syzbot


KCSAN: data-race in kimage_alloc_page / prepare_signal

Status: auto-closed as invalid on 2021/01/20 01:58
Subsystems: kernel
[Documentation on labels]
First crash: 1198d, last: 1198d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kimage_alloc_page / prepare_signal

write to 0xffff88802185a7a8 of 8 bytes by interrupt on cpu 1:
 sigandnsets include/linux/signal.h:161 [inline]
 flush_sigqueue_mask kernel/signal.c:789 [inline]
 prepare_signal+0x98c/0xd80 kernel/signal.c:928
 send_sigqueue+0xe7/0x400 kernel/signal.c:1861
 posix_timer_event kernel/time/posix-timers.c:354 [inline]
 posix_timer_fn+0xdd/0x1f0 kernel/time/posix-timers.c:380
 __run_hrtimer+0x133/0x420 kernel/time/hrtimer.c:1519
 __hrtimer_run_queues kernel/time/hrtimer.c:1583 [inline]
 hrtimer_interrupt+0x36e/0xa10 kernel/time/hrtimer.c:1645
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1085 [inline]
 __sysvec_apic_timer_interrupt+0x6f/0x200 arch/x86/kernel/apic/apic.c:1102
 asm_call_irq_on_stack+0xf/0x20
 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline]
 run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline]
 sysvec_apic_timer_interrupt+0x52/0x90 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
 native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline]
 arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline]
 kcsan_setup_watchpoint+0x1fc/0x4e0 kernel/kcsan/core.c:591
 pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:559 [inline]
 queued_spin_unlock arch/x86/include/asm/qspinlock.h:56 [inline]
 do_raw_spin_unlock include/linux/spinlock.h:212 [inline]
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:175 [inline]
 _raw_spin_unlock_bh+0x10/0x40 kernel/locking/spinlock.c:207
 spin_unlock_bh include/linux/spinlock.h:399 [inline]
 batadv_nc_purge_paths+0x26f/0x2c0 net/batman-adv/network-coding.c:467
 batadv_nc_worker+0x18a/0x9e0 net/batman-adv/network-coding.c:718
 process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
 worker_thread+0x635/0xb90 kernel/workqueue.c:2421
 kthread+0x1fd/0x220 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

read to 0xffff88802185a7a8 of 8 bytes by task 11308 on cpu 0:
 sigismember include/linux/signal.h:84 [inline]
 __fatal_signal_pending include/linux/sched/signal.h:377 [inline]
 fatal_signal_pending include/linux/sched/signal.h:382 [inline]
 kimage_alloc_pages kernel/kexec_core.c:302 [inline]
 kimage_alloc_page+0x15d/0x780 kernel/kexec_core.c:724
 kimage_load_normal_segment kernel/kexec_core.c:807 [inline]
 kimage_load_segment+0x494/0x780 kernel/kexec_core.c:924
 do_kexec_load+0x364/0x450 kernel/kexec.c:155
 __do_sys_kexec_load kernel/kexec.c:261 [inline]
 __se_sys_kexec_load+0x14a/0x190 kernel/kexec.c:236
 __x64_sys_kexec_load+0x51/0x60 kernel/kexec.c:236
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 11308 Comm: syz-executor.5 Not tainted 5.10.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/16 01:53 upstream d635a69dd498 f213e07e .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.