/0xf0 sound/core/seq/oss/seq_oss_timer.c:140
 snd_seq_oss_timer_stop.part.0+0x35/0x50 sound/core/seq/oss/seq_oss_timer.c:176
 snd_seq_oss_timer_stop sound/core/seq/oss/seq_oss_timer.c:174 [inline]
 snd_seq_oss_timer_start+0x14e/0x160 sound/core/seq/oss/seq_oss_timer.c:153
 old_event sound/core/seq/oss/seq_oss_event.c:113 [inline]
 snd_seq_oss_process_event+0x6ee/0xe20 sound/core/seq/oss/seq_oss_event.c:88
 insert_queue sound/core/seq/oss/seq_oss_rw.c:166 [inline]
 snd_seq_oss_write+0x194/0x510 sound/core/seq/oss/seq_oss_rw.c:135
 odev_write+0x51/0x80 sound/core/seq/oss/seq_oss.c:164
 __vfs_write+0x67/0xc0 fs/read_write.c:494
 vfs_write fs/read_write.c:558 [inline]
 vfs_write+0x18a/0x390 fs/read_write.c:542
 ksys_write+0xd5/0x1b0 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x4c/0x60 fs/read_write.c:620
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 11395 Comm: syz-executor.4 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/08 19:30 https://github.com/google/ktsan.git kcsan f60f0f543333 06150bf1 .config console log report ci2-upstream-kcsan-gce
2020/01/10 16:27 https://github.com/google/ktsan.git kcsan 245a43005292 532ec44e .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.