* [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9)
@ 2024-08-13 8:50 syzbot
2024-08-13 12:14 ` Jens Axboe
0 siblings, 1 reply; 4+ messages in thread
From: syzbot @ 2024-08-13 8:50 UTC (permalink / raw)
To: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6a0e38264012 Merge tag 'for-6.11-rc2-tag' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1019759d980000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb57e6ebf675f9d2
dashboard link: https://syzkaller.appspot.com/bug?extid=2b946a3fd80caf971b21
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/753a842a966b/disk-6a0e3826.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e12e23519777/vmlinux-6a0e3826.xz
kernel image: https://storage.googleapis.com/syzbot-assets/bce0584a8cb4/bzImage-6a0e3826.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]
==================================================================
BUG: KCSAN: data-race in io_sq_thread / io_sq_thread_park
write to 0xffff888111459638 of 8 bytes by task 10761 on cpu 1:
io_sq_thread+0xdab/0xff0 io_uring/sqpoll.c:383
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
read to 0xffff888111459638 of 8 bytes by task 10329 on cpu 0:
io_sq_thread_park+0x1b/0x80 io_uring/sqpoll.c:47
io_ring_exit_work+0x197/0x500 io_uring/io_uring.c:2786
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
worker_thread+0x526/0x700 kernel/workqueue.c:3390
kthread+0x1d1/0x210 kernel/kthread.c:389
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
value changed: 0xffff8881223d0000 -> 0x0000000000000000
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10329 Comm: kworker/u8:8 Not tainted 6.11.0-rc2-syzkaller-00027-g6a0e38264012 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: iou_exit io_ring_exit_work
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9)
2024-08-13 8:50 [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9) syzbot
@ 2024-08-13 12:14 ` Jens Axboe
2024-08-13 12:14 ` syzbot
0 siblings, 1 reply; 4+ messages in thread
From: Jens Axboe @ 2024-08-13 12:14 UTC (permalink / raw)
To: syzbot, asml.silence, io-uring, linux-kernel, syzkaller-bugs
On 8/13/24 2:50 AM, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 6a0e38264012 Merge tag 'for-6.11-rc2-tag' of git://git.ker..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1019759d980000
> kernel config: https://syzkaller.appspot.com/x/.config?x=cb57e6ebf675f9d2
> dashboard link: https://syzkaller.appspot.com/bug?extid=2b946a3fd80caf971b21
> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/753a842a966b/disk-6a0e3826.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/e12e23519777/vmlinux-6a0e3826.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/bce0584a8cb4/bzImage-6a0e3826.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: [email protected]
>
> ==================================================================
> BUG: KCSAN: data-race in io_sq_thread / io_sq_thread_park
>
> write to 0xffff888111459638 of 8 bytes by task 10761 on cpu 1:
> io_sq_thread+0xdab/0xff0 io_uring/sqpoll.c:383
> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> read to 0xffff888111459638 of 8 bytes by task 10329 on cpu 0:
> io_sq_thread_park+0x1b/0x80 io_uring/sqpoll.c:47
> io_ring_exit_work+0x197/0x500 io_uring/io_uring.c:2786
> process_one_work kernel/workqueue.c:3231 [inline]
> process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
> worker_thread+0x526/0x700 kernel/workqueue.c:3390
> kthread+0x1d1/0x210 kernel/kthread.c:389
> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>
> value changed: 0xffff8881223d0000 -> 0x0000000000000000
It's just a debug check.
#syz test
diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
index b3722e5275e7..3b50dc9586d1 100644
--- a/io_uring/sqpoll.c
+++ b/io_uring/sqpoll.c
@@ -44,7 +44,7 @@ void io_sq_thread_unpark(struct io_sq_data *sqd)
void io_sq_thread_park(struct io_sq_data *sqd)
__acquires(&sqd->lock)
{
- WARN_ON_ONCE(sqd->thread == current);
+ WARN_ON_ONCE(data_race(sqd->thread) == current);
atomic_inc(&sqd->park_pending);
set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
--
Jens Axboe
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9)
2024-08-13 12:14 ` Jens Axboe
@ 2024-08-13 12:14 ` syzbot
2024-08-13 12:17 ` Jens Axboe
0 siblings, 1 reply; 4+ messages in thread
From: syzbot @ 2024-08-13 12:14 UTC (permalink / raw)
To: axboe; +Cc: asml.silence, axboe, io-uring, linux-kernel, syzkaller-bugs
> On 8/13/24 2:50 AM, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 6a0e38264012 Merge tag 'for-6.11-rc2-tag' of git://git.ker..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=1019759d980000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=cb57e6ebf675f9d2
>> dashboard link: https://syzkaller.appspot.com/bug?extid=2b946a3fd80caf971b21
>> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
>>
>> Unfortunately, I don't have any reproducer for this issue yet.
>>
>> Downloadable assets:
>> disk image: https://storage.googleapis.com/syzbot-assets/753a842a966b/disk-6a0e3826.raw.xz
>> vmlinux: https://storage.googleapis.com/syzbot-assets/e12e23519777/vmlinux-6a0e3826.xz
>> kernel image: https://storage.googleapis.com/syzbot-assets/bce0584a8cb4/bzImage-6a0e3826.xz
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: [email protected]
>>
>> ==================================================================
>> BUG: KCSAN: data-race in io_sq_thread / io_sq_thread_park
>>
>> write to 0xffff888111459638 of 8 bytes by task 10761 on cpu 1:
>> io_sq_thread+0xdab/0xff0 io_uring/sqpoll.c:383
>> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>>
>> read to 0xffff888111459638 of 8 bytes by task 10329 on cpu 0:
>> io_sq_thread_park+0x1b/0x80 io_uring/sqpoll.c:47
>> io_ring_exit_work+0x197/0x500 io_uring/io_uring.c:2786
>> process_one_work kernel/workqueue.c:3231 [inline]
>> process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
>> worker_thread+0x526/0x700 kernel/workqueue.c:3390
>> kthread+0x1d1/0x210 kernel/kthread.c:389
>> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
>> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
>>
>> value changed: 0xffff8881223d0000 -> 0x0000000000000000
>
> It's just a debug check.
>
> #syz test
This crash does not have a reproducer. I cannot test it.
>
> diff --git a/io_uring/sqpoll.c b/io_uring/sqpoll.c
> index b3722e5275e7..3b50dc9586d1 100644
> --- a/io_uring/sqpoll.c
> +++ b/io_uring/sqpoll.c
> @@ -44,7 +44,7 @@ void io_sq_thread_unpark(struct io_sq_data *sqd)
> void io_sq_thread_park(struct io_sq_data *sqd)
> __acquires(&sqd->lock)
> {
> - WARN_ON_ONCE(sqd->thread == current);
> + WARN_ON_ONCE(data_race(sqd->thread) == current);
>
> atomic_inc(&sqd->park_pending);
> set_bit(IO_SQ_THREAD_SHOULD_PARK, &sqd->state);
>
> --
> Jens Axboe
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9)
2024-08-13 12:14 ` syzbot
@ 2024-08-13 12:17 ` Jens Axboe
0 siblings, 0 replies; 4+ messages in thread
From: Jens Axboe @ 2024-08-13 12:17 UTC (permalink / raw)
To: syzbot; +Cc: asml.silence, io-uring, linux-kernel, syzkaller-bugs
On Tue, Aug 13, 2024 at 6:14?AM syzbot <[email protected]> wrote:
>
> > On 8/13/24 2:50 AM, syzbot wrote:
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit: 6a0e38264012 Merge tag 'for-6.11-rc2-tag' of git://git.ker..
> >> git tree: upstream
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=1019759d980000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=cb57e6ebf675f9d2
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=2b946a3fd80caf971b21
> >> compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> >>
> >> Unfortunately, I don't have any reproducer for this issue yet.
> >>
> >> Downloadable assets:
> >> disk image: https://storage.googleapis.com/syzbot-assets/753a842a966b/disk-6a0e3826.raw.xz
> >> vmlinux: https://storage.googleapis.com/syzbot-assets/e12e23519777/vmlinux-6a0e3826.xz
> >> kernel image: https://storage.googleapis.com/syzbot-assets/bce0584a8cb4/bzImage-6a0e3826.xz
> >>
> >> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >> Reported-by: [email protected]
> >>
> >> ==================================================================
> >> BUG: KCSAN: data-race in io_sq_thread / io_sq_thread_park
> >>
> >> write to 0xffff888111459638 of 8 bytes by task 10761 on cpu 1:
> >> io_sq_thread+0xdab/0xff0 io_uring/sqpoll.c:383
> >> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
> >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >>
> >> read to 0xffff888111459638 of 8 bytes by task 10329 on cpu 0:
> >> io_sq_thread_park+0x1b/0x80 io_uring/sqpoll.c:47
> >> io_ring_exit_work+0x197/0x500 io_uring/io_uring.c:2786
> >> process_one_work kernel/workqueue.c:3231 [inline]
> >> process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
> >> worker_thread+0x526/0x700 kernel/workqueue.c:3390
> >> kthread+0x1d1/0x210 kernel/kthread.c:389
> >> ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
> >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> >>
> >> value changed: 0xffff8881223d0000 -> 0x0000000000000000
> >
> > It's just a debug check.
> >
> > #syz test
>
> This crash does not have a reproducer. I cannot test it.
#syz fix: io_uring/sqpoll: annotate debug task == current with data_race()
--
Jens Axboe
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-08-13 12:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-13 8:50 [syzbot] [io-uring?] KCSAN: data-race in io_sq_thread / io_sq_thread_park (9) syzbot
2024-08-13 12:14 ` Jens Axboe
2024-08-13 12:14 ` syzbot
2024-08-13 12:17 ` Jens Axboe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox