syzbot


KCSAN: data-race in prepare_signal / ptrace_attach (13)

Status: moderation: reported on 2025/04/17 00:20
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+f95a52b1bb9c1a00dd0c@syzkaller.appspotmail.com
First crash: 30d, last: 12d
Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in prepare_signal / ptrace_attach (5) kernel 2 1394d 1408d 0/28 auto-closed as invalid on 2021/08/26 15:59
upstream KCSAN: data-race in prepare_signal / ptrace_attach (12) kernel 1 144d 144d 0/28 auto-obsoleted due to no activity on 2025/02/17 10:01
upstream KCSAN: data-race in prepare_signal / ptrace_attach kernel 1 1788d 1788d 0/28 auto-closed as invalid on 2020/07/29 00:33
upstream KCSAN: data-race in prepare_signal / ptrace_attach (6) kernel 1 1237d 1237d 0/28 auto-closed as invalid on 2022/01/30 21:35
upstream KCSAN: data-race in prepare_signal / ptrace_attach (2) kernel 3 1711d 1747d 0/28 auto-closed as invalid on 2020/10/13 05:51
upstream KCSAN: data-race in prepare_signal / ptrace_attach (9) kernel 1 559d 523d 0/28 auto-obsoleted due to no activity on 2023/12/25 00:07
upstream KCSAN: data-race in prepare_signal / ptrace_attach (11) kernel 1 402d 402d 0/28 auto-obsoleted due to no activity on 2024/05/14 10:05
upstream KCSAN: data-race in prepare_signal / ptrace_attach (7) kernel 1 1174d 1174d 0/28 auto-closed as invalid on 2022/04/03 14:09
upstream KCSAN: data-race in prepare_signal / ptrace_attach (8) kernel 1 1096d 1096d 0/28 auto-closed as invalid on 2022/06/20 14:20
upstream KCSAN: data-race in prepare_signal / ptrace_attach (10) kernel 2 448d 474d 0/28 auto-obsoleted due to no activity on 2024/03/29 18:16
upstream KCSAN: data-race in prepare_signal / ptrace_attach (4) kernel 1 1478d 1478d 0/28 auto-closed as invalid on 2021/06/03 07:49
upstream KCSAN: data-race in prepare_signal / ptrace_attach (3) kernel 2 1572d 1607d 0/28 auto-closed as invalid on 2021/03/01 09:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in prepare_signal / ptrace_attach

write to 0xffff8881014a52b0 of 4 bytes by task 14654 on cpu 1:
 ptrace_attach+0x230/0x4f0 kernel/ptrace.c:462
 __do_sys_ptrace kernel/ptrace.c:1276 [inline]
 __se_sys_ptrace+0x146/0x2b0 kernel/ptrace.c:1258
 __x64_sys_ptrace+0x55/0x70 kernel/ptrace.c:1258
 x64_sys_call+0x1d6a/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:102
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881014a52b0 of 4 bytes by task 14655 on cpu 0:
 sig_ignored kernel/signal.c:121 [inline]
 prepare_signal+0x450/0x670 kernel/signal.c:935
 __send_signal_locked+0x30/0x760 kernel/signal.c:1053
 send_signal_locked+0x34e/0x3c0 kernel/signal.c:1216
 force_sig_info_to_task+0x1fb/0x290 kernel/signal.c:1320
 force_sig_fault_to_task kernel/signal.c:1699 [inline]
 force_sig_fault+0x71/0xa0 kernel/signal.c:1704
 __bad_area_nosemaphore+0x25d/0x330 arch/x86/mm/fault.c:824
 handle_page_fault arch/x86/mm/fault.c:1478 [inline]
 exc_page_fault+0x6d/0xc0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14655 Comm: syz.6.3454 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/05 03:24 upstream 92a09c47464d b0714e37 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in prepare_signal / ptrace_attach
2025/04/17 00:19 upstream c62f4b82d571 a95239b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in prepare_signal / ptrace_attach
* Struck through repros no longer work on HEAD.