syzbot


DATA RACE in buffer.(*Buffer).PullUp

Status: fixed on 2024/12/13 12:59
Reported-by: syzbot+63c78a2c88a5744c636b@syzkaller.appspotmail.com
Fix commit: afa323bd3070 Replace most instances of IncRef with Clone.
First crash: 92d, last: 92d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c000eff0d0 by goroutine 439:
  gvisor.dev/gvisor/pkg/buffer.(*Buffer).PullUp()
      pkg/buffer/buffer.go:323 +0x40f
  gvisor.dev/gvisor/pkg/tcpip/stack.(*PacketBuffer).headerView()
      pkg/tcpip/stack/packet_buffer.go:364 +0x184
  gvisor.dev/gvisor/pkg/tcpip/stack.PacketHeader.Slice()
      pkg/tcpip/stack/packet_buffer.go:504 +0x58
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).processExtensionHeaders()
      pkg/tcpip/network/ipv6/ipv6.go:1508 +0x448
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).deliverPacketLocally()
      pkg/tcpip/network/ipv6/ipv6.go:1397 +0x198
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).handleValidatedPacket()
      pkg/tcpip/network/ipv6/ipv6.go:1376 +0x4b7
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).HandlePacket()
      pkg/tcpip/network/ipv6/ipv6.go:1146 +0xcd4
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverNetworkPacket()
      pkg/tcpip/stack/nic.go:769 +0x1ea
  gvisor.dev/gvisor/pkg/tcpip/link/nested.(*Endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/nested/nested.go:61 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/packetsocket.(*endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/packetsocket/packetsocket.go:47 +0x5e
  gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound()
      pkg/tcpip/link/channel/channel.go:207 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write()
      pkg/tcpip/link/tun/device.go:250 +0x805
  gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write()
      pkg/sentry/devices/tundev/tundev.go:163 +0x591
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:679 +0x144
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xa4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x38e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2294
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:400 +0x44

Previous read at 0x00c000eff0d0 by goroutine 441:
  gvisor.dev/gvisor/pkg/buffer.(*View).Clone()
      pkg/buffer/view.go:96 +0xb7
  gvisor.dev/gvisor/pkg/buffer.(*Buffer).Clone()
      pkg/buffer/buffer.go:417 +0x86
  gvisor.dev/gvisor/pkg/tcpip/stack.(*PacketBuffer).Clone()
      pkg/tcpip/stack/packet_buffer.go:376 +0xfc
  gvisor.dev/gvisor/pkg/tcpip/network/internal/fragmentation.(*reassembler).process()
      pkg/tcpip/network/internal/fragmentation/reassembler.go:172 +0xfae
  gvisor.dev/gvisor/pkg/tcpip/network/internal/fragmentation.(*Fragmentation).Process()
      pkg/tcpip/network/internal/fragmentation/fragmentation.go:201 +0xb08
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).processFragmentExtHdr()
      pkg/tcpip/network/ipv6/ipv6.go:1870 +0xb47
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).processExtensionHeader()
      pkg/tcpip/network/ipv6/ipv6.go:1455 +0x848
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).processExtensionHeaders()
      pkg/tcpip/network/ipv6/ipv6.go:1509 +0x484
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).deliverPacketLocally()
      pkg/tcpip/network/ipv6/ipv6.go:1397 +0x198
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).handleValidatedPacket()
      pkg/tcpip/network/ipv6/ipv6.go:1376 +0x4b7
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).HandlePacket()
      pkg/tcpip/network/ipv6/ipv6.go:1146 +0xcd4
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverNetworkPacket()
      pkg/tcpip/stack/nic.go:769 +0x1ea
  gvisor.dev/gvisor/pkg/tcpip/link/nested.(*Endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/nested/nested.go:61 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/packetsocket.(*endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/packetsocket/packetsocket.go:47 +0x5e
  gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound()
      pkg/tcpip/link/channel/channel.go:207 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write()
      pkg/tcpip/link/tun/device.go:250 +0x805
  gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write()
      pkg/sentry/devices/tundev/tundev.go:163 +0x591
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:679 +0x144
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xa4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x38e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2294
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:400 +0x44

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/21 04:08 gvisor 151f3fb3bf57 4b25d554 .config console log report syz / log C ci-gvisor-systrap-1-race-cover DATA RACE in buffer.(*Buffer).PullUp
2024/11/21 11:01 gvisor 151f3fb3bf57 4b25d554 .config console log report syz / log ci-gvisor-ptrace-1-race-cover DATA RACE in buffer.(*Buffer).PullUp
* Struck through repros no longer work on HEAD.