linux-kernel - Re: [syzbot] [virt?] KCSAN: data-race in virtqueue_disable_cb / vring

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240912105002-mutt-send-email-mst@kernel.org>
Date: Thu, 12 Sep 2024 11:00:12 -0400
From: "Michael S. Tsirkin" <mst@...hat.com>
To: Marco Elver <elver@...gle.com>
Cc: syzbot <syzbot+8a02104389c2e0ef5049@...kaller.appspotmail.com>,
	eperezma@...hat.com, jasowang@...hat.com,
	linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
	virtualization@...ts.linux.dev, xuanzhuo@...ux.alibaba.com
Subject: Re: [syzbot] [virt?] KCSAN: data-race in virtqueue_disable_cb /
 vring_interrupt (4)

On Thu, Sep 12, 2024 at 04:46:28PM +0200, Marco Elver wrote:
> On Thu, 12 Sept 2024 at 16:34, Michael S. Tsirkin <mst@...hat.com> wrote:
> >
> > On Thu, Sep 12, 2024 at 03:48:32PM +0200, Marco Elver wrote:
> > > On Thu, 12 Sept 2024 at 13:03, Michael S. Tsirkin <mst@...hat.com> wrote:
> > > >
> > > > On Thu, Sep 12, 2024 at 01:11:21AM -0700, syzbot wrote:
> > > > > Hello,
> > > > >
> > > > > syzbot found the following issue on:
> > > > >
> > > > > HEAD commit:    7c6a3a65ace7 minmax: reduce min/max macro expansion in ato..
> > > > > git tree:       upstream
> > > > > console output: https://syzkaller.appspot.com/x/log.txt?x=1608e49f980000
> > > > > kernel config:  https://syzkaller.appspot.com/x/.config?x=1e7d02549be622b2
> > > > > dashboard link: https://syzkaller.appspot.com/bug?extid=8a02104389c2e0ef5049
> > > > > compiler:       Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
> > > > >
> > > > > Unfortunately, I don't have any reproducer for this issue yet.
> > > > >
> > > > > Downloadable assets:
> > > > > disk image: https://storage.googleapis.com/syzbot-assets/a1f7496fa21f/disk-7c6a3a65.raw.xz
> > > > > vmlinux: https://storage.googleapis.com/syzbot-assets/f423739e51a9/vmlinux-7c6a3a65.xz
> > > > > kernel image: https://storage.googleapis.com/syzbot-assets/b65a0f38cbd7/bzImage-7c6a3a65.xz
> > > > >
> > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > > > > Reported-by: syzbot+8a02104389c2e0ef5049@...kaller.appspotmail.com
> > > > >
> > > > > ==================================================================
> > > > > BUG: KCSAN: data-race in virtqueue_disable_cb / vring_interrupt
> > > > >
> > > > > write to 0xffff88810285ef52 of 1 bytes by interrupt on cpu 0:
> > > > >  vring_interrupt+0x12b/0x180 drivers/virtio/virtio_ring.c:2591
> > > >
> > > >
> > > > Yes, it's racy!
> > > >
> > > > 2589:        /* Just a hint for performance: so it's ok that this can be racy! */
> > > > 2590:        if (vq->event)
> > > > 2591:            vq->event_triggered = true;
> > > >
> > > >
> > > > Question: is there a way to annotate code to tell syzbot it's ok?
> > >
> > > In this case, "if (data_race(vq->event))" might be the right choice.
> >
> > No, vq->event is not racy.
> 
> Oops - yes.
> 
> > The race is between a write and a read of event_triggered.
> > I think data_race tags a read, it can not tag a write, correct?
> 
> data_race() takes an expression, so either read or write can be
> enclosed - e.g. "data_race(vq->event_triggered = true);" works as
> well.

Ah, good to know. Yes, I see it is basically __kcsan_disable_current +
__kcsan_enable_current.  Will do.



-- 
MST