syzbot


KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (5)

Status: moderation: reported on 2026/02/16 17:03
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+50a602f0e0b3e0394501@syzkaller.appspotmail.com
First crash: 4d20h, last: 4d20h
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock batman 6 1 2215d 2215d 0/29 auto-closed as invalid on 2020/04/06 19:35
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (3) batman 6 1 512d 512d 0/29 auto-obsoleted due to no activity on 2024/10/30 10:58
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (2) batman 6 1 628d 628d 0/29 auto-obsoleted due to no activity on 2024/07/06 18:55
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (4) batman race:harmful 6 1 76d 43d 0/29 auto-obsoleted due to no activity on 2026/01/30 00:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock

read to 0xffff888108109518 of 2 bytes by task 206 on cpu 0:
 batadv_tt_local_set_flags net/batman-adv/translation-table.c:3570 [inline]
 batadv_tt_local_commit_changes_nolock+0xe2/0x570 net/batman-adv/translation-table.c:3643
 batadv_tt_local_commit_changes+0x26/0x40 net/batman-adv/translation-table.c:3667
 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:819 [inline]
 batadv_iv_ogm_schedule+0x249/0x810 net/batman-adv/bat_iv_ogm.c:873
 batadv_iv_send_outstanding_bat_ogm_packet+0x419/0x470 net/batman-adv/bat_iv_ogm.c:1709
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0x4de/0x9e0 kernel/workqueue.c:3358
 worker_thread+0x581/0x770 kernel/workqueue.c:3439
 kthread+0x22a/0x280 kernel/kthread.c:467
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read-write to 0xffff888108109518 of 2 bytes by task 4635 on cpu 1:
 batadv_tt_local_add+0xdcd/0x1720 net/batman-adv/translation-table.c:-1
 batadv_interface_tx+0x42b/0xae0 net/batman-adv/mesh-interface.c:236
 __netdev_start_xmit include/linux/netdevice.h:5275 [inline]
 netdev_start_xmit include/linux/netdevice.h:5284 [inline]
 xmit_one net/core/dev.c:3864 [inline]
 dev_hard_start_xmit+0x136/0x3f0 net/core/dev.c:3880
 __dev_queue_xmit+0xd9c/0x1f40 net/core/dev.c:4829
 dev_queue_xmit include/linux/netdevice.h:3384 [inline]
 __bpf_tx_skb net/core/filter.c:2153 [inline]
 __bpf_redirect_common net/core/filter.c:2197 [inline]
 __bpf_redirect+0x862/0x990 net/core/filter.c:2204
 ____bpf_clone_redirect net/core/filter.c:2487 [inline]
 bpf_clone_redirect+0x20c/0x290 net/core/filter.c:2450
 bpf_prog_ba7156dd260b21a3+0x62/0x6b
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x29d/0x620 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x9a4/0xef0 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x204/0x340 kernel/bpf/syscall.c:4722
 __sys_bpf+0x52e/0x7e0 kernel/bpf/syscall.c:6247
 __do_sys_bpf kernel/bpf/syscall.c:6342 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6340 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6340
 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0200 -> 0x0000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4635 Comm: syz.4.415 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/15 01:45 upstream 3e48a11675c5 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock
* Struck through repros no longer work on HEAD.