kernel-sanitizers

KCSAN: Found bugs

This is a non-exhaustive list of some upstream fixes for data races found by KCSAN. Last updated: Aug 23, 2021.

• perf: Fix data race between pin_count increment/decrement
• io_uring: fix data race to avoid potential NULL-deref
• timers: Move clearing of base::timer_running under base:: Lock
• net: igmp: fix data-race in igmp_ifc_timer_expire()
• udp: annotate data races around unix_sk(sk)->gso_size
• net: annotate data race around sk_ll_usec
• net/af_unix: fix a data-race in unix_dgram_sendmsg / unix_release_sock
• net/packet: annotate accesses to po->ifindex
• net/packet: annotate accesses to po->bind
• inet: annotate date races around sk->sk_txhash
• net: annotate data race in sock_error()
• inet: annotate data race in inet_send_prepare() and inet_dgram_connect()
• bpf_lru_list: Read double-checked variable once without lock
• ALSA: rawmidi: Access runtime->avail always in spinlock
• ALSA: seq: Use bool for snd_seq_queue internal flags
• mm/page_counter: fix various data races at memsw

• fat: don’t allow to mount if the FAT length == 0

  lkml

• rcu: Add *_ONCE() and data_race() to rcu_node ->exp_tasks plus locking
• tcp: annotate sk->sk_rcvbuf lockless reads

• ALSA: seq: Avoid concurrent access to queue flags

  syzbot

• ALSA: seq: Fix concurrent access to queue current tick/time
• mm: annotate a data race in page_zonenum()
• mm/mempool: fix a data race in mempool_free()
• ext4: fix a data race in EXT4_I(inode)->i_disksize
• rcutorture: Annotation lockless accesses to rcu_torture_current
• rcutorture: Add READ_ONCE() to rcu_torture_count and rcu_torture_batch
• rcutorture: Fix stray access to rcu_fwd_cb_nodelay
• rcutorture: Fix rcu_torture_one_read()/rcu_torture_writer() data race
• srcu: Add READ_ONCE() to srcu_struct ->srcu_gp_seq load
• srcu: Fix process_srcu()/srcu_batches_completed() datarace
• srcu: Fix __call_srcu()/srcu_get_delay() datarace
• srcu: Fix __call_srcu()/process_srcu() datarace
• rcu-tasks: *_ONCE() for rcu_tasks_cbs_head
• rcu: Add WRITE_ONCE() to rcu_state ->gp_start
• rcu: Add *_ONCE() to rcu_node ->boost_kthread_status
• rcu: Add *_ONCE() to rcu_data ->rcu_forced_tick
• rcu: Add READ_ONCE() to rcu_data ->gpwrap
• rcu: *_ONCE() for grace-period progress indicators
• rcu: Add READ_ONCE() to rcu_segcblist ->tails
• rcu: Add WRITE_ONCE() to rcu_node ->qsmaskinitnext
• locking/rtmutex: rcu: Add WRITE_ONCE() to rt_mutex ->owner
• rcu: Add WRITE_ONCE() to rcu_state ->gp_req_activity
• rcu: Add READ_ONCE() to rcu_node ->gp_seq
• rcu: Add WRITE_ONCE to rcu_node ->exp_seq_rq store
• rcu: Add WRITE_ONCE() to rcu_node ->qsmask update
• rcu: Fix exp_funnel_lock()/rcu_exp_wait_wake() datarace
• skbuff: fix a data race in skb_queue_len()
• debugobjects: Fix various data races
• tick/sched: Annotate lockless access to last_jiffies_update
• rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
• rcu: Avoid data-race in rcu_gp_fqs_check_wake()
• tomoyo: Use atomic_t for statistics counter
• locking/spinlock/debug: Fix various data races
• vfs: mark pipes and sockets as stream-like file descriptors
• sctp: cache netns in sctp_ep_common
• tun: fix data-race in gro_normal_list()
• tcp: fix data-race in tcp_recvmsg()
• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state

• ipv6: fixes rt6_probe() and fib6_nh->last_probe init

  lkml

• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end

• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node()

  report

• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)

• rcu: Fix data-race due to atomic_t copy-by-value

  lkml

• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour

• taskstats: fix data-race

  report