KCSAN: data-race in tcp_poll / tcp_recvmsg (2)

Status: fixed on 2019/11/04 14:50
Subsystems: net
[Documentation on labels]
Fix commit: 7db48e983930 tcp: annotate tp->copied_seq lockless reads
First crash: 2486d, last: 2480d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in tcp_poll / tcp_recvmsg net 6 26 2487d 2497d 0/29 closed as invalid on 2019/10/15 15:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in tcp_poll / tcp_recvmsg

read to 0xffff8881236177bc of 4 bytes by task 7108 on cpu 1:
 tcp_poll+0x1cc/0x6b0 net/ipv4/tcp.c:549
 sock_poll+0xed/0x250 net/socket.c:1256
 vfs_poll include/linux/poll.h:90 [inline]
 ep_item_poll.isra.0+0x90/0x190 fs/eventpoll.c:892
 ep_send_events_proc+0x113/0x590 fs/eventpoll.c:1749
 ep_scan_ready_list.constprop.0+0x189/0x500 fs/eventpoll.c:704
 ep_send_events fs/eventpoll.c:1793 [inline]
 ep_poll+0xe3/0x900 fs/eventpoll.c:1930
 do_epoll_wait+0x162/0x180 fs/eventpoll.c:2294
 __do_sys_epoll_pwait fs/eventpoll.c:2325 [inline]
 __se_sys_epoll_pwait fs/eventpoll.c:2311 [inline]
 __x64_sys_epoll_pwait+0xcd/0x180 fs/eventpoll.c:2311
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff8881236177bc of 4 bytes by task 7112 on cpu 0:
 tcp_recvmsg+0xd86/0x1a30 net/ipv4/tcp.c:2142
 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838
 sock_recvmsg_nosec net/socket.c:871 [inline]
 sock_recvmsg net/socket.c:889 [inline]
 sock_recvmsg+0x92/0xb0 net/socket.c:885
 sock_read_iter+0x15f/0x1e0 net/socket.c:967
 call_read_iter include/linux/fs.h:1889 [inline]
 new_sync_read+0x389/0x4f0 fs/read_write.c:414
 __vfs_read+0xb1/0xc0 fs/read_write.c:427
 vfs_read fs/read_write.c:461 [inline]
 vfs_read+0x143/0x2c0 fs/read_write.c:446
 ksys_read+0xd5/0x1b0 fs/read_write.c:587
 __do_sys_read fs/read_write.c:597 [inline]
 __se_sys_read fs/read_write.c:595 [inline]
 __x64_sys_read+0x4c/0x60 fs/read_write.c:595
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 7112 Comm: syz-fuzzer Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (22):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/22 12:23 https://github.com/google/ktsan.git kcsan 05f2236801fe c59a7cd8 .config console log report ci2-upstream-kcsan-gce
2019/10/22 07:27 https://github.com/google/ktsan.git kcsan 05f2236801fe c59a7cd8 .config console log report ci2-upstream-kcsan-gce
2019/10/21 16:07 https://github.com/google/ktsan.git kcsan 05f2236801fe b24d2b8a .config console log report ci2-upstream-kcsan-gce
2019/10/21 12:53 https://github.com/google/ktsan.git kcsan 05f2236801fe b24d2b8a .config console log report ci2-upstream-kcsan-gce
2019/10/21 11:40 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/21 05:43 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/21 02:53 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/21 01:58 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/20 09:50 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/20 08:40 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/19 17:50 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/19 09:37 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/19 01:20 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/18 05:22 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/17 20:53 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/17 15:37 https://github.com/google/ktsan.git kcsan 05f2236801fe 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/17 13:47 https://github.com/google/ktsan.git kcsan a6311db074d9 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/17 10:56 https://github.com/google/ktsan.git kcsan a6311db074d9 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/16 22:36 https://github.com/google/ktsan.git kcsan a6311db074d9 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/16 21:57 https://github.com/google/ktsan.git kcsan a6311db074d9 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/16 18:16 https://github.com/google/ktsan.git kcsan a6311db074d9 8c88c9c1 .config console log report ci2-upstream-kcsan-gce
2019/10/16 05:05 https://github.com/google/ktsan.git kcsan e3d315561216 d4ea592f .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.