KCSAN: data-race in ip6_tnl_xmit / ip6_tnl

similar bugs (5):
Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit	3	1245d	1249d	0/24	closed as invalid on 2019/11/19 13:24
upstream	KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit (5)	3	381d	419d	0/24	auto-closed as invalid on 2022/04/16 19:07
upstream	KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit (4)	1	496d	496d	0/24	auto-closed as invalid on 2021/12/22 23:42
upstream	KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit (2)	1	916d	915d	0/24	auto-closed as invalid on 2020/10/29 08:32
upstream	KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit (3)	1	776d	776d	0/24	auto-closed as invalid on 2021/03/18 08:19

==================================================================
BUG: KCSAN: data-race in ip6_tnl_xmit / ip6_tnl_xmit

read-write to 0xffff888135e491b8 of 8 bytes by task 17431 on cpu 0:
 ip6_tnl_xmit+0x86c/0x1230 net/ipv6/ip6_tunnel.c:1270
 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1387 [inline]
 ip6_tnl_start_xmit+0x93f/0xa90 net/ipv6/ip6_tunnel.c:1436
 __netdev_start_xmit include/linux/netdevice.h:4805 [inline]
 netdev_start_xmit include/linux/netdevice.h:4819 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3588
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3604
 __dev_queue_xmit+0x84c/0xfe0 net/core/dev.c:4253
 dev_queue_xmit include/linux/netdevice.h:2994 [inline]
 neigh_connected_output+0x266/0x2a0 net/core/neighbour.c:1557
 neigh_output include/net/neighbour.h:549 [inline]
 ip6_finish_output2+0xa12/0xc30 net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
 ip6_finish_output+0x395/0x4f0 net/ipv6/ip6_output.c:206
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:227
 dst_output include/net/dst.h:451 [inline]
 ip6_local_out+0x60/0x80 net/ipv6/output_core.c:161
 ip6_send_skb net/ipv6/ip6_output.c:1947 [inline]
 ip6_push_pending_frames+0xb6/0x170 net/ipv6/ip6_output.c:1967
 rawv6_push_pending_frames+0x3a2/0x3f0 net/ipv6/raw.c:613
 rawv6_sendmsg+0xd56/0xe40 net/ipv6/raw.c:956
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 ____sys_sendmsg+0x38f/0x500 net/socket.c:2492
 ___sys_sendmsg net/socket.c:2546 [inline]
 __sys_sendmmsg+0x27c/0x4a0 net/socket.c:2632
 __do_sys_sendmmsg net/socket.c:2661 [inline]
 __se_sys_sendmmsg net/socket.c:2658 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2658
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

read-write to 0xffff888135e491b8 of 8 bytes by task 17430 on cpu 1:
 ip6_tnl_xmit+0x86c/0x1230 net/ipv6/ip6_tunnel.c:1270
 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1387 [inline]
 ip6_tnl_start_xmit+0x93f/0xa90 net/ipv6/ip6_tunnel.c:1436
 __netdev_start_xmit include/linux/netdevice.h:4805 [inline]
 netdev_start_xmit include/linux/netdevice.h:4819 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3588
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3604
 __dev_queue_xmit+0x84c/0xfe0 net/core/dev.c:4253
 dev_queue_xmit include/linux/netdevice.h:2994 [inline]
 neigh_connected_output+0x266/0x2a0 net/core/neighbour.c:1557
 neigh_output include/net/neighbour.h:549 [inline]
 ip6_finish_output2+0xa12/0xc30 net/ipv6/ip6_output.c:134
 __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
 ip6_finish_output+0x395/0x4f0 net/ipv6/ip6_output.c:206
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:227
 dst_output include/net/dst.h:451 [inline]
 ip6_local_out+0x60/0x80 net/ipv6/output_core.c:161
 ip6_send_skb net/ipv6/ip6_output.c:1947 [inline]
 ip6_push_pending_frames+0xb6/0x170 net/ipv6/ip6_output.c:1967
 rawv6_push_pending_frames+0x3a2/0x3f0 net/ipv6/raw.c:613
 rawv6_sendmsg+0xd56/0xe40 net/ipv6/raw.c:956
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:819
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 ____sys_sendmsg+0x38f/0x500 net/socket.c:2492
 ___sys_sendmsg net/socket.c:2546 [inline]
 __sys_sendmmsg+0x27c/0x4a0 net/socket.c:2632
 __do_sys_sendmmsg net/socket.c:2661 [inline]
 __se_sys_sendmmsg net/socket.c:2658 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2658
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

value changed: 0x00000000000021fd -> 0x00000000000021fe

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17430 Comm: syz-executor.1 Not tainted 5.19.0-rc2-syzkaller-00049-g24625f7d91fb-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================