syzbot


KCSAN: data-race in complete_signal / do_nanosleep

Status: auto-closed as invalid on 2020/04/17 00:04
Subsystems: kernel
[Documentation on labels]
First crash: 1511d, last: 1511d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in complete_signal / do_nanosleep (2) kernel 2 1353d 1378d 0/26 auto-closed as invalid on 2020/08/18 02:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in complete_signal / do_nanosleep

read to 0xffff88811dcab0d0 of 8 bytes by interrupt on cpu 1:
 wants_signal kernel/signal.c:978 [inline]
 complete_signal+0xcd/0x5e0 kernel/signal.c:995
 send_sigqueue+0x2cf/0x4b0 kernel/signal.c:1879
 posix_timer_event kernel/time/posix-timers.c:328 [inline]
 posix_timer_fn+0x10d/0x230 kernel/time/posix-timers.c:354
 __run_hrtimer kernel/time/hrtimer.c:1517 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1579
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1641
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 __read_once_size.constprop.0+0x16/0x20 include/linux/compiler.h:232
 compound_head include/linux/page-flags.h:174 [inline]
 check_heap_object mm/usercopy.c:236 [inline]
 __check_object_size+0x18c/0x346 mm/usercopy.c:286
 check_object_size include/linux/thread_info.h:119 [inline]
 check_copy_size include/linux/thread_info.h:152 [inline]
 copy_from_user include/linux/uaccess.h:143 [inline]
 rw_copy_check_uvector+0xa3/0x270 fs/read_write.c:798
 import_iovec+0x67/0x220 lib/iov_iter.c:1678
 vfs_readv+0x72/0xf0 fs/read_write.c:995
 do_readv+0x20f/0x250 fs/read_write.c:1034
 __do_sys_readv fs/read_write.c:1125 [inline]
 __se_sys_readv fs/read_write.c:1122 [inline]
 __x64_sys_readv+0x4e/0x60 fs/read_write.c:1122
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff88811dcab0d0 of 8 bytes by task 9521 on cpu 0:
 do_nanosleep+0x1da/0x320 kernel/time/hrtimer.c:1881
 hrtimer_nanosleep_restart+0x72/0xa0 kernel/time/hrtimer.c:1908
 __ia32_sys_restart_syscall+0x3a/0x50 kernel/signal.c:2870
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9521 Comm: syz-executor.2 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/06 23:59 https://github.com/google/ktsan.git kcsan 245a43005292 06150bf1 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.