KCSAN: data-race in __perf_event_overflow / fasync_remove_entry

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 245a4300 Merge branch 'rcu/kcsan' into tip/locking/kcsan
git tree: https://github.com/google/ktsan.git kcsan
console output: https://syzkaller.appspot.com/x/log.txt?x=16b144f6e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4b9db179318d21f
dashboard link: https://syzkaller.appspot.com/bug?extid=ad02812e5ea0241debc9
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ac...@kernel.org alexander...@linux.intel.com and...@fb.com a...@kernel.org b...@vger.kernel.org dan...@iogearbox.net jo...@redhat.com ka...@fb.com linux-...@vger.kernel.org mark.r...@arm.com mi...@redhat.com namh...@kernel.org net...@vger.kernel.org pet...@infradead.org songliu...@fb.com y...@fb.com el...@google.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ad0281...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __perf_event_overflow / fasync_remove_entry

read to 0xffff88809d023f00 of 8 bytes by interrupt on cpu 0:
__perf_event_overflow+0x11d/0x200 kernel/events/core.c:8429
perf_swevent_hrtimer+0x261/0x280 kernel/events/core.c:9813
__run_hrtimer kernel/time/hrtimer.c:1517 [inline]
__hrtimer_run_queues+0x274/0x5f0 kernel/time/hrtimer.c:1579
hrtimer_interrupt+0x22a/0x480 kernel/time/hrtimer.c:1641
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline]
smp_apic_timer_interrupt+0xdc/0x280 arch/x86/kernel/apic/apic.c:1135
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
__should_failslab+0x71/0x130 mm/failslab.c:26
should_failslab+0x9/0x14 mm/slab_common.c:1810
slab_pre_alloc_hook mm/slab.h:567 [inline]
slab_alloc_node mm/slab.c:3227 [inline]
kmem_cache_alloc_node+0x39/0x660 mm/slab.c:3575
__alloc_skb+0x8e/0x360 net/core/skbuff.c:197
alloc_skb include/linux/skbuff.h:1049 [inline]
sctp_packet_transmit+0x154/0x1800 net/sctp/output.c:572
sctp_outq_flush_transports net/sctp/outqueue.c:1146 [inline]
sctp_outq_flush+0x1e9/0x14c0 net/sctp/outqueue.c:1194
sctp_outq_uncork+0x64/0x80 net/sctp/outqueue.c:757
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1786 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1189 [inline]
sctp_do_sm+0x37f/0x2f10 net/sctp/sm_sideeffect.c:1160
sctp_assoc_bh_rcv+0x2d7/0x460 net/sctp/associola.c:1045
sctp_inq_push+0x107/0x1a0 net/sctp/inqueue.c:80
sctp_backlog_rcv+0x112/0x7d0 net/sctp/input.c:344
sk_backlog_rcv include/net/sock.h:949 [inline]
__release_sock+0x135/0x1e0 net/core/sock.c:2437
release_sock+0x61/0x160 net/core/sock.c:2953
sctp_setsockopt net/sctp/socket.c:4860 [inline]
sctp_setsockopt+0x11b/0x5230 net/sctp/socket.c:4657
sock_common_setsockopt+0x67/0x90 net/core/sock.c:3149
__sys_setsockopt+0x1ce/0x370 net/socket.c:2117
__do_sys_setsockopt net/socket.c:2133 [inline]
__se_sys_setsockopt net/socket.c:2130 [inline]
__x64_sys_setsockopt+0x70/0x90 net/socket.c:2130
do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff88809d023f00 of 8 bytes by task 15198 on cpu 1:
fasync_remove_entry+0xba/0x120 fs/fcntl.c:882
fasync_helper+0xcf/0xdc fs/fcntl.c:981
perf_fasync+0x6c/0xa0 kernel/events/core.c:6002
__fput+0x46a/0x520 fs/file_table.c:277
____fput+0x1f/0x30 fs/file_table.c:313
task_work_run+0xf6/0x130 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x2b4/0x2c0 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
do_syscall_64+0x384/0x3a0 arch/x86/entry/common.c:304
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 15198 Comm: syz-executor.0 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[Dmitry Vyukov]

This looks weird.
Is it also a use-after-free/out-of-bounds which results in bogus race
(similar to what we see with kmsan)?...
But I don't see any existing reports with UAF/OOB for involved functions...

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-upstream-moderation" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-upstream-m...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-upstream-moderation/0000000000003b7cb9059e3d2705%40google.com.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.