KCSAN: data-race in __io_queue_proc / io_poll

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in __io_queue_proc / io_poll_wake (2) io-uring				2	48d	48d	0/26	auto-obsoleted due to no activity on 2024/05/07 13:03
==================================================================
BUG: KCSAN: data-race in __io_queue_proc / io_poll_wake

write to 0xffff88819c585cc8 of 8 bytes by task 15013 on cpu 0:
 io_poll_wake+0x1f8/0x390 io_uring/poll.c:442
 __wake_up_common+0xb3/0x130 kernel/sched/wait.c:107
 __wake_up_common_lock kernel/sched/wait.c:138 [inline]
 __wake_up+0x7e/0xc0 kernel/sched/wait.c:160
 __receive_buf drivers/tty/n_tty.c:1652 [inline]
 n_tty_receive_buf_common+0x72e/0xbc0 drivers/tty/n_tty.c:1734
 n_tty_receive_buf2+0x33/0x40 drivers/tty/n_tty.c:1780
 tty_ldisc_receive_buf+0x60/0xe0 drivers/tty/tty_buffer.c:387
 tty_port_default_receive_buf+0x59/0x90 drivers/tty/tty_port.c:37
 receive_buf drivers/tty/tty_buffer.c:445 [inline]
 flush_to_ldisc+0x1ca/0x400 drivers/tty/tty_buffer.c:495
 process_one_work kernel/workqueue.c:2630 [inline]
 process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
 worker_thread+0x525/0x730 kernel/workqueue.c:2784
 kthread+0x1d7/0x210 kernel/kthread.c:388
 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

read to 0xffff88819c585cc8 of 8 bytes by task 23149 on cpu 1:
 __io_queue_proc+0xfa/0x260 io_uring/poll.c:495
 io_async_queue_proc+0x43/0x50 io_uring/poll.c:652
 poll_wait include/linux/poll.h:49 [inline]
 n_tty_poll+0x8f/0x490 drivers/tty/n_tty.c:2458
 tty_poll+0x7b/0xf0 drivers/tty/tty_io.c:2206
 vfs_poll include/linux/poll.h:88 [inline]
 __io_arm_poll_handler+0x20b/0xe40 io_uring/poll.c:600
 io_arm_poll_handler+0x40f/0x560 io_uring/poll.c:735
 io_queue_async+0x85/0x4a0 io_uring/io_uring.c:2041
 io_queue_sqe io_uring/io_uring.c:2072 [inline]
 io_req_task_submit+0x11c/0x130 io_uring/io_uring.c:1491
 io_poll_task_func+0x722/0x800
 handle_tw_list io_uring/io_uring.c:1200 [inline]
 tctx_task_work+0x1af/0x4c0 io_uring/io_uring.c:1292
 task_work_run+0x135/0x1a0 kernel/task_work.c:180
 get_signal+0xef2/0x1090 kernel/signal.c:2668
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:309
 exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168
 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204
 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
 syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296
 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0xffff88819fd72e08 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 23149 Comm: syz-executor.3 Not tainted 6.6.0-rc7-syzkaller-00041-g611da07b89fd #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
==================================================================