[syzbot] [io-uring?] KCSAN: data-race in io_req_task_cancel / io_wq_free_work

[syzbot] [io-uring?] KCSAN: data-race in io_req_task_cancel / io_wq_free_work

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    92b71befc349 Merge tag 'objtool-urgent-2025-04-01' of git:..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11195404580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a8120cade23cf14e
dashboard link: https://syzkaller.appspot.com/bug?extid=903a2ad71fb3f1e47cf5
compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2e7df7bc2f52/disk-92b71bef.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/be59123d5efb/vmlinux-92b71bef.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7c9eff86053e/bzImage-92b71bef.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+903a2ad71fb3f1e47cf5@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in io_req_task_cancel / io_wq_free_work

write to 0xffff888117207448 of 8 bytes by task 3861 on cpu 1:
 req_set_fail io_uring/io_uring.h:-1 [inline]
 io_req_defer_failed io_uring/io_uring.c:927 [inline]
 io_req_task_cancel+0x7c/0x1a0 io_uring/io_uring.c:1360
 io_handle_tw_list+0x194/0x1d0 io_uring/io_uring.c:1057
 tctx_task_work_run+0x6e/0x1c0 io_uring/io_uring.c:1121
 tctx_task_work+0x44/0x80 io_uring/io_uring.c:1139
 task_work_run+0x13c/0x1b0 kernel/task_work.c:227
 get_signal+0xee2/0x1080 kernel/signal.c:2809
 arch_do_signal_or_restart+0x9a/0x4b0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x62/0x120 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888117207448 of 8 bytes by task 3871 on cpu 0:
 req_ref_put_and_test io_uring/refs.h:22 [inline]
 io_wq_free_work+0x24/0x1b0 io_uring/io_uring.c:1799
 io_worker_handle_work+0x4c9/0x9f0 io_uring/io-wq.c:618
 io_wq_worker+0x277/0x850 io_uring/io-wq.c:669
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x0000000000180051 -> 0x0000000000980111

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3871 Comm: iou-wrk-3861 Not tainted 6.14.0-syzkaller-12508-g92b71befc349 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [io-uring?] KCSAN: data-race in io_req_task_cancel / io_wq_free_work

[Pavel Begunkov]

On 4/3/25 08:04, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    92b71befc349 Merge tag 'objtool-urgent-2025-04-01' of git:..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11195404580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=a8120cade23cf14e
> dashboard link: https://syzkaller.appspot.com/bug?extid=903a2ad71fb3f1e47cf5
> compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> 
> Unfortunately, I don't have any reproducer for this issue yet.
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/2e7df7bc2f52/disk-92b71bef.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/be59123d5efb/vmlinux-92b71bef.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7c9eff86053e/bzImage-92b71bef.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+903a2ad71fb3f1e47cf5@syzkaller.appspotmail.com

It's benign, the write is for unrelated bits and the flag used in
the read path is set before there could be any races, the compiler
would need to make up a value to anything bad to happen.

We can improve it a little bit though, it'll try that.

-- 
Pavel Begunkov