syzbot


KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash

Status: auto-obsoleted due to no activity on 2025/05/08 13:48
Subsystems: net
[Documentation on labels]
First crash: 186d, last: 165d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash (2) net 6 1 62d 62d 0/29 auto-obsoleted due to no activity on 2025/08/18 23:06

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash

read-write to 0xffff888101705b18 of 4 bytes by task 4950 on cpu 0:
 udp_lib_unhash+0x216/0x4e0 net/ipv4/udp.c:2205
 sk_common_release+0x70/0x220 net/core/sock.c:3871
 udp_lib_close+0x15/0x20 include/net/udp.h:311
 inet_release+0xce/0xf0 net/ipv4/af_inet.c:435
 inet6_release+0x3e/0x60 net/ipv6/af_inet6.c:487
 __sock_release net/socket.c:647 [inline]
 sock_close+0x68/0x150 net/socket.c:1398
 __fput+0x2ac/0x640 fs/file_table.c:464
 ____fput+0x1c/0x30 fs/file_table.c:492
 task_work_run+0x13a/0x1a0 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xa8/0x120 kernel/entry/common.c:218
 do_syscall_64+0xd6/0x1c0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888101705b18 of 4 bytes by task 4967 on cpu 1:
 __udp4_lib_mcast_deliver+0x97/0x730 net/ipv4/udp.c:2504
 __udp4_lib_rcv+0x966/0xfb0 net/ipv4/udp.c:2689
 udp_rcv+0x4f/0x60 net/ipv4/udp.c:2876
 ip_protocol_deliver_rcu+0x3f2/0x750 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x17d/0x210 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_local_deliver+0xec/0x1d0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:469 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:578 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:619 [inline]
 ip_sublist_rcv+0x3c7/0x640 net/ipv4/ip_input.c:635
 ip_list_rcv+0x25e/0x290 net/ipv4/ip_input.c:669
 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline]
 __netif_receive_skb_list_core+0x4f0/0x520 net/core/dev.c:5983
 __netif_receive_skb_list net/core/dev.c:6035 [inline]
 netif_receive_skb_list_internal+0x4e4/0x660 net/core/dev.c:6126
 netif_receive_skb_list+0x31/0x230 net/core/dev.c:6178
 xdp_recv_frames net/bpf/test_run.c:280 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0xe10/0x1040 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0x51d/0x8b0 net/bpf/test_run.c:1316
 bpf_prog_test_run+0x20f/0x3a0 kernel/bpf/syscall.c:4407
 __sys_bpf+0x400/0x7a0 kernel/bpf/syscall.c:5813
 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]
 __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5900
 x64_sys_call+0x2914/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4967 Comm: syz.4.345 Not tainted 6.14.0-rc6-syzkaller-00022-gb7f94fcf5546 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/13 13:43 upstream b7f94fcf5546 44be8b44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash
2025/02/20 05:51 upstream 87a132e73910 50668798 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash
* Struck through repros no longer work on HEAD.