lkml.org 
[lkml]   [2022]   [Jan]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectKCSAN: data-race in tick_nohz_stop_tick / tick_nohz_stop_tick
Hello,

When using Syzkaller to fuzz the latest Linux kernel, the following
crash was triggered.

HEAD commit: a7904a538933 Linux 5.16-rc6
git tree: upstream
console output: KCSAN: data-race in tick_nohz_stop_tick / tick_nohz_stop_tick
kernel config: https://paste.ubuntu.com/p/QB39MJKWKb/plain/
Syzlang reproducer: https://paste.ubuntu.com/p/Xtr5t49Jv6/plain/

If you fix this issue, please add the following tag to the commit:

Reported-by: Hypericum <hypericumperforatum4444@gmail.com>

I think there are two threads visit the variable tick_do_timer_cpu
without locking.

reproducer log: https://paste.ubuntu.com/p/tXZnXYszKs/plain/
reproducer report:
==================================================================
BUG: KCSAN: data-race in tick_nohz_stop_tick / tick_nohz_stop_tick

write to 0xffffffff85ebf1e0 of 4 bytes by task 0 on cpu 7:
tick_nohz_stop_tick+0xa5/0x410 kernel/time/tick-sched.c:873
__tick_nohz_idle_stop_tick kernel/time/tick-sched.c:1062 [inline]
tick_nohz_idle_stop_tick+0xde/0x1a0 kernel/time/tick-sched.c:1083
cpuidle_idle_call kernel/sched/idle.c:192 [inline]
do_idle+0xe3/0x250 kernel/sched/idle.c:306
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:403
secondary_startup_64_no_verify+0xb1/0xbb

read to 0xffffffff85ebf1e0 of 4 bytes by task 0 on cpu 0:
tick_nohz_stop_tick+0x7f/0x410 kernel/time/tick-sched.c:872
__tick_nohz_idle_stop_tick kernel/time/tick-sched.c:1062 [inline]
tick_nohz_idle_stop_tick+0xde/0x1a0 kernel/time/tick-sched.c:1083
cpuidle_idle_call kernel/sched/idle.c:192 [inline]
do_idle+0xe3/0x250 kernel/sched/idle.c:306
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:403
rest_init+0xed/0xf0 init/main.c:725
arch_call_rest_init+0xa/0xb
start_kernel+0x5de/0x663 init/main.c:1135
secondary_startup_64_no_verify+0xb1/0xbb

value changed: 0x00000007 -> 0xffffffff

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-rc8+ #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
==================================================================

\
 
 \ /
  Last update: 2022-01-11 14:36    [W:2.425 / U:0.440 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site