syzbot


KCSAN: data-race in __hrtimer_run_queues / dummy_hrtimer_stop

Status: auto-closed as invalid on 2020/06/01 12:09
Subsystems: kernel
[Documentation on labels]
First crash: 1495d, last: 1495d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __hrtimer_run_queues / dummy_hrtimer_stop

write to 0xffff88812c01fe18 of 8 bytes by interrupt on cpu 0:
 __run_hrtimer kernel/time/hrtimer.c:1488 [inline]
 __hrtimer_run_queues+0x1e4/0x600 kernel/time/hrtimer.c:1579
 hrtimer_run_softirq+0xeb/0x120 kernel/time/hrtimer.c:1596
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xb5/0xd0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe2/0x270 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 get_current arch/x86/include/asm/current.h:15 [inline]
 write_comp_data+0x9/0x70 kernel/kcov.c:207
 __sanitizer_cov_trace_switch+0x45/0x70 kernel/kcov.c:310
 __read_once_size+0x20/0xd0 include/linux/compiler.h:232
 compound_head include/linux/page-flags.h:174 [inline]
 PageActive include/linux/page-flags.h:321 [inline]
 mark_page_accessed+0x1e4/0x4f0 mm/swap.c:385
 touch_buffer fs/buffer.c:63 [inline]
 __find_get_block+0x239/0x740 fs/buffer.c:1340
 sb_find_get_block include/linux/buffer_head.h:338 [inline]
 recently_deleted fs/ext4/ialloc.c:680 [inline]
 find_inode_bit.isra.0+0x161/0x310 fs/ext4/ialloc.c:720
 __ext4_new_inode+0xd5f/0x2f30 fs/ext4/ialloc.c:912
 ext4_create+0x240/0x300 fs/ext4/namei.c:2606
 lookup_open fs/namei.c:3309 [inline]
 do_last fs/namei.c:3401 [inline]
 path_openat+0x28cf/0x2f70 fs/namei.c:3607
 do_filp_open+0x11e/0x1b0 fs/namei.c:3637
 do_sys_openat2+0x4f5/0x620 fs/open.c:1149
 do_sys_open+0xa2/0x110 fs/open.c:1165
 ksys_open include/linux/syscalls.h:1386 [inline]
 __do_sys_open fs/open.c:1171 [inline]
 __se_sys_open fs/open.c:1169 [inline]
 __x64_sys_open+0x50/0x60 fs/open.c:1169
 do_syscall_64+0xc7/0x390 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88812c01fe18 of 8 bytes by task 19064 on cpu 1:
 hrtimer_callback_running include/linux/hrtimer.h:479 [inline]
 dummy_hrtimer_stop+0x88/0xd0 sound/drivers/dummy.c:401
 dummy_pcm_trigger sound/drivers/dummy.c:490 [inline]
 dummy_pcm_trigger+0xe7/0x100 sound/drivers/dummy.c:482
 snd_pcm_do_stop sound/core/pcm_native.c:1407 [inline]
 snd_pcm_do_stop+0xda/0xe0 sound/core/pcm_native.c:1402
 snd_pcm_action_single+0x56/0xc0 sound/core/pcm_native.c:1194
 snd_pcm_action+0x7d/0x90 sound/core/pcm_native.c:1277
 snd_pcm_stop sound/core/pcm_native.c:1442 [inline]
 snd_pcm_drop+0xd1/0x120 sound/core/pcm_native.c:2120
 snd_pcm_kernel_ioctl+0x108/0x1b0 sound/core/pcm_native.c:3309
 snd_pcm_oss_sync.isra.0+0x180/0x4e0 sound/core/oss/pcm_oss.c:1710
 snd_pcm_oss_release+0x160/0x170 sound/core/oss/pcm_oss.c:2545
 __fput+0x1c3/0x4f0 fs/file_table.c:280
 ____fput+0x1b/0x30 fs/file_table.c:313
 task_work_run+0xf5/0x130 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x2ae/0x2c0 arch/x86/entry/common.c:164
 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
 do_syscall_64+0x36e/0x390 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19064 Comm: syz-executor.1 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/23 12:01 https://github.com/google/ktsan.git kcsan 40959e34d670 78267cec .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.