syzbot


KCSAN: data-race in snd_timer_pause / snd_timer_process_callbacks

Status: auto-closed as invalid on 2020/06/01 05:26
Subsystems: sound
[Documentation on labels]
First crash: 1603d, last: 1488d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_timer_pause / snd_timer_process_callbacks

write to 0xffff8880a36fd110 of 4 bytes by interrupt on cpu 0:
 snd_timer_process_callbacks+0x1b6/0x230 sound/core/timer.c:793
 snd_timer_interrupt sound/core/timer.c:919 [inline]
 snd_timer_interrupt+0x488/0x950 sound/core/timer.c:840
 snd_hrtimer_callback+0x188/0x250 sound/core/hrtimer.c:50
 __run_hrtimer kernel/time/hrtimer.c:1517 [inline]
 __hrtimer_run_queues+0x271/0x600 kernel/time/hrtimer.c:1579
 hrtimer_interrupt+0x226/0x490 kernel/time/hrtimer.c:1641
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1119 [inline]
 smp_apic_timer_interrupt+0xd8/0x270 arch/x86/kernel/apic/apic.c:1144
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:752 [inline]
 kcsan_setup_watchpoint+0x25a/0x440 kernel/kcsan/core.c:530
 should_fail+0x48/0x2fd lib/fault-inject.c:117
 __should_failslab+0x82/0xb0 mm/failslab.c:33
 should_failslab+0x5/0xf mm/slab_common.c:1788
 slab_pre_alloc_hook mm/slab.h:567 [inline]
 slab_alloc mm/slab.c:3306 [inline]
 kmem_cache_alloc+0x23/0x5e0 mm/slab.c:3488
 anon_vma_alloc mm/rmap.c:83 [inline]
 anon_vma_fork+0xf3/0x280 mm/rmap.c:361
 dup_mmap kernel/fork.c:565 [inline]
 dup_mm+0x702/0xb90 kernel/fork.c:1366
 copy_mm kernel/fork.c:1422 [inline]
 copy_process+0x39ad/0x3b10 kernel/fork.c:2092
 _do_fork+0xf7/0x790 kernel/fork.c:2441
 __do_sys_clone kernel/fork.c:2596 [inline]
 __se_sys_clone kernel/fork.c:2577 [inline]
 __x64_sys_clone+0x12e/0x170 kernel/fork.c:2577
 do_syscall_64+0xc7/0x390 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8880a36fd110 of 4 bytes by task 18752 on cpu 1:
 snd_timer_pause+0x1f/0x70 sound/core/timer.c:735
 seq_timer_stop sound/core/seq/seq_timer.c:331 [inline]
 snd_seq_timer_stop+0x7c/0xb0 sound/core/seq/seq_timer.c:341
 snd_seq_queue_process_event sound/core/seq/seq_queue.c:673 [inline]
 snd_seq_control_queue+0x235/0x320 sound/core/seq/seq_queue.c:724
 event_input_timer+0x29/0x40 sound/core/seq/seq_system.c:103
 snd_seq_deliver_single_event.constprop.0+0x403/0x500 sound/core/seq/seq_clientmgr.c:638
 snd_seq_deliver_event+0x2eb/0x4b0 sound/core/seq/seq_clientmgr.c:839
 snd_seq_kernel_client_dispatch+0xe0/0x100 sound/core/seq/seq_clientmgr.c:2323
 send_timer_event.isra.0+0xc9/0x100 sound/core/seq/oss/seq_oss_timer.c:140
 snd_seq_oss_timer_stop.part.0+0x32/0x50 sound/core/seq/oss/seq_oss_timer.c:176
 snd_seq_oss_timer_stop+0x3a/0x50 sound/core/seq/oss/seq_oss_timer.c:174
 snd_seq_oss_reset+0x146/0x160 sound/core/seq/oss/seq_oss_init.c:450
 snd_seq_oss_release+0x6a/0xe0 sound/core/seq/oss/seq_oss_init.c:412
 odev_release+0x45/0x60 sound/core/seq/oss/seq_oss.c:140
 __fput+0x1c3/0x4f0 fs/file_table.c:280
 ____fput+0x1b/0x30 fs/file_table.c:313
 task_work_run+0xf5/0x130 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x2ae/0x2c0 arch/x86/entry/common.c:164
 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
 do_syscall_64+0x36e/0x390 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 18752 Comm: syz-executor.3 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/23 05:25 https://github.com/google/ktsan.git kcsan 40959e34d670 78267cec .config console log report ci2-upstream-kcsan-gce
2020/02/27 21:11 https://github.com/google/ktsan.git kcsan 766d004d1b85 c88c7b75 .config console log report ci2-upstream-kcsan-gce
2020/02/06 14:16 https://github.com/google/ktsan.git kcsan 245a43005292 5be3a391 .config console log report ci2-upstream-kcsan-gce
2020/02/04 21:51 https://github.com/google/ktsan.git kcsan 245a43005292 93e5e335 .config console log report ci2-upstream-kcsan-gce
2020/02/01 13:17 https://github.com/google/ktsan.git kcsan 245a43005292 326d4c78 .config console log report ci2-upstream-kcsan-gce
2020/01/31 21:51 https://github.com/google/ktsan.git kcsan 245a43005292 0eb59c27 .config console log report ci2-upstream-kcsan-gce
2020/01/30 04:13 https://github.com/google/ktsan.git kcsan 245a43005292 5ed23f9a .config console log report ci2-upstream-kcsan-gce
2020/01/26 00:03 https://github.com/google/ktsan.git kcsan 245a43005292 f4e7270e .config console log report ci2-upstream-kcsan-gce
2020/01/14 08:02 https://github.com/google/ktsan.git kcsan 245a43005292 32881205 .config console log report ci2-upstream-kcsan-gce
2019/11/29 10:38 https://github.com/google/ktsan.git kcsan ef798c30ba4e 4f7e1d0f .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.