syzbot


KCSAN: data-race in snd_timer_interrupt / snd_timer_pause (3)

Status: auto-closed as invalid on 2021/04/29 16:51
Subsystems: sound
[Documentation on labels]
First crash: 1125d, last: 1125d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in snd_timer_interrupt / snd_timer_pause (2) sound 1 1299d 1299d 0/26 auto-closed as invalid on 2020/11/06 04:33
upstream KCSAN: data-race in snd_timer_interrupt / snd_timer_pause sound 1 1358d 1358d 0/26 auto-closed as invalid on 2020/09/08 04:08

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_timer_interrupt / snd_timer_pause

write to 0xffff888026f81610 of 4 bytes by interrupt on cpu 1:
 snd_timer_reschedule sound/core/timer.c:756 [inline]
 snd_timer_interrupt+0x6a3/0xb40 sound/core/timer.c:902
 snd_hrtimer_callback+0x13f/0x220 sound/core/hrtimer.c:50
 __run_hrtimer+0x163/0x460 kernel/time/hrtimer.c:1537
 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline]
 hrtimer_interrupt+0x380/0xaf0 kernel/time/hrtimer.c:1663
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
 __sysvec_apic_timer_interrupt+0x6f/0x200 arch/x86/kernel/apic/apic.c:1106
 sysvec_apic_timer_interrupt+0x69/0x80 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
 smap_restore arch/x86/include/asm/smap.h:70 [inline]
 kcsan_setup_watchpoint+0x436/0x470 kernel/kcsan/core.c:590
 tomoyo_check_acl+0xad/0x220 security/tomoyo/domain.c:173
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_perm+0x22f/0x330 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x18/0x20 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x7f/0xd0 security/security.c:1288
 vfs_getattr fs/stat.c:131 [inline]
 vfs_statx+0xf8/0x290 fs/stat.c:199
 vfs_fstatat fs/stat.c:217 [inline]
 __do_sys_newfstatat fs/stat.c:386 [inline]
 __se_sys_newfstatat+0x4c/0x250 fs/stat.c:380
 __x64_sys_newfstatat+0x51/0x60 fs/stat.c:380
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888026f81610 of 4 bytes by task 13661 on cpu 0:
 snd_timer_pause+0x13/0x50 sound/core/timer.c:735
 seq_timer_stop sound/core/seq/seq_timer.c:331 [inline]
 snd_seq_timer_stop+0x8e/0xb0 sound/core/seq/seq_timer.c:341
 snd_seq_queue_process_event sound/core/seq/seq_queue.c:654 [inline]
 snd_seq_control_queue+0x36a/0x540 sound/core/seq/seq_queue.c:705
 event_input_timer+0x1e/0x30 sound/core/seq/seq_system.c:103
 snd_seq_deliver_single_event+0x31e/0x4f0 sound/core/seq/seq_clientmgr.c:637
 snd_seq_deliver_event+0x18b/0x4a0 sound/core/seq/seq_clientmgr.c:838
 snd_seq_kernel_client_dispatch+0x16f/0x190 sound/core/seq/seq_clientmgr.c:2322
 send_timer_event sound/core/seq/oss/seq_oss_timer.c:140 [inline]
 snd_seq_oss_timer_stop sound/core/seq/oss/seq_oss_timer.c:176 [inline]
 snd_seq_oss_timer_start+0xb5/0x1d0 sound/core/seq/oss/seq_oss_timer.c:153
 old_event sound/core/seq/oss/seq_oss_event.c:113 [inline]
 snd_seq_oss_process_event+0xcde/0xf30 sound/core/seq/oss/seq_oss_event.c:88
 insert_queue sound/core/seq/oss/seq_oss_rw.c:166 [inline]
 snd_seq_oss_write+0x319/0x550 sound/core/seq/oss/seq_oss_rw.c:135
 odev_write+0x45/0x60 sound/core/seq/oss/seq_oss.c:164
 vfs_write+0x223/0x7e0 fs/read_write.c:603
 ksys_write+0xce/0x180 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __x64_sys_write+0x3e/0x50 fs/read_write.c:667
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13661 Comm: syz-executor.2 Not tainted 5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/25 16:43 upstream e138138003eb 6a383ecf .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in snd_timer_interrupt / snd_timer_pause
* Struck through repros no longer work on HEAD.