syzbot


KCSAN: data-race in kvm_arch_vcpu_load / pvclock_gtod_notify

Status: closed as invalid on 2019/11/19 14:54
Subsystems: kvm
[Documentation on labels]
First crash: 1641d, last: 1621d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kvm_arch_vcpu_load / pvclock_gtod_notify

write to 0xffffffff85fe1628 of 4 bytes by interrupt on cpu 1:
 update_pvclock_gtod arch/x86/kvm/x86.c:1551 [inline]
 pvclock_gtod_notify+0x9f/0x260 arch/x86/kvm/x86.c:7123
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:95
 __raw_notifier_call_chain kernel/notifier.c:396 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:403
 update_pvclock_gtod kernel/time/timekeeping.c:578 [inline]
 timekeeping_update+0x1b5/0x2d0 kernel/time/timekeeping.c:672
 timekeeping_advance+0x87d/0xd80 kernel/time/timekeeping.c:2120
 update_wall_time+0x19/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1a4/0x250 kernel/time/tick-sched.c:94
 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138
 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1292
 __run_hrtimer kernel/time/hrtimer.c:1514 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1576
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1638
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline]
 kcsan_setup_watchpoint+0x205/0x410 kernel/kcsan/core.c:369
 check_access kernel/kcsan/core.c:409 [inline]
 __tsan_read4+0x145/0x1f0 kernel/kcsan/core.c:529
 tomoyo_path_matches_pattern+0x11a/0x160 security/tomoyo/util.c:923
 tomoyo_compare_name_union security/tomoyo/file.c:87 [inline]
 tomoyo_compare_name_union+0x71/0xa0 security/tomoyo/file.c:82
 tomoyo_check_path_acl security/tomoyo/file.c:260 [inline]
 tomoyo_check_path_acl+0x85/0xa0 security/tomoyo/file.c:252
 tomoyo_check_acl+0xf6/0x270 security/tomoyo/domain.c:172
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_permission+0xe3/0x160 security/tomoyo/file.c:573
 tomoyo_path_perm+0x23e/0x390 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x26/0x40 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0x9b/0xd0 security/security.c:1222
 vfs_getattr+0x2e/0x70 fs/stat.c:115
 vfs_statx+0x102/0x190 fs/stat.c:191
 vfs_stat include/linux/fs.h:3242 [inline]
 __do_sys_newstat+0x51/0xb0 fs/stat.c:341
 __se_sys_newstat fs/stat.c:337 [inline]
 __x64_sys_newstat+0x3a/0x50 fs/stat.c:337
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff85fe1628 of 4 bytes by task 25511 on cpu 0:
 kvm_check_tsc_unstable arch/x86/kvm/x86.c:1837 [inline]
 kvm_arch_vcpu_load+0x1e5/0x620 arch/x86/kvm/x86.c:3418
 kvm_sched_in+0x8e/0xc0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4234
 __fire_sched_in_preempt_notifiers kernel/sched/core.c:3029 [inline]
 fire_sched_in_preempt_notifiers kernel/sched/core.c:3035 [inline]
 finish_task_switch+0xee/0x260 kernel/sched/core.c:3227
 context_switch kernel/sched/core.c:3387 [inline]
 __schedule+0x319/0x640 kernel/sched/core.c:4069
 preempt_schedule_common+0x37/0x90 kernel/sched/core.c:4217
 preempt_schedule+0x30/0x40 kernel/sched/core.c:4242
 ___preempt_schedule+0x16/0x20 arch/x86/entry/thunk_64.S:50
 vcpu_enter_guest+0x33ec/0x3830 arch/x86/kvm/x86.c:8208
 vcpu_run arch/x86/kvm/x86.c:8291 [inline]
 kvm_arch_vcpu_ioctl_run+0x2a2/0xdc0 arch/x86/kvm/x86.c:8498
 kvm_vcpu_ioctl+0x752/0xa30 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2772
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:509 [inline]
 do_vfs_ioctl+0x991/0xc60 fs/ioctl.c:696
 ksys_ioctl+0xbd/0xe0 fs/ioctl.c:713
 __do_sys_ioctl fs/ioctl.c:720 [inline]
 __se_sys_ioctl fs/ioctl.c:718 [inline]
 __x64_sys_ioctl+0x4c/0x60 fs/ioctl.c:718
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25511 Comm: syz-executor.2 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (20):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/12 02:12 https://github.com/google/ktsan.git kcsan 94c006602e13 377d77fa .config console log report ci2-upstream-kcsan-gce
2019/11/10 00:25 https://github.com/google/ktsan.git kcsan 94c006602e13 dc438b91 .config console log report ci2-upstream-kcsan-gce
2019/11/08 12:49 https://github.com/google/ktsan.git kcsan 94c006602e13 1e35461e .config console log report ci2-upstream-kcsan-gce
2019/11/07 22:32 https://github.com/google/ktsan.git kcsan 94c006602e13 f39aff9e .config console log report ci2-upstream-kcsan-gce
2019/11/07 04:51 https://github.com/google/ktsan.git kcsan 94c006602e13 d797d201 .config console log report ci2-upstream-kcsan-gce
2019/11/06 06:39 https://github.com/google/ktsan.git kcsan 94c006602e13 bc2c6e45 .config console log report ci2-upstream-kcsan-gce
2019/11/05 15:59 https://github.com/google/ktsan.git kcsan 94c006602e13 af5c522d .config console log report ci2-upstream-kcsan-gce
2019/11/05 12:37 https://github.com/google/ktsan.git kcsan 94c006602e13 0f3ec414 .config console log report ci2-upstream-kcsan-gce
2019/11/05 00:22 https://github.com/google/ktsan.git kcsan 94c006602e13 76630fc9 .config console log report ci2-upstream-kcsan-gce
2019/11/03 23:31 https://github.com/google/ktsan.git kcsan 05f2236801fe b35fad31 .config console log report ci2-upstream-kcsan-gce
2019/11/03 11:23 https://github.com/google/ktsan.git kcsan 05f2236801fe c9610487 .config console log report ci2-upstream-kcsan-gce
2019/11/02 21:33 https://github.com/google/ktsan.git kcsan 05f2236801fe d603afc9 .config console log report ci2-upstream-kcsan-gce
2019/11/02 04:33 https://github.com/google/ktsan.git kcsan 05f2236801fe 997ccc67 .config console log report ci2-upstream-kcsan-gce
2019/10/31 01:27 https://github.com/google/ktsan.git kcsan 05f2236801fe a41ca8fa .config console log report ci2-upstream-kcsan-gce
2019/10/28 19:05 https://github.com/google/ktsan.git kcsan 05f2236801fe 439d7b14 .config console log report ci2-upstream-kcsan-gce
2019/10/26 11:54 https://github.com/google/ktsan.git kcsan 05f2236801fe 25bb509e .config console log report ci2-upstream-kcsan-gce
2019/10/25 14:54 https://github.com/google/ktsan.git kcsan 05f2236801fe 04ca72cd .config console log report ci2-upstream-kcsan-gce
2019/10/24 13:19 https://github.com/google/ktsan.git kcsan 05f2236801fe d01bb02a .config console log report ci2-upstream-kcsan-gce
2019/10/23 15:12 https://github.com/google/ktsan.git kcsan 05f2236801fe b602d64b .config console log report ci2-upstream-kcsan-gce
2019/10/23 02:24 https://github.com/google/ktsan.git kcsan 05f2236801fe d0686497 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.