syzbot


KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (6)

Status: fixed on 2024/01/30 15:47
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+8d482d0e407f665d9d10@syzkaller.appspotmail.com
Fix commit: 482521d8e0c6 udp: annotate data-races around up->pending
First crash: 317d, last: 317d
Discussions (2)
Title Replies (including bot) Last reply
[PATCH net] udp: annotate data-races around up->pending 3 (3) 2024/01/13 15:50
[syzbot] [net?] KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (6) 1 (2) 2024/01/12 10:20
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg net 1 1586d 1586d 0/28 auto-closed as invalid on 2020/08/23 02:37
upstream KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (3) net 1 1300d 1300d 0/28 auto-closed as invalid on 2021/06/05 06:06
upstream KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (4) net 1 1244d 1238d 0/28 auto-closed as invalid on 2021/09/03 03:58
upstream KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (5) net 1 549d 549d 0/28 auto-obsoleted due to no activity on 2023/06/26 01:26
upstream KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg (2) net 1 1538d 1538d 0/28 auto-closed as invalid on 2020/10/10 02:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg

write to 0xffff88814e5eadf0 of 4 bytes by task 15547 on cpu 1:
 udpv6_sendmsg+0x1405/0x1530 net/ipv6/udp.c:1596
 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x257/0x310 net/socket.c:2192
 __do_sys_sendto net/socket.c:2204 [inline]
 __se_sys_sendto net/socket.c:2200 [inline]
 __x64_sys_sendto+0x78/0x90 net/socket.c:2200
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffff88814e5eadf0 of 4 bytes by task 15551 on cpu 0:
 udpv6_sendmsg+0x22c/0x1530 net/ipv6/udp.c:1373
 inet6_sendmsg+0x63/0x80 net/ipv6/af_inet6.c:657
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x37c/0x4d0 net/socket.c:2586
 ___sys_sendmsg net/socket.c:2640 [inline]
 __sys_sendmmsg+0x269/0x500 net/socket.c:2726
 __do_sys_sendmmsg net/socket.c:2755 [inline]
 __se_sys_sendmmsg net/socket.c:2752 [inline]
 __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2752
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x00000000 -> 0x0000000a

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 15551 Comm: syz-executor.1 Tainted: G        W          6.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/01/08 14:27 upstream 0dd3ee311255 d0304e9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in udpv6_sendmsg / udpv6_sendmsg
* Struck through repros no longer work on HEAD.