syzbot


KCSAN: data-race in drop_nlink / vfs_getattr_nosec (5)

Status: auto-closed as invalid on 2021/12/15 06:52
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 388d, last: 388d
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in drop_nlink / vfs_getattr_nosec (6) 1 325d 325d 0/24 auto-closed as invalid on 2022/02/16 06:56
upstream KCSAN: data-race in drop_nlink / vfs_getattr_nosec (3) 2 486d 505d 0/24 auto-closed as invalid on 2021/09/07 16:42
upstream KCSAN: data-race in drop_nlink / vfs_getattr_nosec 1 626d 626d 0/24 auto-closed as invalid on 2021/04/21 10:41
upstream KCSAN: data-race in drop_nlink / vfs_getattr_nosec (2) 6 553d 585d 0/24 auto-closed as invalid on 2021/07/03 10:04
upstream KCSAN: data-race in drop_nlink / vfs_getattr_nosec (4) 1 432d 432d 0/24 auto-closed as invalid on 2021/11/01 05:59

Sample crash report:
loop4: detected capacity change from 0 to 264192
 loop4: p1 < > p2 p3 p4
loop4: p2 size 1073741824 extends beyond EOD, truncated
loop4: p3 size 1912633224 extends beyond EOD, truncated
==================================================================
BUG: KCSAN: data-race in drop_nlink / vfs_getattr_nosec

write to 0xffff888104eb90c0 of 4 bytes by task 21 on cpu 0:
 drop_nlink+0x37/0x90 fs/inode.c:309
 shmem_unlink+0x17b/0x1a0 mm/shmem.c:2948
 vfs_unlink+0x257/0x450 fs/namei.c:4100
 handle_remove drivers/base/devtmpfs.c:335 [inline]
 handle drivers/base/devtmpfs.c:382 [inline]
 devtmpfs_work_loop+0x87c/0x930 drivers/base/devtmpfs.c:395
 devtmpfsd+0x3f/0x40 drivers/base/devtmpfs.c:437
 kthread+0x2c7/0x2e0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

read to 0xffff888104eb90c0 of 4 bytes by task 1102 on cpu 1:
 generic_fillattr fs/stat.c:49 [inline]
 vfs_getattr_nosec+0x1c1/0x2f0 fs/stat.c:126
 vfs_getattr fs/stat.c:160 [inline]
 vfs_statx+0x138/0x2a0 fs/stat.c:225
 vfs_fstatat fs/stat.c:243 [inline]
 vfs_stat include/linux/fs.h:3354 [inline]
 __do_sys_newstat fs/stat.c:385 [inline]
 __se_sys_newstat+0x5d/0x250 fs/stat.c:381
 __x64_sys_newstat+0x2d/0x40 fs/stat.c:381
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 1102 Comm: syz-executor.4 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/11/10 06:43 upstream cb690f5238d7 55fa030c .config log report info KCSAN: data-race in drop_nlink / vfs_getattr_nosec
* Struck through repros no longer work on HEAD.