KCSAN: data-race in __io_fill_cqe / io_uring_poll

3 views
Skip to first unread message

syzbot

unread,
Mar 9, 2022, 2:51:22 PM3/9/22
to syzkaller-upst...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 330f4c53d3c2 ARM: fix build error when BPF_SYSCALL is disa..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12be0511700000
kernel config: https://syzkaller.appspot.com/x/.config?x=5f8eb792c7b91c8f
dashboard link: https://syzkaller.appspot.com/bug?extid=2ab8fd8e89e11f3bf4b7
compiler: Debian clang version 11.0.1-2, GNU ld (GNU Binutils for Debian) 2.35.2
CC: [asml.s...@gmail.com ax...@kernel.dk io-u...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2ab8fd...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __io_fill_cqe / io_uring_poll

write to 0xffff8881270fba00 of 4 bytes by task 17731 on cpu 0:
io_get_cqe fs/io_uring.c:1725 [inline]
__io_fill_cqe+0xf9/0x380 fs/io_uring.c:1915
__io_req_complete_post+0x6c/0x420 fs/io_uring.c:1944
io_req_complete_post+0x40/0xc0 fs/io_uring.c:1972
io_req_complete_failed fs/io_uring.c:2003 [inline]
io_drain_req+0x154/0x556 fs/io_uring.c:6635
io_queue_sqe_fallback fs/io_uring.c:7125 [inline]
io_queue_sqe+0x216/0x550 fs/io_uring.c:7142
io_submit_sqe+0x796/0x4b34 fs/io_uring.c:7348
io_submit_sqes+0x25f/0x560 fs/io_uring.c:7454
__do_sys_io_uring_enter fs/io_uring.c:10162 [inline]
__se_sys_io_uring_enter+0x212/0xb00 fs/io_uring.c:10104
__x64_sys_io_uring_enter+0x74/0x80 fs/io_uring.c:10104
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881270fba00 of 4 bytes by task 17721 on cpu 1:
__io_cqring_events fs/io_uring.c:1709 [inline]
io_cqring_events fs/io_uring.c:2580 [inline]
io_uring_poll+0xc6/0x146 fs/io_uring.c:9518
vfs_poll include/linux/poll.h:88 [inline]
do_pollfd fs/select.c:873 [inline]
do_poll fs/select.c:921 [inline]
do_sys_poll+0x4b8/0xad0 fs/select.c:1015
__do_sys_ppoll fs/select.c:1121 [inline]
__se_sys_ppoll+0x18b/0x1d0 fs/select.c:1101
__x64_sys_ppoll+0x63/0x70 fs/select.c:1101
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x00000046 -> 0x0000004a

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17721 Comm: syz-executor.3 Not tainted 5.17.0-rc7-syzkaller-00064-g330f4c53d3c2-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
Apr 25, 2022, 1:18:18 PM4/25/22
to syzkaller-upst...@googlegroups.com
Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.
Reply all
Reply to author
Forward
0 new messages