syzbot


KCSAN: data-race in ktime_get / timekeeping_advance

Status: closed as invalid on 2019/11/07 21:13
Subsystems: kernel
[Documentation on labels]
First crash: 1644d, last: 1630d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get / timekeeping_advance (3) kernel 1 1426d 1426d 0/26 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in ktime_get / timekeeping_advance (2) kernel 3 1511d 1561d 0/26 auto-closed as invalid on 2020/05/14 01:36

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get / timekeeping_advance

write to 0xffffffff86041b08 of 280 bytes by interrupt on cpu 1:
 timekeeping_advance+0x88e/0xd80 include/linux/string.h:378
 update_wall_time+0x19/0x20 kernel/time/timekeeping.c:2137
 tick_do_update_jiffies64+0x1a4/0x250 kernel/time/tick-sched.c:94
 tick_sched_do_timer+0xd4/0xe0 kernel/time/tick-sched.c:138
 tick_sched_timer+0x43/0xe0 kernel/time/tick-sched.c:1292
 __run_hrtimer kernel/time/hrtimer.c:1514 [inline]
 __hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1576
 hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1638
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
 smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 arch_local_irq_enable arch/x86/include/asm/paravirt.h:766 [inline]
 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
 _raw_spin_unlock_irq+0x4e/0x80 kernel/locking/spinlock.c:199
 finish_lock_switch kernel/sched/core.c:3123 [inline]
 finish_task_switch+0x7b/0x260 kernel/sched/core.c:3223
 context_switch kernel/sched/core.c:3387 [inline]
 __schedule+0x319/0x640 kernel/sched/core.c:4069
 preempt_schedule_irq+0x57/0x90 kernel/sched/core.c:4319
 restore_regs_and_return_to_kernel+0x0/0x25
 get_ctx kernel/kcsan/core.c:136 [inline]
 is_atomic kernel/kcsan/core.c:141 [inline]
 should_watch kernel/kcsan/core.c:162 [inline]
 check_access kernel/kcsan/core.c:408 [inline]
 __tsan_read8+0xb5/0x1f0 kernel/kcsan/core.c:530
 find_inode_bit.isra.0+0x98/0x300 fs/ext4/ialloc.c:718
 __ext4_new_inode+0xd10/0x2ec0 fs/ext4/ialloc.c:914
 ext4_create+0x152/0x370 fs/ext4/namei.c:2587
 lookup_open fs/namei.c:3224 [inline]
 do_last fs/namei.c:3314 [inline]
 path_openat+0x2b4b/0x36e0 fs/namei.c:3525
 do_filp_open+0x11e/0x1b0 fs/namei.c:3555
 do_sys_open+0x3b3/0x4f0 fs/open.c:1097
 __do_sys_open fs/open.c:1115 [inline]
 __se_sys_open fs/open.c:1110 [inline]
 __x64_sys_open+0x55/0x70 fs/open.c:1110
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff86041b28 of 8 bytes by interrupt on cpu 0:
 timekeeping_delta_to_ns kernel/time/timekeeping.c:363 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:375 [inline]
 ktime_get+0x11c/0x210 kernel/time/timekeeping.c:759
 ktime_get_ns include/linux/timekeeping.h:154 [inline]
 tcp_clock_ns include/net/tcp.h:746 [inline]
 tcp_mstamp_refresh net/ipv4/tcp_output.c:54 [inline]
 tcp_write_xmit+0x4f/0x3120 net/ipv4/tcp_output.c:2370
 __tcp_push_pending_frames+0x7b/0x1d0 net/ipv4/tcp_output.c:2616
 tcp_push_pending_frames include/net/tcp.h:1810 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5217 [inline]
 tcp_rcv_established+0x56a/0xf50 net/ipv4/tcp_input.c:5709
 tcp_v4_do_rcv+0x3b5/0x520 net/ipv4/tcp_ipv4.c:1564
 tcp_v4_rcv+0x19ec/0x1bd0 net/ipv4/tcp_ipv4.c:1945
 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:442 [inline]
 ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043
 process_backlog+0x207/0x4b0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6379
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/06 21:38 https://github.com/google/ktsan.git kcsan 94c006602e13 da505f84 .config console log report ci2-upstream-kcsan-gce
2019/11/03 08:11 https://github.com/google/ktsan.git kcsan 05f2236801fe d603afc9 .config console log report ci2-upstream-kcsan-gce
2019/10/30 22:51 https://github.com/google/ktsan.git kcsan 05f2236801fe a41ca8fa .config console log report ci2-upstream-kcsan-gce
2019/10/27 03:36 https://github.com/google/ktsan.git kcsan 05f2236801fe 25bb509e .config console log report ci2-upstream-kcsan-gce
2019/10/23 23:23 https://github.com/google/ktsan.git kcsan 05f2236801fe b602d64b .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.