syzbot


KCSAN: data-race in virtqueue_enable_cb_delayed / virtqueue_enable_cb_prepare (2)

Status: auto-closed as invalid on 2020/12/21 12:00
Subsystems: virt
[Documentation on labels]
Reported-by: syzbot+fd5057c0ac20ecf16f0a@syzkaller.appspotmail.com
First crash: 1258d, last: 1258d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in virtqueue_enable_cb_delayed / virtqueue_enable_cb_prepare virt 31 1538d 1633d 0/26 auto-closed as invalid on 2020/04/16 14:34

Sample crash report:
==================================================================
BUG: KCSAN: data-race in virtqueue_enable_cb_delayed / virtqueue_enable_cb_prepare

write to 0xffff888141f29370 of 2 bytes by task 8452 on cpu 1:
 virtqueue_enable_cb_delayed_split drivers/virtio/virtio_ring.c:795 [inline]
 virtqueue_enable_cb_delayed+0x253/0x390 drivers/virtio/virtio_ring.c:2009
 start_xmit+0xda/0xa80 drivers/net/virtio_net.c:1593
 __netdev_start_xmit include/linux/netdevice.h:4718 [inline]
 netdev_start_xmit include/linux/netdevice.h:4732 [inline]
 xmit_one+0xf9/0x2e0 net/core/dev.c:3564
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3580
 sch_direct_xmit+0x170/0x730 net/sched/sch_generic.c:313
 qdisc_restart net/sched/sch_generic.c:376 [inline]
 __qdisc_run+0x119/0x180 net/sched/sch_generic.c:384
 qdisc_run include/net/pkt_sched.h:131 [inline]
 __dev_xmit_skb net/core/dev.c:3755 [inline]
 __dev_queue_xmit+0xa62/0x1510 net/core/dev.c:4108
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4173
 neigh_hh_output include/net/neighbour.h:498 [inline]
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0xb09/0xba0 net/ipv4/ip_output.c:230
 __ip_finish_output+0x3d8/0x430 net/ipv4/ip_output.c:308
 ip_finish_output+0x39/0x160 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip_output+0xf6/0x1a0 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0x9ca/0x9f0 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x34/0x40 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1250/0x1860 net/ipv4/tcp_output.c:1404
 __tcp_send_ack+0x1e9/0x2e0 net/ipv4/tcp_output.c:3967
 tcp_send_ack+0x23/0x30 net/ipv4/tcp_output.c:3973
 tcp_cleanup_rbuf+0x1c4/0x310 net/ipv4/tcp.c:1584
 tcp_recvmsg+0x1119/0x1c10 net/ipv4/tcp.c:2251
 inet_recvmsg+0xa3/0x210 net/ipv4/af_inet.c:848
 sock_recvmsg_nosec net/socket.c:885 [inline]
 sock_recvmsg net/socket.c:903 [inline]
 sock_read_iter+0x19e/0x1e0 net/socket.c:976
 call_read_iter include/linux/fs.h:1881 [inline]
 new_sync_read fs/read_write.c:415 [inline]
 vfs_read+0x552/0x5c0 fs/read_write.c:496
 ksys_read+0xce/0x180 fs/read_write.c:634
 __do_sys_read fs/read_write.c:644 [inline]
 __se_sys_read fs/read_write.c:642 [inline]
 __x64_sys_read+0x3e/0x50 fs/read_write.c:642
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888141f29370 of 2 bytes by interrupt on cpu 0:
 virtqueue_enable_cb_prepare_split drivers/virtio/virtio_ring.c:761 [inline]
 virtqueue_enable_cb_prepare+0x99/0x200 drivers/virtio/virtio_ring.c:1946
 virtqueue_napi_complete+0x1b/0x80 drivers/net/virtio_net.c:333
 virtnet_poll_tx+0x13d/0x1b0 drivers/net/virtio_net.c:1524
 napi_poll+0x178/0x4c0 net/core/dev.c:6763
 net_rx_action+0x17a/0x480 net/core/dev.c:6833
 __do_softirq+0x12c/0x2b1 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu+0xb2/0xc0 kernel/softirq.c:423
 common_interrupt+0xb5/0x130 arch/x86/kernel/irq.c:239
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:622
 native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
 arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
 acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
 acpi_idle_do_entry drivers/acpi/processor_idle.c:517 [inline]
 acpi_idle_enter+0x25b/0x2e0 drivers/acpi/processor_idle.c:648
 cpuidle_enter_state+0x2bd/0x750 drivers/cpuidle/cpuidle.c:237
 cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:351
 call_cpuidle kernel/sched/idle.c:132 [inline]
 cpuidle_idle_call kernel/sched/idle.c:213 [inline]
 do_idle+0x193/0x230 kernel/sched/idle.c:273
 cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:369
 rest_init+0xd7/0xe0 init/main.c:711
 arch_call_rest_init+0xa/0xb
 start_kernel+0x5a0/0x625 init/main.c:1051
 secondary_startup_64_no_verify+0xb0/0xbb

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.10.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/12 17:20 upstream 3d5e28bff7ad 77a55c8e .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.