Hello,
syzbot found the following issue on:
HEAD commit: 58e1100fdc59 MAINTAINERS: co-maintain random.c
git tree: upstream
console output:
https://syzkaller.appspot.com/x/log.txt?x=1726ec75b00000
kernel config:
https://syzkaller.appspot.com/x/.config?x=5308954916f6d362
dashboard link:
https://syzkaller.appspot.com/bug?extid=888f3df5bec03d45cffc
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
CC: [
jaso...@redhat.com linux-...@vger.kernel.org m...@redhat.com virtual...@lists.linux-foundation.org]
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by:
syzbot+888f3d...@syzkaller.appspotmail.com
==================================================================
BUG: KCSAN: data-race in detach_buf_split / virtqueue_add
read to 0xffff888101d93f40 of 4 bytes by task 6708 on cpu 0:
virtqueue_add_split drivers/virtio/virtio_ring.c:508 [inline]
virtqueue_add+0x4c5/0x2260 drivers/virtio/virtio_ring.c:1804
virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1883
request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline]
copy_data drivers/char/hw_random/virtio-rng.c:74 [inline]
virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92
rng_get_data drivers/char/hw_random/core.c:192 [inline]
rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229
vfs_read+0x1e6/0x750 fs/read_write.c:479
ksys_pread64 fs/read_write.c:671 [inline]
__do_sys_pread64 fs/read_write.c:681 [inline]
__se_sys_pread64 fs/read_write.c:678 [inline]
__x64_sys_pread64+0xf5/0x150 fs/read_write.c:678
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
write to 0xffff888101d93f40 of 4 bytes by interrupt on cpu 1:
detach_buf_split+0x20c/0x490 drivers/virtio/virtio_ring.c:712
virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:790 [inline]
virtqueue_get_buf_ctx+0x38d/0x5d0 drivers/virtio/virtio_ring.c:1998
virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2004
random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42
vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2163
__handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:198 [inline]
handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215
handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:231 [inline]
__common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250
common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x1e/0x40
release_pages+0x125/0x7e0 mm/swap.c:919
free_pages_and_swap_cache+0x1e5/0x200 mm/swap_state.c:320
tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:242 [inline]
tlb_flush_mmu+0x597/0x5f0 mm/mmu_gather.c:249
zap_pte_range+0xe56/0x10e0 mm/memory.c:1418
zap_pmd_range mm/memory.c:1467 [inline]
zap_pud_range mm/memory.c:1496 [inline]
zap_p4d_range mm/memory.c:1517 [inline]
unmap_page_range+0x2dc/0x3d0 mm/memory.c:1538
unmap_single_vma+0x157/0x210 mm/memory.c:1583
unmap_vmas+0xd0/0x180 mm/memory.c:1615
exit_mmap+0x23d/0x470 mm/mmap.c:3170
__mmput+0x27/0x1b0 kernel/fork.c:1113
mmput+0x3d/0x50 kernel/fork.c:1134
exit_mm+0xdb/0x170 kernel/exit.c:507
do_exit+0x608/0x17a0 kernel/exit.c:819
do_group_exit+0xce/0x180 kernel/exit.c:929
get_signal+0xfc3/0x1550 kernel/signal.c:2852
arch_do_signal_or_restart+0x8c/0x2e0 arch/x86/kernel/signal.c:868
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x113/0x190 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300
do_syscall_64+0x50/0xd0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000001 -> 0x00000002
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6687 Comm: syz-executor.4 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
==================================================================
BUG: KCSAN: data-race in detach_buf_split / virtqueue_add
read to 0xffff888101d93f2c of 4 bytes by task 6738 on cpu 0:
virtqueue_add_split drivers/virtio/virtio_ring.c:530 [inline]
virtqueue_add+0x797/0x2260 drivers/virtio/virtio_ring.c:1804
virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1883
request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline]
copy_data drivers/char/hw_random/virtio-rng.c:74 [inline]
virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92
rng_get_data drivers/char/hw_random/core.c:192 [inline]
rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229
vfs_read+0x1e6/0x750 fs/read_write.c:479
ksys_pread64 fs/read_write.c:671 [inline]
__do_sys_pread64 fs/read_write.c:681 [inline]
__se_sys_pread64 fs/read_write.c:678 [inline]
__x64_sys_pread64+0xf5/0x150 fs/read_write.c:678
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
write to 0xffff888101d93f2c of 4 bytes by interrupt on cpu 1:
detach_buf_split+0x22d/0x490 drivers/virtio/virtio_ring.c:715
virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:790 [inline]
virtqueue_get_buf_ctx+0x38d/0x5d0 drivers/virtio/virtio_ring.c:1998
virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2004
random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42
vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2163
__handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:198 [inline]
handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215
handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:231 [inline]
__common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250
common_interrupt+0x9a/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x1e/0x40
__sanitizer_cov_trace_pc+0x59/0x60 kernel/kcov.c:208
avc_has_perm_noaudit+0x1f0/0x270
avc_has_perm+0x70/0x160 security/selinux/avc.c:1190
inode_has_perm security/selinux/hooks.c:1685 [inline]
file_has_perm+0x34d/0x390 security/selinux/hooks.c:1777
selinux_revalidate_file_permission security/selinux/hooks.c:3674 [inline]
selinux_file_permission+0x321/0x350 security/selinux/hooks.c:3695
security_file_permission+0x42/0xa0 security/security.c:1507
rw_verify_area fs/read_write.c:385 [inline]
vfs_write+0x16d/0x950 fs/read_write.c:581
ksys_pwrite64 fs/read_write.c:697 [inline]
__do_sys_pwrite64 fs/read_write.c:707 [inline]
__se_sys_pwrite64 fs/read_write.c:704 [inline]
__x64_sys_pwrite64+0xf5/0x150 fs/read_write.c:704
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
value changed: 0x00000100 -> 0x000000ff
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6739 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
==================================================================
BUG: KCSAN: data-race in detach_buf_split / virtqueue_add
write to 0xffff888101d93f40 of 4 bytes by task 6738 on cpu 0:
virtqueue_add+0x2077/0x2260 drivers/virtio/virtio_ring.c:1804
virtqueue_add_inbuf+0x52/0x80 drivers/virtio/virtio_ring.c:1883
request_entropy drivers/char/hw_random/virtio-rng.c:61 [inline]
copy_data drivers/char/hw_random/virtio-rng.c:74 [inline]
virtio_read+0x1f1/0x450 drivers/char/hw_random/virtio-rng.c:92
rng_get_data drivers/char/hw_random/core.c:192 [inline]
rng_dev_read+0x1b4/0x630 drivers/char/hw_random/core.c:229
vfs_read+0x1e6/0x750 fs/read_write.c:479
ksys_pread64 fs/read_write.c:671 [inline]
__do_sys_pread64 fs/read_write.c:681 [inline]
__se_sys_pread64 fs/read_write.c:678 [inline]
__x64_sys_pread64+0xf5/0x150 fs/read_write.c:678
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
read to 0xffff888101d93f40 of 4 bytes by interrupt on cpu 1:
detach_buf_split+0x1df/0x490 drivers/virtio/virtio_ring.c:711
virtqueue_get_buf_ctx_split drivers/virtio/virtio_ring.c:790 [inline]
virtqueue_get_buf_ctx+0x38d/0x5d0 drivers/virtio/virtio_ring.c:1998
virtqueue_get_buf+0x1b/0x20 drivers/virtio/virtio_ring.c:2004
random_recv_done+0x42/0x80 drivers/char/hw_random/virtio-rng.c:42
vring_interrupt+0x15d/0x180 drivers/virtio/virtio_ring.c:2163
__handle_irq_event_percpu+0x93/0x480 kernel/irq/handle.c:158
handle_irq_event_percpu kernel/irq/handle.c:198 [inline]
handle_irq_event+0x9a/0x150 kernel/irq/handle.c:215
handle_edge_irq+0x18e/0x5f0 kernel/irq/chip.c:822
generic_handle_irq_desc include/linux/irqdesc.h:158 [inline]
handle_irq arch/x86/kernel/irq.c:231 [inline]
__common_interrupt+0x60/0x100 arch/x86/kernel/irq.c:250
common_interrupt+0x45/0xc0 arch/x86/kernel/irq.c:240
asm_common_interrupt+0x1e/0x40
value changed: 0x00000001 -> 0x00000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6739 Comm: syz-executor.0 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
---
This report is generated by a bot. It may contain errors.
See
https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at
syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.