KCSAN: data-race in internal_add_timer / timer_clear

KCSAN: data-race in internal_add_timer / timer_clear_idle
Status: moderation: reported on 2020/12/07 11:53
Reported-by: syzbot+b130e0d14518a7e0d5bf@syzkaller.appspotmail.com
First crash: 152d, last: 1d03h

Sample crash report:

==================================================================
BUG: KCSAN: data-race in internal_add_timer / timer_clear_idle

write to 0xffff88813bc1b925 of 1 bytes by task 0 on cpu 0:
 timer_clear_idle+0x1e/0x30 kernel/time/timer.c:1713
 tick_nohz_restart_sched_tick kernel/time/tick-sched.c:916 [inline]
 __tick_nohz_idle_restart_tick+0x20/0x180 kernel/time/tick-sched.c:1210
 tick_nohz_idle_exit+0x104/0x220 kernel/time/tick-sched.c:1251
 do_idle+0x1f6/0x230 kernel/sched/idle.c:313
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:397
 rest_init+0xd7/0xe0 init/main.c:721
 arch_call_rest_init+0xa/0xb
 start_kernel+0x5a1/0x626 init/main.c:1064
 secondary_startup_64_no_verify+0xb0/0xbb

read to 0xffff88813bc1b925 of 1 bytes by interrupt on cpu 1:
 trigger_dyntick_cpu kernel/time/timer.c:568 [inline]
 enqueue_timer kernel/time/timer.c:599 [inline]
 internal_add_timer+0x221/0x2a0 kernel/time/timer.c:609
 __mod_timer+0x7a8/0xc10 kernel/time/timer.c:1060
 mod_timer+0x1b/0x20 kernel/time/timer.c:1106
 sk_reset_timer+0x1f/0xa0 net/core/sock.c:2960
 tcp_send_delayed_ack+0x23e/0x250 net/ipv4/tcp_output.c:3932
 __tcp_ack_snd_check+0x2f9/0x510 net/ipv4/tcp_input.c:5419
 tcp_ack_snd_check net/ipv4/tcp_input.c:5459 [inline]
 tcp_rcv_established+0x9c5/0x1330 net/ipv4/tcp_input.c:5884
 tcp_v4_do_rcv+0x278/0x4a0 net/ipv4/tcp_ipv4.c:1679
 tcp_v4_rcv+0x219f/0x2420 net/ipv4/tcp_ipv4.c:2062
 ip_protocol_deliver_rcu+0x1f9/0x3e0 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x1d6/0x2a0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:458 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:551 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:601 [inline]
 ip_sublist_rcv+0x4c4/0x590 net/ipv4/ip_input.c:609
 ip_list_rcv+0x262/0x290 net/ipv4/ip_input.c:644
 __netif_receive_skb_list_ptype net/core/dev.c:5408 [inline]
 __netif_receive_skb_list_core+0x34b/0x450 net/core/dev.c:5456
 __netif_receive_skb_list+0x262/0x2e0 net/core/dev.c:5508
 netif_receive_skb_list_internal+0xda/0x330 net/core/dev.c:5618
 gro_normal_list net/core/dev.c:5772 [inline]
 napi_complete_done+0x1b2/0x4d0 net/core/dev.c:6474
 virtqueue_napi_complete+0x28/0x80 drivers/net/virtio_net.c:334
 virtnet_poll+0x65f/0x790 drivers/net/virtio_net.c:1455
 __napi_poll+0x77/0x510 net/core/dev.c:6892
 napi_poll net/core/dev.c:6959 [inline]
 net_rx_action+0x29f/0x680 net/core/dev.c:7036
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:422
 common_interrupt+0x80/0x90 arch/x86/kernel/irq.c:240
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:623
 native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:110 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:516 [inline]
 acpi_idle_enter+0x25b/0x2e0 drivers/acpi/processor_idle.c:647
 cpuidle_enter_state+0x2b6/0x7c0 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:158 [inline]
 cpuidle_idle_call kernel/sched/idle.c:239 [inline]
 do_idle+0x193/0x230 kernel/sched/idle.c:300
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:397
 secondary_startup_64_no_verify+0xb0/0xbb

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (16):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Title
ci2-upstream-kcsan-gce	2021/03/06 18:50	upstream	a38fd874	e4b4d570	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/21 10:28	upstream	e767b353	3e5ed8b4	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/17 23:02	upstream	f40ddce8	14052202	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/17 13:53	upstream	f40ddce8	052f8d9f	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/17 02:04	upstream	f40ddce8	98682e5e	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/12 13:30	upstream	dcc0b490	a5f86b15	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/04 21:24	upstream	61556703	42b90a7c	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/04 02:09	upstream	3afe9076	624dad51	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/02/02 02:19	upstream	88bb507a	e6b95f32	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/01/20 10:04	upstream	45dfb8a5	d4f4eca5	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2021/01/18 16:32	upstream	19c329f6	63631df1	.config	log	report	info	KCSAN: data-race in internal_add_timer / timer_clear_idle
ci2-upstream-kcsan-gce	2020/12/22 11:55	upstream	8653b778	04201c06	.config	log	report	info
ci2-upstream-kcsan-gce	2020/11/20 22:39	upstream	4d02da97	68068804	.config	log	report	info
ci2-upstream-kcsan-gce	2020/11/17 23:08	upstream	111e91a6	09323409	.config	log	report	info
ci2-upstream-kcsan-gce	2020/10/26 08:12	upstream	986b9eac	a1839e81	.config	log	report	info
ci2-upstream-kcsan-gce	2020/10/06 09:53	upstream	7575fdda	1880b4a9	.config	log	report	info