syzbot


KCSAN: data-race in __io_fill_cqe / io_cqring_wait

Status: auto-closed as invalid on 2022/03/04 23:41
Subsystems: fs
[Documentation on labels]
First crash: 808d, last: 808d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __io_fill_cqe / io_cqring_wait

write to 0xffff888137727200 of 4 bytes by task 2884 on cpu 0:
 io_get_cqe fs/io_uring.c:1725 [inline]
 __io_fill_cqe+0xf9/0x380 fs/io_uring.c:1915
 __io_req_complete_post+0x6c/0x420 fs/io_uring.c:1944
 io_req_complete_post fs/io_uring.c:1972 [inline]
 __io_req_complete fs/io_uring.c:1992 [inline]
 io_req_complete fs/io_uring.c:1997 [inline]
 io_sync_file_range fs/io_uring.c:4854 [inline]
 io_issue_sqe+0x310d/0x98d0 fs/io_uring.c:6768
 io_wq_submit_work+0x1c5/0x370 fs/io_uring.c:6916
 io_worker_handle_work+0x51b/0xc10 fs/io-wq.c:588
 io_wqe_worker+0x1bc/0x4f0 fs/io-wq.c:639
 ret_from_fork+0x1f/0x30

read to 0xffff888137727200 of 4 bytes by task 2870 on cpu 1:
 io_should_wake fs/io_uring.c:7658 [inline]
 io_cqring_wait_schedule fs/io_uring.c:7703 [inline]
 io_cqring_wait+0x61b/0x950 fs/io_uring.c:7771
 __do_sys_io_uring_enter fs/io_uring.c:10175 [inline]
 __se_sys_io_uring_enter+0x649/0xb00 fs/io_uring.c:10091
 __x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:10091
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000169f -> 0x000016a0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 2870 Comm: syz-executor.5 Not tainted 5.17.0-rc1-syzkaller-00316-gdf0001545b27-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/01/28 23:34 upstream df0001545b27 495e00c5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __io_fill_cqe / io_cqring_wait
* Struck through repros no longer work on HEAD.