syzbot


DATA RACE in futex.(*waiterEntry).SetNext

Status: fixed on 2024/06/14 00:33
Fix commit: b58e8a129d62 futex: add missing locking in lockBuckets()
First crash: 173d, last: 173d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000b6a4e0 by goroutine 868:
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*waiterEntry).SetNext()
      bazel-out/k8-fastbuild/bin/pkg/sentry/kernel/futex/waiter_list.go:231 +0x27
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*waiterList).PushBack()
      bazel-out/k8-fastbuild/bin/pkg/sentry/kernel/futex/waiter_list.go:115 +0x98
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).WaitPrepare()
      pkg/sentry/kernel/futex/futex.go:599 +0x267
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.futexWaitDuration()
      pkg/sentry/syscalls/linux/sys_futex.go:85 +0xd7
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Futex()
      pkg/sentry/syscalls/linux/sys_futex.go:192 +0x55c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x994
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x71
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0x93
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x4af
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:263 +0x1fed
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x46c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:393 +0x44

Previous read at 0x00c000b6a4e0 by goroutine 872:
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*waiterEntry).Next()
      bazel-out/k8-fastbuild/bin/pkg/sentry/kernel/futex/waiter_list.go:217 +0x24
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*bucket).requeueLocked()
      pkg/sentry/kernel/futex/futex.go:306 +0x24e
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).doRequeue()
      pkg/sentry/kernel/futex/futex.go:514 +0x457
  gvisor.dev/gvisor/pkg/sentry/kernel/futex.(*Manager).Requeue()
      pkg/sentry/kernel/futex/futex.go:522 +0x99
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Futex()
      pkg/sentry/syscalls/linux/sys_futex.go:224 +0x125
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x994
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x71
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0x93
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x4af
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:263 +0x1fed
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x46c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:393 +0x44

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/06/06 06:04 gvisor e8ccc27cdf4b 121701b6 .config console log report syz / log C ci-gvisor-ptrace-1-race DATA RACE in futex.(*waiterEntry).SetNext
2024/06/06 06:01 gvisor e8ccc27cdf4b 121701b6 .config console log report syz / log ci-gvisor-ptrace-2-race DATA RACE in futex.(*waiterEntry).SetNext
2024/06/06 04:52 gvisor e8ccc27cdf4b 121701b6 .config console log report info ci-gvisor-ptrace-1-race-cover DATA RACE in futex.(*waiterEntry).SetNext
* Struck through repros no longer work on HEAD.