syzbot


KCSAN: data-race in llcp_raw_sock_bind / llcp_sock_getname

Status: auto-obsoleted due to no activity on 2024/03/29 04:02
Subsystems: net nfc
[Documentation on labels]
Reported-by: syzbot+7eae05af95180a023d2b@syzkaller.appspotmail.com
First crash: 60d, last: 60d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in llcp_raw_sock_bind / llcp_sock_getname

write to 0xffff888167154700 of 8 bytes by task 10196 on cpu 1:
 llcp_raw_sock_bind+0x131/0x200 net/nfc/llcp_sock.c:188
 __sys_bind+0x157/0x1c0 net/socket.c:1847
 __do_sys_bind net/socket.c:1858 [inline]
 __se_sys_bind net/socket.c:1856 [inline]
 __x64_sys_bind+0x41/0x50 net/socket.c:1856
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffff888167154700 of 8 bytes by task 10197 on cpu 0:
 llcp_sock_getname+0x3a/0x1b0 net/nfc/llcp_sock.c:510
 sk_getsockopt+0xc78/0x1680 net/core/sock.c:1826
 do_sock_getsockopt+0x9e/0x190 net/socket.c:2365
 __sys_getsockopt+0x199/0x200 net/socket.c:2402
 __do_sys_getsockopt net/socket.c:2412 [inline]
 __se_sys_getsockopt net/socket.c:2409 [inline]
 __x64_sys_getsockopt+0x66/0x80 net/socket.c:2409
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x0000000000000000 -> 0xffff888101f4d800

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10197 Comm: syz-executor.2 Not tainted 6.8.0-rc5-syzkaller-00121-g1c892cdd8fe0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/02/23 04:01 upstream 1c892cdd8fe0 8d446f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in llcp_raw_sock_bind / llcp_sock_getname
* Struck through repros no longer work on HEAD.