syzbot


KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (5)

Status: moderation: reported on 2026/02/16 17:03
Subsystems: batman
[Documentation on labels]
Reported-by: syzbot+50a602f0e0b3e0394501@syzkaller.appspotmail.com
First crash: 56d, last: 16d
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
7853a9b1-4074-455d-911b-22988a9eca82 repro KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (5) 2026/03/06 20:01 2026/03/06 20:01 2026/03/06 20:10 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
af54e338-4735-44a3-81fd-5f2f3b376208 assessment-kcsan Benign: ❌  Confident: ✅  KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (5) 2026/02/15 01:46 2026/02/23 14:06 2026/02/23 14:19 305c0ec5cd886e2d13738e28e1b2df9b0ec20fc9
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock batman 6 1 2266d 2266d 0/29 auto-closed as invalid on 2020/04/06 19:35
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (3) batman 6 1 564d 564d 0/29 auto-obsoleted due to no activity on 2024/10/30 10:58
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (2) batman 6 1 679d 679d 0/29 auto-obsoleted due to no activity on 2024/07/06 18:55
upstream KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock (4) batman race:harmful 6 1 128d 95d 0/29 auto-obsoleted due to no activity on 2026/01/30 00:55

Sample crash report:
==================================================================
BUG: KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock

read to 0xffff888103c42b18 of 2 bytes by task 6666 on cpu 0:
 batadv_tt_local_set_flags net/batman-adv/translation-table.c:3570 [inline]
 batadv_tt_local_commit_changes_nolock+0xe2/0x570 net/batman-adv/translation-table.c:3643
 batadv_tt_local_commit_changes+0x26/0x40 net/batman-adv/translation-table.c:3667
 batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:822 [inline]
 batadv_iv_ogm_schedule+0x249/0x810 net/batman-adv/bat_iv_ogm.c:876
 batadv_iv_send_outstanding_bat_ogm_packet+0x419/0x470 net/batman-adv/bat_iv_ogm.c:1712
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0x513/0xa10 kernel/workqueue.c:3359
 worker_thread+0x58a/0x780 kernel/workqueue.c:3440
 kthread+0x22a/0x280 kernel/kthread.c:436
 ret_from_fork+0x150/0x360 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

write to 0xffff888103c42b18 of 2 bytes by task 14051 on cpu 1:
 batadv_tt_local_add+0xe43/0x1720 net/batman-adv/translation-table.c:-1
 batadv_interface_tx+0x42b/0xae0 net/batman-adv/mesh-interface.c:236
 __netdev_start_xmit include/linux/netdevice.h:5325 [inline]
 netdev_start_xmit include/linux/netdevice.h:5334 [inline]
 xmit_one net/core/dev.c:3871 [inline]
 dev_hard_start_xmit+0x136/0x3f0 net/core/dev.c:3887
 __dev_queue_xmit+0xd9a/0x1f20 net/core/dev.c:4837
 dev_queue_xmit include/linux/netdevice.h:3385 [inline]
 __bpf_tx_skb net/core/filter.c:2152 [inline]
 __bpf_redirect_common net/core/filter.c:2196 [inline]
 __bpf_redirect+0x862/0x990 net/core/filter.c:2203
 ____bpf_clone_redirect net/core/filter.c:2493 [inline]
 bpf_clone_redirect+0x20c/0x290 net/core/filter.c:2456
 bpf_prog_ba7156dd260b21a3+0x62/0x6b
 bpf_dispatcher_nop_func include/linux/bpf.h:1402 [inline]
 __bpf_prog_run include/linux/filter.h:723 [inline]
 bpf_prog_run include/linux/filter.h:730 [inline]
 bpf_test_run+0x29d/0x620 net/bpf/test_run.c:423
 bpf_prog_test_run_skb+0x9a4/0xef0 net/bpf/test_run.c:1159
 bpf_prog_test_run+0x204/0x340 kernel/bpf/syscall.c:4722
 __sys_bpf+0x52e/0x7e0 kernel/bpf/syscall.c:6246
 __do_sys_bpf kernel/bpf/syscall.c:6341 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6339 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6339
 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0200 -> 0x0000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 14051 Comm: syz.5.3069 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/26 18:25 upstream 0138af2472df 766b6434 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock
2026/02/15 01:45 upstream 3e48a11675c5 1e62d198 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in batadv_tt_local_add / batadv_tt_local_commit_changes_nolock
* Struck through repros no longer work on HEAD.