================================================================== BUG: KCSAN: data-race in detach_buf_split / virtqueue_add write to 0xffff888101be3740 of 4 bytes by task 21910 on cpu 0: virtqueue_add+0x2212/0x2450 drivers/virtio/virtio_ring.c:1852 virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1931 request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline] copy_data drivers/char/hw_random/virtio-rng.c:74 [inline] virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92 rng_get_data drivers/char/hw_random/core.c:192 [inline] rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229 vfs_read+0x1e6/0x750 fs/read_write.c:479 ksys_read+0xd9/0x190 fs/read_write.c:619 __do_sys_read fs/read_write.c:629 [inline] __se_sys_read fs/read_write.c:627 [inline] __x64_sys_read+0x3e/0x50 fs/read_write.c:627 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888101be3740 of 4 bytes by interrupt on cpu 1: detach_buf_split+0x1df/0x490 drivers/virtio/virtio_ring.c:723 virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:807 [inline] virtqueue_get_buf_ctx+0x464/0x710 drivers/virtio/virtio_ring.c:2046 virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2052 random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42 vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2211 __handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:198 [inline] handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215 handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250 common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 do_unlinkat+0x1/0x540 fs/namei.c:4128 __do_sys_unlink fs/namei.c:4215 [inline] __se_sys_unlink fs/namei.c:4213 [inline] __x64_sys_unlink+0x2c/0x30 fs/namei.c:4213 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000001 -> 0x00000002 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 383 Comm: udevd Tainted: G W 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== sd 0:0:1:0: tag#3694 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3694 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3694 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3694 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3694 CDB[20]: ba sd 0:0:1:0: tag#3681 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3681 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3681 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3681 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3681 CDB[20]: ba sd 0:0:1:0: tag#3670 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3670 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3670 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3670 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3670 CDB[20]: ba sd 0:0:1:0: tag#3658 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3658 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3658 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3658 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3658 CDB[20]: ba ================================================================== BUG: KCSAN: data-race in detach_buf_split / virtqueue_add write to 0xffff888101be372c of 4 bytes by task 25100 on cpu 0: virtqueue_add_split drivers/virtio/virtio_ring.c:606 [inline] virtqueue_add+0x2207/0x2450 drivers/virtio/virtio_ring.c:1852 virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1931 request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline] copy_data drivers/char/hw_random/virtio-rng.c:74 [inline] virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92 rng_get_data drivers/char/hw_random/core.c:192 [inline] rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229 vfs_read+0x1e6/0x750 fs/read_write.c:479 ksys_read+0xd9/0x190 fs/read_write.c:619 __do_sys_read fs/read_write.c:629 [inline] __se_sys_read fs/read_write.c:627 [inline] __x64_sys_read+0x3e/0x50 fs/read_write.c:627 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888101be372c of 4 bytes by interrupt on cpu 1: detach_buf_split+0x220/0x490 drivers/virtio/virtio_ring.c:727 virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:807 [inline] virtqueue_get_buf_ctx+0x464/0x710 drivers/virtio/virtio_ring.c:2046 virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2052 random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42 vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2211 __handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:198 [inline] handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215 handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250 common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 watchpoint_slot kernel/kcsan/encoding.h:90 [inline] find_watchpoint kernel/kcsan/core.c:115 [inline] check_access kernel/kcsan/core.c:618 [inline] __tsan_read4+0x12/0x180 kernel/kcsan/core.c:854 avc_search_node security/selinux/avc.c:539 [inline] avc_lookup security/selinux/avc.c:567 [inline] avc_has_perm_noaudit+0x102/0x270 security/selinux/avc.c:1152 selinux_inode_permission+0x2da/0x3f0 security/selinux/hooks.c:3191 security_inode_permission+0x72/0xc0 security/security.c:1314 inode_permission fs/namei.c:532 [inline] may_lookup fs/namei.c:1683 [inline] link_path_walk+0x1e4/0x930 fs/namei.c:2239 path_parentat fs/namei.c:2496 [inline] filename_parentat+0x123/0x480 fs/namei.c:2519 do_unlinkat+0x83/0x540 fs/namei.c:4138 __do_sys_unlink fs/namei.c:4215 [inline] __se_sys_unlink fs/namei.c:4213 [inline] __x64_sys_unlink+0x2c/0x30 fs/namei.c:4213 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000100 -> 0x000000ff Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 383 Comm: udevd Tainted: G W 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== ================================================================== BUG: KCSAN: data-race in detach_buf_split / virtqueue_add read to 0xffff888101be372c of 4 bytes by task 27668 on cpu 0: virtqueue_add_split drivers/virtio/virtio_ring.c:537 [inline] virtqueue_add+0x7d3/0x2450 drivers/virtio/virtio_ring.c:1852 virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1931 request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline] copy_data drivers/char/hw_random/virtio-rng.c:74 [inline] virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92 rng_get_data drivers/char/hw_random/core.c:192 [inline] rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229 do_loop_readv_writev fs/read_write.c:746 [inline] do_iter_read+0x370/0x5d0 fs/read_write.c:788 vfs_readv fs/read_write.c:906 [inline] do_preadv+0x159/0x240 fs/read_write.c:998 __do_sys_preadv fs/read_write.c:1048 [inline] __se_sys_preadv fs/read_write.c:1043 [inline] __x64_sys_preadv+0x54/0x60 fs/read_write.c:1043 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae write to 0xffff888101be372c of 4 bytes by interrupt on cpu 1: detach_buf_split+0x22d/0x490 drivers/virtio/virtio_ring.c:727 virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:807 [inline] virtqueue_get_buf_ctx+0x464/0x710 drivers/virtio/virtio_ring.c:2046 virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2052 random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42 vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2211 __handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:198 [inline] handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215 handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250 common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 check_kcov_mode kernel/kcov.c:163 [inline] __sanitizer_cov_trace_pc+0x2d/0x60 kernel/kcov.c:197 zap_pte_range+0x44d/0x10f0 mm/memory.c:1353 zap_pmd_range mm/memory.c:1481 [inline] zap_pud_range mm/memory.c:1510 [inline] zap_p4d_range mm/memory.c:1531 [inline] unmap_page_range+0x2dc/0x3d0 mm/memory.c:1552 unmap_single_vma+0x157/0x210 mm/memory.c:1597 unmap_vmas+0xd0/0x180 mm/memory.c:1629 exit_mmap+0x23d/0x470 mm/mmap.c:3171 __mmput+0x27/0x1b0 kernel/fork.c:1113 mmput+0x3d/0x50 kernel/fork.c:1134 exit_mm+0xdb/0x170 kernel/exit.c:507 do_exit+0x608/0x17a0 kernel/exit.c:819 do_group_exit+0xce/0x180 kernel/exit.c:929 get_signal+0xf83/0x1510 kernel/signal.c:2820 arch_do_signal_or_restart+0x8c/0x2c0 arch/x86/kernel/signal.c:868 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x113/0x190 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300 do_syscall_64+0x50/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000100 -> 0x000000ff Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 27497 Comm: syz-executor.4 Tainted: G W 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== ================================================================== BUG: KCSAN: data-race in detach_buf_split / virtqueue_add write to 0xffff888101be3740 of 4 bytes by task 27668 on cpu 0: virtqueue_add+0x2212/0x2450 drivers/virtio/virtio_ring.c:1852 virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1931 request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline] copy_data drivers/char/hw_random/virtio-rng.c:74 [inline] virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92 rng_get_data drivers/char/hw_random/core.c:192 [inline] rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229 do_loop_readv_writev fs/read_write.c:746 [inline] do_iter_read+0x370/0x5d0 fs/read_write.c:788 vfs_readv fs/read_write.c:906 [inline] do_preadv+0x159/0x240 fs/read_write.c:998 __do_sys_preadv fs/read_write.c:1048 [inline] __se_sys_preadv fs/read_write.c:1043 [inline] __x64_sys_preadv+0x54/0x60 fs/read_write.c:1043 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae read to 0xffff888101be3740 of 4 bytes by interrupt on cpu 1: detach_buf_split+0x1df/0x490 drivers/virtio/virtio_ring.c:723 virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:807 [inline] virtqueue_get_buf_ctx+0x464/0x710 drivers/virtio/virtio_ring.c:2046 virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2052 random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42 vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2211 __handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158 handle_irq_event_percpu kernel/irq/handle.c:198 [inline] handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215 handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822 generic_handle_irq_desc include/linux/irqdesc.h:158 [inline] handle_irq arch/x86/kernel/irq.c:231 [inline] __common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250 common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240 asm_common_interrupt+0x1e/0x40 __sanitizer_cov_trace_pc+0x4/0x60 kernel/kcov.c:193 d_add+0xe/0x50 fs/dcache.c:2731 simple_lookup+0x85/0x90 fs/libfs.c:75 __lookup_hash+0xbc/0x180 fs/namei.c:1558 do_unlinkat+0x169/0x540 fs/namei.c:4151 __do_sys_unlink fs/namei.c:4215 [inline] __se_sys_unlink fs/namei.c:4213 [inline] __x64_sys_unlink+0x2c/0x30 fs/namei.c:4213 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x44/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000001 -> 0x00000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 383 Comm: udevd Tainted: G W 5.15.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== sd 0:0:1:0: tag#3710 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3710 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3710 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3710 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3710 CDB[20]: ba sd 0:0:1:0: tag#3648 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3648 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3648 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3648 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3648 CDB[20]: ba