syzbot


KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (2)

Status: closed as invalid on 2020/06/18 14:13
Subsystems: bridge
[Documentation on labels]
First crash: 1466d, last: 1466d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (4) bridge 3 1299d 1280d 0/28 auto-closed as invalid on 2020/12/27 17:42
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (3) bridge 11 1349d 1435d 0/28 auto-closed as invalid on 2020/11/07 07:33
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (7) bridge 92 322d 760d 0/28 auto-obsoleted due to no activity on 2023/09/01 04:22
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (5) bridge 2 1207d 1239d 0/28 auto-closed as invalid on 2021/03/30 00:44
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (8) bridge 1 270d 269d 25/28 fixed on 2023/12/21 01:43
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish bridge 3 1592d 1671d 0/28 auto-closed as invalid on 2020/04/14 05:00
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (6) bridge 7 824d 946d 0/28 auto-closed as invalid on 2022/04/16 22:53

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish

write to 0xffff8880a85a5148 of 8 bytes by interrupt on cpu 0:
 br_handle_frame_finish+0x7d0/0xaa0 net/bridge/br_input.c:145
 br_nf_hook_thresh+0x1f7/0x210 net/bridge/br_netfilter_hooks.c:1022
 br_nf_pre_routing_finish_ipv6+0x3a6/0x4f0 net/bridge/br_netfilter_ipv6.c:206
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing_ipv6+0x23a/0x340 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0xa54/0xcd2 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:227 [inline]
 br_handle_frame+0x425/0x880 net/bridge/br_input.c:352
 __netif_receive_skb_core+0xd8a/0x2120 net/core/dev.c:5088
 __netif_receive_skb_one_core+0x61/0xe0 net/core/dev.c:5185
 __netif_receive_skb+0x33/0xf0 net/core/dev.c:5301
 process_backlog+0x213/0x4c0 net/core/dev.c:6133
 napi_poll net/core/dev.c:6571 [inline]
 net_rx_action+0x3ad/0xac0 net/core/dev.c:6639
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 run_ksoftirqd+0x41/0x60 kernel/softirq.c:604
 smpboot_thread_fn+0x374/0x4a0 kernel/smpboot.c:165
 kthread+0x203/0x230 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffff8880a85a5148 of 8 bytes by interrupt on cpu 1:
 br_handle_frame_finish+0x7bd/0xaa0 net/bridge/br_input.c:145
 br_nf_hook_thresh+0x1f7/0x210 net/bridge/br_netfilter_hooks.c:1022
 br_nf_pre_routing_finish_ipv6+0x3a6/0x4f0 net/bridge/br_netfilter_ipv6.c:206
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing_ipv6+0x23a/0x340 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0xa54/0xcd2 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:227 [inline]
 br_handle_frame+0x425/0x880 net/bridge/br_input.c:352
 __netif_receive_skb_core+0xd8a/0x2120 net/core/dev.c:5088
 __netif_receive_skb_one_core+0x61/0xe0 net/core/dev.c:5185
 __netif_receive_skb+0x33/0xf0 net/core/dev.c:5301
 process_backlog+0x213/0x4c0 net/core/dev.c:6133
 napi_poll net/core/dev.c:6571 [inline]
 net_rx_action+0x3ad/0xac0 net/core/dev.c:6639
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 run_ksoftirqd+0x41/0x60 kernel/softirq.c:604
 smpboot_thread_fn+0x374/0x4a0 kernel/smpboot.c:165
 kthread+0x203/0x230 kernel/kthread.c:268
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/08 08:31 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 7751efd0 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.