syzbot


KCSAN: data-race in ktime_get_with_offset / timekeeping_advance

Status: closed as invalid on 2019/10/18 14:11
Subsystems: kernel
[Documentation on labels]
First crash: 1659d, last: 1659d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get_with_offset / timekeeping_advance (2) kernel 12 1624d 1640d 0/26 closed as invalid on 2019/11/19 14:54
upstream KCSAN: data-race in ktime_get_with_offset / timekeeping_advance (3) kernel 6 1489d 1609d 0/26 auto-closed as invalid on 2020/06/04 04:21

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get_with_offset / timekeeping_advance

write to 0xffffffff8603db08 of 280 bytes by interrupt on cpu 0:
 timekeeping_advance+0x893/0xd80 include/linux/string.h:359
 update_wall_time+0x19/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1ae/0x260 kernel/time/tick-sched.c:94
 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138
 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1289
 __run_hrtimer kernel/time/hrtimer.c:1389 [inline]
 __hrtimer_run_queues+0x288/0x600 kernel/time/hrtimer.c:1451
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1509
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 __kcsan_setup_watchpoint+0x62/0x500 kernel/kcsan/core.c:473
 skb_header_pointer include/linux/skbuff.h:3515 [inline]
 tcp_options.isra.0+0xaf/0x360 net/netfilter/nf_conntrack_proto_tcp.c:353
 tcp_in_window net/netfilter/nf_conntrack_proto_tcp.c:566 [inline]
 nf_conntrack_tcp_packet+0x2886/0x3390 net/netfilter/nf_conntrack_proto_tcp.c:1091
 nf_conntrack_handle_packet net/netfilter/nf_conntrack_core.c:1633 [inline]
 nf_conntrack_in+0x410/0xaa0 net/netfilter/nf_conntrack_core.c:1727
 ipv4_conntrack_local+0xbe/0x130 net/netfilter/nf_conntrack_proto.c:200

read to 0xffffffff8603db10 of 8 bytes by interrupt on cpu 1:
 timekeeping_get_delta kernel/time/timekeeping.c:270 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:374 [inline]
 ktime_get_with_offset+0xd4/0x220 kernel/time/timekeeping.c:802
 ktime_get_real include/linux/timekeeping.h:79 [inline]
 __net_timestamp include/linux/skbuff.h:3613 [inline]
 net_timestamp_set net/core/dev.c:1895 [inline]
 dev_queue_xmit_nit+0x3d1/0x540 net/core/dev.c:2049
 xmit_one net/core/dev.c:3276 [inline]
 dev_hard_start_xmit+0x3f5/0x430 net/core/dev.c:3296
 __dev_queue_xmit+0x14ba/0x1b90 net/core/dev.c:3869
 dev_queue_xmit+0x21/0x30 net/core/dev.c:3902
 neigh_hh_output include/net/neighbour.h:500 [inline]
 neigh_output include/net/neighbour.h:509 [inline]
 ip_finish_output2+0x834/0xe40 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip_output+0xdf/0x210 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x45/0x60 include/net/ip.h:236
 __tcp_transmit_skb+0xdeb/0x1cd0 net/ipv4/tcp_output.c:1158

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8252 Comm: syz-executor.3 Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/08 10:54 https://github.com/google/ktsan.git kcsan c1c7521f03c7 64612bfd .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.