syzbot


KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (7)

Status: moderation: reported on 2026/01/06 17:48
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+dd9847d70c4018fed74e@syzkaller.appspotmail.com
First crash: 215d, last: 7d01h
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (4) net 6 2 557d 590d 0/29 auto-obsoleted due to no activity on 2024/08/08 02:32
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (5) net 6 4 491d 522d 0/29 auto-obsoleted due to no activity on 2024/10/12 18:17
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (2) net 6 2 1820d 1852d 0/29 auto-closed as invalid on 2021/02/22 11:54
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (6) net 6 8 288d 416d 0/29 auto-obsoleted due to no activity on 2025/05/25 10:40
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release (3) net 6 1 1272d 1270d 0/29 auto-closed as invalid on 2022/08/23 20:42
upstream KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release net 6 22 2168d 2272d 0/29 auto-closed as invalid on 2020/04/15 13:52

Sample crash report:
==================================================================
BUG: KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release

write to 0xffff88811bce50e0 of 8 bytes by task 10132 on cpu 1:
 sk_set_socket include/net/sock.h:2092 [inline]
 sock_orphan include/net/sock.h:2118 [inline]
 sk_common_release+0xae/0x230 net/core/sock.c:4003
 udp_lib_close+0x15/0x20 include/net/udp.h:325
 inet_release+0xce/0xf0 net/ipv4/af_inet.c:437
 __sock_release net/socket.c:662 [inline]
 sock_close+0x6b/0x150 net/socket.c:1455
 __fput+0x29b/0x650 fs/file_table.c:468
 ____fput+0x1c/0x30 fs/file_table.c:496
 task_work_run+0x131/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x1dd/0x2b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811bce50e0 of 8 bytes by task 6117 on cpu 0:
 l2tp_tunnel_del_work+0x2f/0x1a0 net/l2tp/l2tp_core.c:1418
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0xffff88811b477a80 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 6117 Comm: kworker/u8:55 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: l2tp l2tp_tunnel_del_work
==================================================================

Crashes (17):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/05 13:32 upstream 3609fa95fb0f d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2026/01/03 23:51 upstream aacb0a6d604a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/12/28 15:40 upstream d26143bb38e2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/12/15 02:36 upstream 8f0b4cce4481 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/12/07 07:51 upstream cc3ee4ba57b7 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/19 15:10 upstream 1c64efcb083c 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/16 02:55 upstream 1f4a222b0e33 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/11 20:30 upstream 0739473694c4 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/09 03:38 upstream cd5a0afbdf80 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/02 20:42 upstream 7f7072574127 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/10/01 03:13 upstream 30d4efb2f5a5 65a0eece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/09/24 12:31 upstream cec1e6e5d1ab 0abd0691 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/09/18 16:43 upstream 8b789f2b7602 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/08/04 08:35 upstream 352af6a011d5 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/07/27 16:33 upstream ec2df4364666 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/07/09 08:47 upstream 733923397fd9 f4e5e155 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
2025/06/11 00:17 upstream aef17cb3d3c4 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in l2tp_tunnel_del_work / sk_common_release
* Struck through repros no longer work on HEAD.