syzbot


KCSAN: data-race in ktime_get / timekeeping_advance (2)

Status: auto-closed as invalid on 2020/05/14 01:36
Subsystems: kernel
[Documentation on labels]
First crash: 1535d, last: 1485d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get / timekeeping_advance (3) kernel 1 1400d 1400d 0/26 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in ktime_get / timekeeping_advance kernel 5 1604d 1618d 0/26 closed as invalid on 2019/11/07 21:13

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get / timekeeping_advance

write to 0xffffffff86d962c8 of 280 bytes by interrupt on cpu 1:
 timekeeping_advance+0x88e/0xd80 include/linux/string.h:381
 update_wall_time+0x15/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1e5/0x2a0 kernel/time/tick-sched.c:98
 tick_sched_do_timer+0xc7/0xd0 kernel/time/tick-sched.c:142
 tick_sched_timer+0x3f/0xd0 kernel/time/tick-sched.c:1307
 __run_hrtimer kernel/time/hrtimer.c:1517 [inline]
 __hrtimer_run_queues+0x271/0x600 kernel/time/hrtimer.c:1579
 hrtimer_interrupt+0x226/0x490 kernel/time/hrtimer.c:1641
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1119 [inline]
 smp_apic_timer_interrupt+0xd8/0x270 arch/x86/kernel/apic/apic.c:1144
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 find_watchpoint kernel/kcsan/core.c:126 [inline]
 check_access kernel/kcsan/core.c:537 [inline]
 __tsan_read4+0x65/0x100 kernel/kcsan/core.c:685
 __read_seqcount_begin include/linux/seqlock.h:129 [inline]
 raw_read_seqcount_begin include/linux/seqlock.h:166 [inline]
 hrtimer_active+0x114/0x1b0 kernel/time/hrtimer.c:1446
 hrtimer_try_to_cancel+0x3b/0x250 kernel/time/hrtimer.c:1163
 hrtimer_cancel kernel/time/hrtimer.c:1278 [inline]
 do_nanosleep+0x1a4/0x320 kernel/time/hrtimer.c:1876
 hrtimer_nanosleep+0x136/0x230 kernel/time/hrtimer.c:1927
 __do_sys_nanosleep kernel/time/hrtimer.c:1961 [inline]
 __se_sys_nanosleep kernel/time/hrtimer.c:1948 [inline]
 __x64_sys_nanosleep+0x14b/0x190 kernel/time/hrtimer.c:1948
 do_syscall_64+0xc7/0x390 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff86d962e8 of 8 bytes by task 5744 on cpu 0:
 timekeeping_delta_to_ns kernel/time/timekeeping.c:363 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:375 [inline]
 ktime_get+0x11b/0x210 kernel/time/timekeeping.c:759
 ktime_get_ns include/linux/timekeeping.h:154 [inline]
 tcp_clock_ns include/net/tcp.h:762 [inline]
 tcp_mstamp_refresh net/ipv4/tcp_output.c:55 [inline]
 tcp_write_xmit+0x54/0x31e0 net/ipv4/tcp_output.c:2435
 __tcp_push_pending_frames+0x72/0x1b0 net/ipv4/tcp_output.c:2689
 tcp_sendmsg_locked+0x15b1/0x20f0 net/ipv4/tcp.c:1381
 tcp_sendmsg+0x35/0x50 net/ipv4/tcp.c:1433
 inet_sendmsg+0x69/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0x98/0xc0 net/socket.c:672
 __sys_sendto+0x1e2/0x2c0 net/socket.c:1998
 __do_sys_sendto net/socket.c:2010 [inline]
 __se_sys_sendto net/socket.c:2006 [inline]
 __x64_sys_sendto+0x7e/0xa0 net/socket.c:2006
 do_syscall_64+0xc7/0x390 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 5744 Comm: syz-executor.4 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/03/05 01:28 https://github.com/google/ktsan.git kcsan 766d004d1b85 576fb9bc .config console log report ci2-upstream-kcsan-gce
2020/02/17 09:31 https://github.com/google/ktsan.git kcsan b12d66a6c34f 1f448cd6 .config console log report ci2-upstream-kcsan-gce
2020/01/15 00:12 https://github.com/google/ktsan.git kcsan 245a43005292 fa12bd3c .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.