syzbot


KCSAN: data-race in tty_flip_buffer_push / tty_insert_flip_string_fixed_flag

Status: auto-closed as invalid on 2021/05/20 02:15
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 653d, last: 653d
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in tty_flip_buffer_push / tty_insert_flip_string_fixed_flag (2) 3 460d 490d 0/24 auto-closed as invalid on 2021/11/29 04:22
upstream KCSAN: data-race in tty_flip_buffer_push / tty_insert_flip_string_fixed_flag (3) 4 346d 377d 0/24 auto-closed as invalid on 2022/03/23 06:48

Sample crash report:
==================================================================
BUG: KCSAN: data-race in tty_flip_buffer_push / tty_insert_flip_string_fixed_flag

write to 0xffff88804301d408 of 4 bytes by task 27654 on cpu 1:
 tty_insert_flip_string_fixed_flag+0x15c/0x1c0 drivers/tty/tty_buffer.c:325
 tty_insert_flip_string include/linux/tty_flip.h:37 [inline]
 pty_write+0xad/0x120 drivers/tty/pty.c:121
 decode_std_command drivers/net/hamradio/6pack.c:910 [inline]
 sixpack_decode drivers/net/hamradio/6pack.c:961 [inline]
 sixpack_receive_buf+0xe6b/0xf90 drivers/net/hamradio/6pack.c:453
 tiocsti drivers/tty/tty_io.c:2316 [inline]
 tty_ioctl+0x91a/0x10c0 drivers/tty/tty_io.c:2717
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl+0xcb/0x140 fs/ioctl.c:739
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:739
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88804301d408 of 4 bytes by task 8 on cpu 0:
 tty_schedule_flip drivers/tty/tty_buffer.c:412 [inline]
 tty_flip_buffer_push+0x28/0x60 drivers/tty/tty_buffer.c:556
 pty_write+0xef/0x120 drivers/tty/pty.c:125
 decode_std_command drivers/net/hamradio/6pack.c:910 [inline]
 sixpack_decode drivers/net/hamradio/6pack.c:961 [inline]
 sixpack_receive_buf+0xe6b/0xf90 drivers/net/hamradio/6pack.c:453
 tty_ldisc_receive_buf+0xc6/0xf0 drivers/tty/tty_buffer.c:465
 tty_port_default_receive_buf+0x54/0x80 drivers/tty/tty_port.c:38
 receive_buf drivers/tty/tty_buffer.c:481 [inline]
 flush_to_ldisc+0x1c5/0x2c0 drivers/tty/tty_buffer.c:533
 process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
 worker_thread+0x616/0xa70 kernel/workqueue.c:2421
 kthread+0x20b/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8 Comm: kworker/u4:0 Tainted: G        W         5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events_unbound flush_to_ldisc
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-kcsan-gce 2021/04/15 02:05 upstream 7f75285ca572 fcdb12ba .config console log report info KCSAN: data-race in tty_flip_buffer_push / tty_insert_flip_string_fixed_flag
* Struck through repros no longer work on HEAD.