syzbot


DATA RACE in buffer.(*buffer).Remove

Status: fixed on 2021/08/16 21:45
Fix commit: 6d0b40b1d159 [op] Make PacketBuffer Clone() do a deeper copy.
First crash: 1208d, last: 1208d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c0004f6187 by goroutine 412:
  runtime.slicecopy()
      GOROOT/src/runtime/slice.go:247 +0x0
  gvisor.dev/gvisor/pkg/buffer.(*buffer).Remove()
      pkg/buffer/buffer.go:64 +0x29d
  gvisor.dev/gvisor/pkg/buffer.(*View).Remove()
      pkg/buffer/view.go:63 +0x1b0
  gvisor.dev/gvisor/pkg/tcpip/stack.PacketData.DeleteFront()
      pkg/tcpip/stack/packet_buffer.go:398 +0x82f
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).handleICMP()
      pkg/tcpip/network/ipv6/icmp.go:337 +0x83b
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).processExtensionHeaders()
      pkg/tcpip/network/ipv6/ipv6.go:1553 +0x793
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).handleValidatedPacket()
      pkg/tcpip/network/ipv6/ipv6.go:1190 +0x41a
  gvisor.dev/gvisor/pkg/tcpip/network/ipv6.(*endpoint).HandlePacket()
      pkg/tcpip/network/ipv6/ipv6.go:1107 +0x1e9
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverNetworkPacket()
      pkg/tcpip/stack/nic.go:749 +0x413
  gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectLinkAddr()
      pkg/tcpip/link/channel/channel.go:193 +0x499
  gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write()
      pkg/tcpip/link/tun/device.go:236 +0x2b2
  gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write()
      pkg/sentry/devices/tundev/tundev.go:146 +0x236
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:657 +0x130
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.write()
      pkg/sentry/syscalls/linux/vfs2/read_write.go:346 +0xed
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Write()
      pkg/sentry/syscalls/linux/vfs2/read_write.go:315 +0x307
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:104 +0x452
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:239 +0xb3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:199 +0x10e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:174 +0x213
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:282 +0x12c6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x392

Previous read at 0x00c0004f6187 by goroutine 410:
  runtime.slicecopy()
      GOROOT/src/runtime/slice.go:247 +0x0
  gvisor.dev/gvisor/pkg/safemem.Copy()
      pkg/safemem/block_unsafe.go:199 +0x4e6
  gvisor.dev/gvisor/pkg/safemem.CopySeq()
      pkg/safemem/seq_unsafe.go:282 +0x296
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).CopyOut.func1()
      pkg/sentry/mm/io.go:121 +0xaf
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).withInternalMappings()
      pkg/sentry/mm/io.go:507 +0xb63
  gvisor.dev/gvisor/pkg/sentry/mm.(*MemoryManager).CopyOut()
      pkg/sentry/mm/io.go:120 +0x256
  gvisor.dev/gvisor/pkg/usermem.CopyOutVec()
      pkg/usermem/usermem.go:263 +0x1f2
  gvisor.dev/gvisor/pkg/usermem.IOSequence.CopyOut()
      pkg/usermem/usermem.go:481 +0x15b
  gvisor.dev/gvisor/pkg/usermem.(*IOSequenceReadWriter).Write()
      pkg/usermem/usermem.go:559 +0x45
  gvisor.dev/gvisor/pkg/tcpip/buffer.(*VectorisedView).ReadTo()
      pkg/tcpip/buffer/view.go:156 +0xe8
  gvisor.dev/gvisor/pkg/tcpip/transport/raw.(*endpoint).Read()
      pkg/tcpip/transport/raw/endpoint.go:229 +0x344
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*socketOpsCommon).nonBlockingRead()
      pkg/sentry/socket/netstack/netstack.go:2645 +0x30b
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*SocketVFS2).Read()
      pkg/sentry/socket/netstack/netstack_vfs2.go:114 +0x156
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Read()
      pkg/sentry/vfs/file_description.go:626 +0x16d
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.read()
      pkg/sentry/syscalls/linux/vfs2/read_write.go:116 +0x5b2
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux/vfs2.Read()
      pkg/sentry/syscalls/linux/vfs2/read_write.go:64 +0x307
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:104 +0x452
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:239 +0xb3
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:199 +0x10e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:174 +0x213
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:282 +0x12c6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x392

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/08/06 07:23 gvisor 569f605f438d 2f537099 .config console log report syz C ci-gvisor-ptrace-2-race DATA RACE in buffer.(*buffer).Remove
2021/08/06 07:17 gvisor 569f605f438d 2f537099 .config console log report info ci-gvisor-ptrace-1-race DATA RACE in buffer.(*buffer).Remove
* Struck through repros no longer work on HEAD.