syzbot

 sign-in | mailing list | source | docs
🐞 Open [7]
🐞 Fixed [500]
🐞 Invalid [396]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint

Status: fixed on 2025/02/07 11:57
Fix commit: da7cd03064d7 Lock around packet mmap fields.
First crash: 15d, last: 14d

Sample crash report:
WARNING: DATA RACE
Write at 0x00c0008961d8 by goroutine 360:
  gvisor.dev/gvisor/pkg/tcpip/transport/packet.(*endpoint).SetPacketMMapEndpoint()
      pkg/tcpip/transport/packet/endpoint.go:578 +0x51
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.setSockOptPacket()
      pkg/sentry/socket/netstack/netstack.go:2752 +0x772
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:1873 +0x365
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:634 +0x6a9
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.SetSockOpt()
      pkg/sentry/syscalls/linux/sys_socket.go:551 +0x46b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2294
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x44

Previous read at 0x00c0008961d8 by goroutine 362:
  gvisor.dev/gvisor/pkg/tcpip/transport/packet.(*endpoint).HandlePacket()
      pkg/tcpip/transport/packet/endpoint.go:464 +0x110
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket.func2()
      pkg/tcpip/stack/nic.go:815 +0x391
  gvisor.dev/gvisor/pkg/tcpip/stack.(*packetEndpointList).forEach()
      pkg/tcpip/stack/nic.go:146 +0x142
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket()
      pkg/tcpip/stack/nic.go:830 +0x2e6
  gvisor.dev/gvisor/pkg/tcpip/link/nested.(*Endpoint).DeliverLinkPacket()
      pkg/tcpip/link/nested/nested.go:71 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/packetsocket.(*endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/packetsocket/packetsocket.go:45 +0x4b
  gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound()
      pkg/tcpip/link/channel/channel.go:208 +0xc1
  gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write()
      pkg/tcpip/link/tun/device.go:250 +0x805
  gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write()
      pkg/sentry/devices/tundev/tundev.go:163 +0x591
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:682 +0x144
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xa4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x38e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2294
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x44

Crashes (25):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/07 10:06 gvisor a4a0e84b5cd5 53657d1b .config console log report syz / log C ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 06:56 gvisor a4a0e84b5cd5 53657d1b .config console log report syz / log C ci-gvisor-ptrace-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 10:10 gvisor a4a0e84b5cd5 53657d1b .config console log report syz / log ci-gvisor-ptrace-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 08:38 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 08:17 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 06:47 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 06:42 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 05:27 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 05:17 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 05:02 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 04:55 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 04:49 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 04:41 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 04:19 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 02:57 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 02:56 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 02:50 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/07 00:59 gvisor a4a0e84b5cd5 53657d1b .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 20:26 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 17:40 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 16:46 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 15:37 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-ptrace-2-race DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 14:45 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-ptrace-2-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 13:18 gvisor 902a56c6c584 1e1faf27 .config console log report info ci-gvisor-ptrace-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
2025/02/06 06:49 gvisor 902a56c6c584 577d049b .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packet.(*endpoint).SetPacketMMapEndpoint
* Struck through repros no longer work on HEAD.