syzbot


KCSAN: data-race in __packet_rcv_has_room / tpacket_rcv

Status: auto-closed as invalid on 2021/04/15 14:19
Subsystems: net
[Documentation on labels]
First crash: 1142d, last: 1142d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __packet_rcv_has_room / tpacket_rcv

write to 0xffff888029410000 of 8 bytes by interrupt on cpu 0:
 __packet_set_status net/packet/af_packet.c:372 [inline]
 tpacket_rcv+0x202a/0x2410 net/packet/af_packet.c:2419
 deliver_skb net/core/dev.c:2279 [inline]
 __netif_receive_skb_core+0x405/0x1e10 net/core/dev.c:5212
 __netif_receive_skb_one_core net/core/dev.c:5363 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5479
 process_backlog+0x23f/0x3e0 net/core/dev.c:6346
 __napi_poll+0x77/0x510 net/core/dev.c:6892
 napi_poll net/core/dev.c:6959 [inline]
 net_rx_action+0x29f/0x680 net/core/dev.c:7036
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:345
 do_softirq+0x73/0xa0 kernel/softirq.c:248
 __local_bh_enable_ip+0x5a/0x60 kernel/softirq.c:198
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:251 [inline]
 _raw_read_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:279
 wg_socket_send_skb_to_peer+0x112/0x130 drivers/net/wireguard/socket.c:183
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276
 process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
 worker_thread+0x616/0xa70 kernel/workqueue.c:2421
 kthread+0x20b/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

read to 0xffff888029410000 of 8 bytes by task 19 on cpu 1:
 __packet_get_status net/packet/af_packet.c:401 [inline]
 packet_lookup_frame net/packet/af_packet.c:488 [inline]
 __tpacket_has_room net/packet/af_packet.c:1219 [inline]
 __packet_rcv_has_room+0x279/0x450 net/packet/af_packet.c:1260
 tpacket_rcv+0x2b0/0x2410 net/packet/af_packet.c:2231
 deliver_skb net/core/dev.c:2279 [inline]
 dev_queue_xmit_nit+0x392/0x600 net/core/dev.c:2349
 xmit_one+0x71/0x2e0 net/core/dev.c:3588
 dev_hard_start_xmit net/core/dev.c:3609 [inline]
 __dev_queue_xmit+0xf22/0x1580 net/core/dev.c:4182
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4215
 neigh_hh_output include/net/neighbour.h:499 [inline]
 neigh_output include/net/neighbour.h:508 [inline]
 ip6_finish_output2+0x95e/0xb20 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x428/0x480 net/ipv6/ip6_output.c:182
 ip6_finish_output+0x39/0x160 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:215
 dst_output include/net/dst.h:448 [inline]
 ip6_local_out+0x60/0x80 net/ipv6/output_core.c:179
 ip6tunnel_xmit include/net/ip6_tunnel.h:160 [inline]
 udp_tunnel6_xmit_skb+0x2f9/0x490 net/ipv6/ip6_udp_tunnel.c:109
 send6+0x2ed/0x3b0 drivers/net/wireguard/socket.c:152
 wg_socket_send_skb_to_peer+0xbb/0x130 drivers/net/wireguard/socket.c:177
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x142/0x360 drivers/net/wireguard/send.c:276
 process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
 worker_thread+0x616/0xa70 kernel/workqueue.c:2421
 kthread+0x20b/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 5.12.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: wg-crypt-wg0 wg_packet_tx_worker
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/11 14:14 upstream a74e6a014c9d c2ca1f2a .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __packet_rcv_has_room / tpacket_rcv
* Struck through repros no longer work on HEAD.