syzbot


KCSAN: data-race in pvclock_gtod_notify / pvclock_update_vm_gtod_copy

Status: closed as invalid on 2019/11/19 14:54
Subsystems: kvm-x86
[Documentation on labels]
First crash: 2132d, last: 2116d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in pvclock_gtod_notify / pvclock_update_vm_gtod_copy

write to 0xffffffff85fe1628 of 4 bytes by interrupt on cpu 0:
 update_pvclock_gtod arch/x86/kvm/x86.c:1551 [inline]
 pvclock_gtod_notify+0x9f/0x260 arch/x86/kvm/x86.c:7123
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:95
 __raw_notifier_call_chain kernel/notifier.c:396 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:403
 update_pvclock_gtod kernel/time/timekeeping.c:578 [inline]
 timekeeping_update+0x1b5/0x2d0 kernel/time/timekeeping.c:672
 timekeeping_advance+0x87d/0xd80 kernel/time/timekeeping.c:2120
 update_wall_time+0x19/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1a4/0x250 kernel/time/tick-sched.c:94
 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138
 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1292
 __run_hrtimer kernel/time/hrtimer.c:1514 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1576
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1638
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 find_watchpoint kernel/kcsan/core.c:67 [inline]
 check_access kernel/kcsan/core.c:388 [inline]
 __tsan_unaligned_write4+0x46/0x1f0 kernel/kcsan/core.c:529
 __rcu_read_unlock+0x90/0x3c0 kernel/rcu/tree_plugin.h:380
 rcu_read_unlock include/linux/rcupdate.h:652 [inline]
 __unlock_page_memcg+0x42/0xa0 mm/memcontrol.c:2136
 unlock_page_memcg+0x23/0x30 mm/memcontrol.c:2145
 page_remove_file_rmap mm/rmap.c:1254 [inline]
 page_remove_rmap+0x377/0x770 mm/rmap.c:1305
 zap_pte_range mm/memory.c:1062 [inline]
 zap_pmd_range mm/memory.c:1166 [inline]
 zap_pud_range mm/memory.c:1195 [inline]
 zap_p4d_range mm/memory.c:1216 [inline]
 unmap_page_range+0xbab/0x18d0 mm/memory.c:1237
 unmap_single_vma+0x144/0x200 mm/memory.c:1282
 unmap_vmas+0xda/0x1a0 mm/memory.c:1314
 exit_mmap+0x13e/0x300 mm/mmap.c:3161
 __mmput kernel/fork.c:1079 [inline]
 mmput+0xea/0x280 kernel/fork.c:1100
 exit_mm kernel/exit.c:485 [inline]
 do_exit+0x4c9/0x18f0 kernel/exit.c:804
 do_group_exit+0xb4/0x1c0 kernel/exit.c:921
 get_signal+0x2a2/0x1320 kernel/signal.c:2734
 do_signal+0x3b/0xbf0 arch/x86/kernel/signal.c:815
 exit_to_usermode_loop+0x250/0x2c0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x353/0x370 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff85fe1628 of 4 bytes by task 27606 on cpu 1:
 arch_atomic_set arch/x86/include/asm/atomic.h:43 [inline]
 atomic_set include/asm-generic/atomic-instrumented.h:58 [inline]
 pvclock_update_vm_gtod_copy+0x4a7/0x4d0 arch/x86/kvm/x86.c:2148
 kvm_gen_update_masterclock+0x5f/0x1c0 arch/x86/kvm/x86.c:2171
 vcpu_enter_guest+0x1a4e/0x3830 arch/x86/kvm/x86.c:7952
 vcpu_run arch/x86/kvm/x86.c:8291 [inline]
 kvm_arch_vcpu_ioctl_run+0x2a2/0xdc0 arch/x86/kvm/x86.c:8498
 kvm_vcpu_ioctl+0x752/0xa30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2772
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x991/0xc60 fs/ioctl.c:696
 ksys_ioctl+0xbd/0xe0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x4c/0x60 fs/ioctl.c:718
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 27606 Comm: syz-executor.3 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/12 03:43 https://github.com/google/ktsan.git kcsan 94c006602e13 377d77fa .config console log report ci2-upstream-kcsan-gce
2019/11/10 17:50 https://github.com/google/ktsan.git kcsan 94c006602e13 dc438b91 .config console log report ci2-upstream-kcsan-gce
2019/11/05 14:10 https://github.com/google/ktsan.git kcsan 94c006602e13 0f3ec414 .config console log report ci2-upstream-kcsan-gce
2019/11/04 12:45 https://github.com/google/ktsan.git kcsan 05f2236801fe 18e12644 .config console log report ci2-upstream-kcsan-gce
2019/11/04 01:18 https://github.com/google/ktsan.git kcsan 05f2236801fe b35fad31 .config console log report ci2-upstream-kcsan-gce
2019/10/26 22:58 https://github.com/google/ktsan.git kcsan 05f2236801fe 25bb509e .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.