syzbot


KCSAN: data-race in __io_cqring_fill_event / io_uring_poll

Status: auto-closed as invalid on 2020/09/14 23:42
Reported-by: syzbot+3020eb77f81ef0772fbe@syzkaller.appspotmail.com
First crash: 906d, last: 903d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __io_cqring_fill_event / io_uring_poll (2) 38 412d 668d 0/24 auto-closed as invalid on 2022/01/18 18:07

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __io_cqring_fill_event / io_uring_poll

write to 0xffff8881223aa5c0 of 4 bytes by task 709 on cpu 0:
 io_get_cqring fs/io_uring.c:1282 [inline]
 __io_cqring_fill_event+0x116/0x430 fs/io_uring.c:1386
 io_cqring_add_event fs/io_uring.c:1420 [inline]
 __io_req_complete+0xdb/0x1b0 fs/io_uring.c:1458
 io_complete_rw_common fs/io_uring.c:2208 [inline]
 __io_complete_rw+0x2c9/0x2e0 fs/io_uring.c:2289
 kiocb_done fs/io_uring.c:2533 [inline]
 io_write fs/io_uring.c:3199 [inline]
 io_issue_sqe+0x4fb1/0x7140 fs/io_uring.c:5530
 io_wq_submit_work+0x23e/0x340 fs/io_uring.c:5775
 io_worker_handle_work+0xa69/0xcf0 fs/io-wq.c:527
 io_wqe_worker+0x1f2/0x860 fs/io-wq.c:569
 kthread+0x20d/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

read to 0xffff8881223aa5c0 of 4 bytes by task 656 on cpu 1:
 io_cqring_events fs/io_uring.c:1937 [inline]
 io_uring_poll+0x105/0x140 fs/io_uring.c:7751
 vfs_poll include/linux/poll.h:90 [inline]
 __io_arm_poll_handler+0x176/0x3f0 fs/io_uring.c:4735
 io_arm_poll_handler+0x293/0x5c0 fs/io_uring.c:4792
 __io_queue_sqe+0x413/0x760 fs/io_uring.c:5988
 io_queue_sqe+0x81/0x2b0 fs/io_uring.c:6060
 io_submit_sqe+0x333/0x560 fs/io_uring.c:6130
 io_submit_sqes+0x8c6/0xfc0 fs/io_uring.c:6327
 __do_sys_io_uring_enter fs/io_uring.c:8036 [inline]
 __se_sys_io_uring_enter+0x1c2/0x720 fs/io_uring.c:7995
 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:7995
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 656 Comm: syz-executor.4 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-kcsan-gce 2020/08/10 23:41 upstream fc80c51fd4b2 d3694ffb .config console log report
ci2-upstream-kcsan-gce 2020/08/10 20:07 upstream fc80c51fd4b2 7adc7b65 .config console log report
ci2-upstream-kcsan-gce 2020/08/07 17:20 upstream 86cfccb66937 28ac5c9e .config console log report
* Struck through repros no longer work on HEAD.