syzbot


KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (4)

Status: moderation: reported on 2026/01/07 12:43
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+15a2e70951eeccc9719e@syzkaller.appspotmail.com
First crash: 42d, last: 42d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock batman 6 1 2180d 2180d 0/29 auto-closed as invalid on 2020/04/06 19:35
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (3) batman 6 1 477d 477d 0/29 auto-obsoleted due to no activity on 2024/10/30 10:58
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (2) batman 6 1 593d 593d 0/29 auto-obsoleted due to no activity on 2024/07/06 18:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock

read to 0xffff88811a96ec18 of 2 bytes by task 3561 on cpu 0:
 batadv_tt_local_set_flags net/batman-adv/translation-table.c:3570 [inline]
 batadv_tt_local_commit_changes_nolock+0xe2/0x570 net/batman-adv/translation-table.c:3643
 batadv_tt_local_commit_changes+0x26/0x40 net/batman-adv/translation-table.c:3667
 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:819 [inline]
 batadv_iv_ogm_schedule+0x249/0x810 net/batman-adv/bat_iv_ogm.c:873
 batadv_iv_send_outstanding_bat_ogm_packet+0x419/0x470 net/batman-adv/bat_iv_ogm.c:1709
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

read-write to 0xffff88811a96ec18 of 2 bytes by task 3559 on cpu 1:
 batadv_tt_local_add+0xd6b/0x1050 net/batman-adv/translation-table.c:-1
 batadv_interface_tx+0x42b/0xae0 net/batman-adv/mesh-interface.c:236
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3869
 __dev_queue_xmit+0xda9/0x1ec0 net/core/dev.c:4817
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 __bpf_tx_skb net/core/filter.c:2153 [inline]
 __bpf_redirect_common net/core/filter.c:2197 [inline]
 __bpf_redirect+0x862/0x990 net/core/filter.c:2204
 ____bpf_clone_redirect net/core/filter.c:2487 [inline]
 bpf_clone_redirect+0x20c/0x290 net/core/filter.c:2450
 bpf_prog_ba7156dd260b21a3+0x62/0x6b
 bpf_dispatcher_nop_func include/linux/bpf.h:1376 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x284/0x610 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x9cf/0xf50 net/bpf/test_run.c:1158
 bpf_prog_test_run+0x22a/0x390 kernel/bpf/syscall.c:4703
 __sys_bpf+0x4c0/0x7c0 kernel/bpf/syscall.c:6182
 __do_sys_bpf kernel/bpf/syscall.c:6274 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6272 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6272
 x64_sys_call+0x28e1/0x3000 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0200 -> 0x0000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3559 Comm: syz.4.17 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================
syz.4.17 (3559) used greatest stack depth: 10360 bytes left

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/05 00:54 upstream 559e608c4655 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock
* Struck through repros no longer work on HEAD.