syzbot


KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect (4)

Status: upstream: reported on 2026/03/05 11:59
Subsystems: sctp
[Documentation on labels]
Reported-by: syzbot+5a18a1130eb54693214f@syzkaller.appspotmail.com
First crash: 16d, last: 16d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
24a5004e-3d7e-4181-8abf-3b797755d28c assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect (4) 2026/02/23 14:50 2026/02/23 14:50 2026/02/23 15:02 305c0ec5cd886e2d13738e28e1b2df9b0ec20fc9
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [sctp?] KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect (4) 0 (1) 2026/03/05 11:59
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect (3) sctp 6 1 98d 67d 0/29 closed as invalid on 2026/01/09 17:26
upstream KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect sctp 6 1 1273d 1263d 0/29 auto-obsoleted due to no activity on 2022/10/15 23:56
upstream KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect (2) sctp 6 2 1059d 1156d 0/29 auto-obsoleted due to no activity on 2023/05/17 20:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect

write to 0xffff88815e3ad228 of 4 bytes by task 15371 on cpu 1:
 sctp_cmd_new_state net/sctp/sm_sideeffect.c:878 [inline]
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1342 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
 sctp_do_sm+0xa19/0x3330 net/sctp/sm_sideeffect.c:1175
 sctp_primitive_SHUTDOWN+0x74/0x90 net/sctp/primitive.c:89
 sctp_close+0x272/0x570 net/sctp/socket.c:1529
 inet_release+0xcd/0xf0 net/ipv4/af_inet.c:437
 __sock_release net/socket.c:662 [inline]
 sock_close+0x6b/0x150 net/socket.c:1455
 __fput+0x29b/0x650 fs/file_table.c:469
 ____fput+0x1c/0x30 fs/file_table.c:497
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 get_signal+0xe0e/0xf60 kernel/signal.c:2807
 arch_do_signal_or_restart+0x96/0x450 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x6a/0x6f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x249/0x370 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88815e3ad228 of 4 bytes by task 15375 on cpu 0:
 sctp_wait_for_connect+0x173/0x390 net/sctp/socket.c:9381
 sctp_sendmsg_to_asoc+0xf34/0xf50 net/sctp/socket.c:1884
 sctp_sendmsg+0x13b9/0x1d60 net/sctp/socket.c:2030
 inet_sendmsg+0xc5/0xd0 net/ipv4/af_inet.c:859
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 __sys_sendto+0x3f4/0x4d0 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2209
 x64_sys_call+0x2d35/0x3020 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 15375 Comm: syz.4.3516 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/18 23:13 upstream 23b0f90ba871 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in sctp_do_sm / sctp_wait_for_connect
* Struck through repros no longer work on HEAD.