syzbot


DATA RACE in udp.(*endpoint).Connect.func1

Status: fixed on 2023/08/04 01:01
Reported-by: syzbot+71d37762edde2e805a42@syzkaller.appspotmail.com
Fix commit: 5babda534107 Lock around endpoint info access in UDP onICMPError.
First crash: 495d, last: 495d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c00100c32a by goroutine 1001:
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).Connect.func1()
      pkg/tcpip/transport/udp/endpoint.go:694 +0x4f0
  gvisor.dev/gvisor/pkg/tcpip/transport/internal/network.(*Endpoint).ConnectAndThen()
      pkg/tcpip/transport/internal/network/endpoint.go:650 +0x596
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).Connect()
      pkg/tcpip/transport/udp/endpoint.go:665 +0x185
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).Connect()
      pkg/sentry/socket/netstack/netstack.go:707 +0x5e5
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Connect()
      pkg/sentry/syscalls/linux/sys_socket.go:279 +0x1f5
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:142 +0x9c1
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:322 +0x7c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:282 +0x8e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:257 +0x4c4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x1d4a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
      pkg/sentry/kernel/task_start.go:389 +0x47

Previous read at 0x00c00100c32a by goroutine 997:
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).onICMPError()
      pkg/tcpip/transport/udp/endpoint.go:1040 +0x78a
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).HandleError()
      pkg/tcpip/transport/udp/endpoint.go:1056 +0x8f
  gvisor.dev/gvisor/pkg/tcpip/stack.(*endpointsByNIC).handleError()
      pkg/tcpip/stack/transport_demuxer.go:209 +0x22c
  gvisor.dev/gvisor/pkg/tcpip/stack.(*transportDemuxer).deliverError()
      pkg/tcpip/stack/transport_demuxer.go:649 +0x1a9
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverTransportError()
      pkg/tcpip/stack/nic.go:882 +0x264
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleControl()
      pkg/tcpip/network/ipv4/icmp.go:280 +0x494
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleICMP()
      pkg/tcpip/network/ipv4/icmp.go:482 +0x63e
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).deliverPacketLocally()
      pkg/tcpip/network/ipv4/ipv4.go:1290 +0xe16
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleValidatedPacket()
      pkg/tcpip/network/ipv4/ipv4.go:1154 +0xde4
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleLocalPacket()
      pkg/tcpip/network/ipv4/ipv4.go:882 +0x31a
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacketPostRouting()
      pkg/tcpip/network/ipv4/ipv4.go:546 +0xa4
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacket()
      pkg/tcpip/network/ipv4/ipv4.go:538 +0x2d3
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).WritePacket()
      pkg/tcpip/network/ipv4/ipv4.go:506 +0x1a4
  gvisor.dev/gvisor/pkg/tcpip/stack.(*Route).WritePacket()
      pkg/tcpip/stack/route.go:495 +0xf8
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*protocol).returnError()
      pkg/tcpip/network/ipv4/icmp.go:794 +0xf70
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).deliverPacketLocally()
      pkg/tcpip/network/ipv4/ipv4.go:1331 +0x10e8
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleValidatedPacket()
      pkg/tcpip/network/ipv4/ipv4.go:1154 +0xde4
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).handleLocalPacket()
      pkg/tcpip/network/ipv4/ipv4.go:882 +0x31a
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacketPostRouting()
      pkg/tcpip/network/ipv4/ipv4.go:546 +0xa4
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacket()
      pkg/tcpip/network/ipv4/ipv4.go:538 +0x2d3
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).WritePacket()
      pkg/tcpip/network/ipv4/ipv4.go:506 +0x1a4
  gvisor.dev/gvisor/pkg/tcpip/stack.(*Route).WritePacket()
      pkg/tcpip/stack/route.go:495 +0xf8
  gvisor.dev/gvisor/pkg/tcpip/transport/internal/network.(*WriteContext).WritePacket()
      pkg/tcpip/transport/internal/network/endpoint.go:320 +0x1ec
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).write()
      pkg/tcpip/transport/udp/endpoint.go:529 +0x8ea
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).Write()
      pkg/tcpip/transport/udp/endpoint.go:366 +0x86
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).Write()
      pkg/sentry/socket/netstack/netstack.go:482 +0x202
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:679 +0x124
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0x9c
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x274
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:142 +0x9c1
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:322 +0x7c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:282 +0x8e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:257 +0x4c4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x1d4a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:98 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.func1()
      pkg/sentry/kernel/task_start.go:389 +0x47

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/07/19 22:06 gvisor ea7cd7184192 4547cdf9 .config console log report syz C ci-gvisor-ptrace-2-race DATA RACE in udp.(*endpoint).Connect.func1
2023/07/19 21:54 gvisor ea7cd7184192 4547cdf9 .config console log report syz C ci-gvisor-systrap-1-race DATA RACE in udp.(*endpoint).Connect.func1
2023/07/19 19:43 gvisor ea7cd7184192 4547cdf9 .config console log report syz ci-gvisor-ptrace-1-race-cover DATA RACE in udp.(*endpoint).Connect.func1
* Struck through repros no longer work on HEAD.