syzbot


KCSAN: data-race in enqueue_timer / sctp_addr_wq_mgmt

Status: auto-closed as invalid on 2020/03/08 20:04
Subsystems: sctp
[Documentation on labels]
First crash: 2082d, last: 2067d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in enqueue_timer / sctp_addr_wq_mgmt

read to 0xffff8880ac942a18 of 8 bytes by task 2640 on cpu 0:
 sctp_addr_wq_mgmt+0x2ae/0x410 net/sctp/protocol.c:740
 sctp_inet6addr_event+0x1bd/0x440 net/sctp/ipv6.c:104
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:83
 __atomic_notifier_call_chain kernel/notifier.c:173 [inline]
 atomic_notifier_call_chain+0x3c/0x60 kernel/notifier.c:183
 inet6addr_notifier_call_chain+0x2e/0x40 net/ipv6/addrconf_core.c:109
 addrconf_ifdown+0x6b7/0xce0 net/ipv6/addrconf.c:3823
 addrconf_notify+0x35e/0x1550 net/ipv6/addrconf.c:3633
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:83
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:368
 call_netdevice_notifiers_info net/core/dev.c:1893 [inline]
 call_netdevice_notifiers_info+0x9a/0x120 net/core/dev.c:1878
 call_netdevice_notifiers_extack net/core/dev.c:1905 [inline]
 call_netdevice_notifiers net/core/dev.c:1919 [inline]
 dev_close_many+0x24f/0x380 net/core/dev.c:1544
 rollback_registered_many+0x2f5/0xa40 net/core/dev.c:8721
 unregister_netdevice_many net/core/dev.c:9907 [inline]
 unregister_netdevice_many+0x62/0x240 net/core/dev.c:9902
 default_device_exit_batch+0x234/0x270 net/core/dev.c:10380
 ops_exit_list.isra.0+0xa2/0xc0 net/core/net_namespace.c:175
 cleanup_net+0x405/0x6b0 net/core/net_namespace.c:597
 process_one_work+0x3d4/0x890 kernel/workqueue.c:2264
 worker_thread+0xa0/0x800 kernel/workqueue.c:2410
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

write to 0xffff8880ac942a18 of 8 bytes by interrupt on cpu 1:
 hlist_add_head include/linux/list.h:787 [inline]
 enqueue_timer+0x6c/0x210 kernel/time/timer.c:540
 __internal_add_timer+0x4f/0x60 kernel/time/timer.c:553
 internal_add_timer kernel/time/timer.c:595 [inline]
 __mod_timer kernel/time/timer.c:1053 [inline]
 mod_timer kernel/time/timer.c:1100 [inline]
 add_timer+0x250/0x550 kernel/time/timer.c:1136
 dsp_cmx_send+0x8cd/0xcf0 drivers/isdn/mISDN/dsp_cmx.c:1850
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 start_secondary+0x168/0x1b0 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/12/29 19:59 https://github.com/google/ktsan.git kcsan 245a43005292 af6b8ef8 .config console log report ci2-upstream-kcsan-gce
2019/12/22 03:28 https://github.com/google/ktsan.git kcsan 245a43005292 bc586918 .config console log report ci2-upstream-kcsan-gce
2019/12/14 08:47 https://github.com/google/ktsan.git kcsan 245a43005292 eef6e580 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.