KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy

KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert (3)

Status: internal: reported on 2023/09/08 17:34
Subsystems: net
[Documentation on labels]
Fix commit: 3e4bc23926b8 xfrm: fix a data-race in xfrm_gen_index()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 110d, last: 110d

▶ ▼ Similar bugs (2)

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert net				1	811d	811d	0/25	auto-closed as invalid on 2021/10/16 00:54
upstream	KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert (2) net				1	637d	637d	0/25	auto-closed as invalid on 2022/04/07 07:53

Sample crash report:

==================================================================
BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert

write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0:
 xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline]
 xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347
 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
 __do_sys_setsockopt net/socket.c:2274 [inline]
 __se_sys_setsockopt net/socket.c:2271 [inline]
 __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1:
 xfrm_sk_policy_insert+0x13e/0x640
 xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
 do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
 ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
 rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
 sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
 __sys_setsockopt+0x1c9/0x230 net/socket.c:2263
 __do_sys_setsockopt net/socket.c:2274 [inline]
 __se_sys_setsockopt net/socket.c:2271 [inline]
 __x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00006ad8 -> 0x00006b18

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
==================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2023/08/12 05:24	upstream	9106536c1aa3	39990d51	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci2-upstream-kcsan-gce	KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert

* ~~Struck through~~ repros no longer work on HEAD.