syzbot


KCSAN: data-race in serial8250_do_startup / serial8250_modem_status (3)

Status: moderation: reported on 2025/12/27 23:53
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+3aef261f2643b65ab7d7@syzkaller.appspotmail.com
First crash: 11d, last: 2h04m
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in serial8250_do_startup / serial8250_modem_status (2) serial 6 1 78d 78d 0/29 auto-obsoleted due to no activity on 2025/12/17 04:14
upstream KCSAN: data-race in serial8250_do_startup / serial8250_modem_status serial 6 5 138d 211d 0/29 auto-obsoleted due to no activity on 2025/10/18 03:59

Sample crash report:
==================================================================
BUG: KCSAN: data-race in serial8250_do_startup / serial8250_modem_status

write to 0xffffffff88f0ddf6 of 1 bytes by task 21745 on cpu 1:
 serial8250_do_startup+0x1491/0x1c10 drivers/tty/serial/8250/8250_port.c:2327
 serial8250_startup+0x41/0x50 drivers/tty/serial/8250/8250_port.c:2347
 uart_port_startup drivers/tty/serial/serial_core.c:321 [inline]
 uart_startup+0x468/0x8e0 drivers/tty/serial/serial_core.c:365
 uart_port_activate+0x67/0xc0 drivers/tty/serial/serial_core.c:1946
 tty_port_open+0x196/0x270 drivers/tty/tty_port.c:747
 uart_open+0x30/0x40 drivers/tty/serial/serial_core.c:1926
 tty_open+0x3d4/0xaf0 drivers/tty/tty_io.c:2137
 chrdev_open+0x2eb/0x3a0 fs/char_dev.c:414
 do_dentry_open+0x54b/0xa60 fs/open.c:962
 vfs_open+0x37/0x1e0 fs/open.c:1094
 do_open fs/namei.c:4628 [inline]
 path_openat+0x1ddd/0x23b0 fs/namei.c:4787
 do_filp_open+0x109/0x230 fs/namei.c:4814
 do_sys_openat2+0xa6/0x150 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1447
 x64_sys_call+0x2b07/0x3000 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88f0ddf6 of 1 bytes by interrupt on cpu 0:
 serial8250_modem_status+0x6a/0x1e0 drivers/tty/serial/8250/8250_port.c:1740
 serial8250_handle_irq+0x3d6/0x660 drivers/tty/serial/8250/8250_port.c:1824
 serial8250_default_handle_irq+0x8e/0x170 drivers/tty/serial/8250/8250_port.c:1846
 serial8250_interrupt+0x63/0x130 drivers/tty/serial/8250/8250_core.c:86
 __handle_irq_event_percpu+0x8b/0x4c0 kernel/irq/handle.c:211
 handle_irq_event_percpu kernel/irq/handle.c:248 [inline]
 handle_irq_event+0x64/0xf0 kernel/irq/handle.c:265
 handle_edge_irq+0x154/0x470 kernel/irq/chip.c:855
 generic_handle_irq_desc include/linux/irqdesc.h:172 [inline]
 handle_irq arch/x86/kernel/irq.c:255 [inline]
 call_irq_handler arch/x86/kernel/irq.c:-1 [inline]
 __common_interrupt+0x60/0xb0 arch/x86/kernel/irq.c:326
 common_interrupt+0x3e/0x90 arch/x86/kernel/irq.c:319
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
 get_ctx kernel/kcsan/core.c:206 [inline]
 check_access kernel/kcsan/core.c:750 [inline]
 __tsan_read1+0xc2/0x180 kernel/kcsan/core.c:1022
 pie_calculate_probability+0x48d/0x4d0 net/sched/sch_pie.c:422
 fq_pie_timer+0xee/0x1d0 net/sched/sch_fq_pie.c:402
 call_timer_fn+0x3b/0x290 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2373 [inline]
 __run_timer_base+0x415/0x610 kernel/time/timer.c:2385
 run_timer_base kernel/time/timer.c:2394 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2404
 handle_softirqs+0xba/0x290 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:723
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 hlist_nulls_empty include/linux/list_nulls.h:89 [inline]
 inet_twsk_purge+0x55/0x3c0 net/ipv4/inet_timewait_sock.c:314
 tcp_twsk_purge+0x7c/0xb0 net/ipv4/tcp_minisocks.c:-1
 tcp_sk_exit_batch+0x26/0xf0 net/ipv4/tcp_ipv4.c:3645
 ops_exit_list net/core/net_namespace.c:205 [inline]
 ops_undo_list+0x2c0/0x410 net/core/net_namespace.c:252
 cleanup_net+0x2f4/0x520 net/core/net_namespace.c:696
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x00 -> 0x05

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4016 Comm: kworker/u8:39 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: netns cleanup_net
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/08 09:19 upstream f0b9d8eb98df d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in serial8250_do_startup / serial8250_modem_status
2025/12/27 23:52 upstream d26143bb38e2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in serial8250_do_startup / serial8250_modem_status
* Struck through repros no longer work on HEAD.