KCSAN: data-race in __x64_sys_ptrace / ptrace_stop (2)

11 views
Skip to first unread message

syzbot

unread,
Jun 13, 2020, 12:24:12 AM6/13/20
to el...@google.com, syzkaller-upst...@googlegroups.com
Hello,

syzbot found the following crash on:

HEAD commit: 7c3cd68e Merge remote-tracking branch 'linux-rcu/kcsan' in..
git tree: https://github.com/google/ktsan.git kcsan
console output: https://syzkaller.appspot.com/x/log.txt?x=10b84151100000
kernel config: https://syzkaller.appspot.com/x/.config?x=ff291dc25f22cdda
dashboard link: https://syzkaller.appspot.com/bug?extid=829eea397372cc52d9b8
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
CC: [ak...@linux-foundation.org chri...@brauner.io ebie...@xmission.com jo...@joelfernandes.org linux-...@vger.kernel.org ol...@redhat.com]

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+829eea...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __x64_sys_ptrace / ptrace_stop

write to 0xffff888088c23010 of 8 bytes by task 2936 on cpu 0:
ptrace_stop+0x5e/0x4f0 kernel/signal.c:2145
ptrace_do_notify+0xe7/0x110 kernel/signal.c:2268
ptrace_notify+0x8c/0xc0 kernel/signal.c:2278
ptrace_report_syscall include/linux/tracehook.h:66 [inline]
tracehook_report_syscall_entry include/linux/tracehook.h:104 [inline]
syscall_trace_enter+0x4c7/0x720 arch/x86/entry/common.c:85
do_syscall_64+0x2ab/0x3b0 arch/x86/entry/common.c:291
entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888088c23010 of 8 bytes by task 2938 on cpu 1:
ptrace_unfreeze_traced kernel/ptrace.c:193 [inline]
__do_sys_ptrace kernel/ptrace.c:1279 [inline]
__se_sys_ptrace kernel/ptrace.c:1242 [inline]
__x64_sys_ptrace+0x14e/0x270 kernel/ptrace.c:1242
do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 2938 Comm: syz-executor.2 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 2938 Comm: syz-executor.2 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x11d/0x187 lib/dump_stack.c:118
panic+0x210/0x640 kernel/panic.c:221
kcsan_report.cold+0xc/0x1a kernel/kcsan/report.c:626
kcsan_setup_watchpoint+0x3fb/0x440 kernel/kcsan/core.c:519
ptrace_unfreeze_traced kernel/ptrace.c:193 [inline]
__do_sys_ptrace kernel/ptrace.c:1279 [inline]
__se_sys_ptrace kernel/ptrace.c:1242 [inline]
__x64_sys_ptrace+0x14e/0x270 kernel/ptrace.c:1242
do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45ca69
Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f62280b8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000065
RAX: ffffffffffffffda RBX: 00000000004fb240 RCX: 000000000045ca69
RDX: 0000000000000000 RSI: 000000000000069b RDI: 0000000000000018
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000881 R14: 00000000004cb6ad R15: 00007f62280b96d4
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Jul 23, 2020, 4:53:11 AM7/23/20
to el...@google.com, syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages