syzbot


KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait

Status: auto-closed as invalid on 2020/03/25 18:32
Subsystems: sound
[Documentation on labels]
First crash: 1599d, last: 1576d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in snd_seq_fifo_event_in / snd_seq_fifo_poll_wait

write to 0xffff888113e9da18 of 4 bytes by task 23083 on cpu 0:
 snd_seq_fifo_event_in+0x129/0x230 sound/core/seq/seq_fifo.c:128
 snd_seq_deliver_single_event.constprop.0+0x42c/0x4d0 sound/core/seq/seq_clientmgr.c:632
 snd_seq_deliver_event+0x2e9/0x4c0 sound/core/seq/seq_clientmgr.c:839
 snd_seq_kernel_client_dispatch+0xef/0x110 sound/core/seq/seq_clientmgr.c:2323
 snd_seq_system_notify+0xa4/0xc0 sound/core/seq/seq_system.c:97
 snd_seq_client_notify_subscription+0xa5/0xe0 sound/core/seq/seq_clientmgr.c:1455
 subscribe_port sound/core/seq/seq_ports.c:419 [inline]
 check_and_subscribe_port+0x4c5/0x4e0 sound/core/seq/seq_ports.c:495
 snd_seq_port_connect+0x250/0x300 sound/core/seq/seq_ports.c:569
 snd_seq_ioctl_subscribe_port+0x136/0x1d0 sound/core/seq/seq_clientmgr.c:1484
 snd_seq_kernel_client_ctl+0xbd/0xf0 sound/core/seq/seq_clientmgr.c:2353
 snd_seq_oss_midi_open+0x29e/0x400 sound/core/seq/oss/seq_oss_midi.c:355
 snd_seq_oss_synth_reset+0x2e0/0x4c0 sound/core/seq/oss/seq_oss_synth.c:407
 snd_seq_oss_reset+0x4f/0x170 sound/core/seq/oss/seq_oss_init.c:435
 snd_seq_oss_release+0x6e/0xf0 sound/core/seq/oss/seq_oss_init.c:412
 odev_release+0x49/0x70 sound/core/seq/oss/seq_oss.c:140
 __fput+0x1e1/0x520 fs/file_table.c:280
 ____fput+0x1f/0x30 fs/file_table.c:313
 task_work_run+0xf6/0x130 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x2b4/0x2c0 arch/x86/entry/common.c:164
 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
 do_syscall_64+0x384/0x3a0 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888113e9da18 of 4 bytes by task 23070 on cpu 1:
 snd_seq_fifo_poll_wait+0x6c/0x90 sound/core/seq/seq_fifo.c:220
 snd_seq_poll+0xac/0x1d0 sound/core/seq/seq_clientmgr.c:1135
 vfs_poll include/linux/poll.h:90 [inline]
 do_pollfd fs/select.c:859 [inline]
 do_poll fs/select.c:907 [inline]
 do_sys_poll+0x4ac/0x990 fs/select.c:1001
 __do_sys_ppoll fs/select.c:1101 [inline]
 __se_sys_ppoll fs/select.c:1081 [inline]
 __x64_sys_ppoll+0x161/0x1a0 fs/select.c:1081
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 23070 Comm: syz-executor.2 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/15 18:26 https://github.com/google/ktsan.git kcsan 245a43005292 f9b69507 .config console log report ci2-upstream-kcsan-gce
2020/01/06 12:16 https://github.com/google/ktsan.git kcsan 245a43005292 438e1227 .config console log report ci2-upstream-kcsan-gce
2019/12/24 01:34 https://github.com/google/ktsan.git kcsan 245a43005292 be5c2c81 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.