syzbot

==================================================================
BUG: KCSAN: data-race in xfrmi_xmit / xfrmi_xmit

read-write to 0xffff88813c871158 of 8 bytes by task 26566 on cpu 0:
 xfrmi_xmit+0x735/0xaf0 net/xfrm/xfrm_interface_core.c:536
 __netdev_start_xmit include/linux/netdevice.h:4865 [inline]
 netdev_start_xmit include/linux/netdevice.h:4879 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3583
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3599
 __dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4249
 dev_queue_xmit include/linux/netdevice.h:3035 [inline]
 neigh_connected_output+0x25c/0x2d0 net/core/neighbour.c:1600
 neigh_output include/net/neighbour.h:546 [inline]
 ip_finish_output2+0x74d/0x850 net/ipv4/ip_output.c:228
 ip_finish_output+0xf3/0x250 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0x60/0x80 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x306/0x470 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0x15c7/0x1680 net/ipv4/ip_tunnel.c:813
 __gre_xmit net/ipv4/ip_gre.c:469 [inline]
 ipgre_xmit+0x506/0x560 net/ipv4/ip_gre.c:661
 __netdev_start_xmit include/linux/netdevice.h:4865 [inline]
 netdev_start_xmit include/linux/netdevice.h:4879 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3583
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3599
 __dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4249
 dev_queue_xmit include/linux/netdevice.h:3035 [inline]
 __bpf_tx_skb net/core/filter.c:2117 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2147 [inline]
 __bpf_redirect+0x541/0x940 net/core/filter.c:2170
 ____bpf_clone_redirect net/core/filter.c:2437 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2409
 ___bpf_prog_run+0x278/0x2da0 kernel/bpf/core.c:1820
 __bpf_prog_run512+0x70/0xa0 kernel/bpf/core.c:2045
 bpf_dispatcher_nop_func include/linux/bpf.h:1082 [inline]
 __bpf_prog_run include/linux/filter.h:600 [inline]
 bpf_prog_run include/linux/filter.h:607 [inline]
 bpf_test_run+0x1eb/0x410 net/bpf/test_run.c:402
 bpf_prog_test_run_skb+0x769/0x9f0 net/bpf/test_run.c:1187
 bpf_prog_test_run+0x22a/0x250 kernel/bpf/syscall.c:3644
 __sys_bpf+0x38a/0x630 kernel/bpf/syscall.c:4997
 __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:5081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read-write to 0xffff88813c871158 of 8 bytes by task 26565 on cpu 1:
 xfrmi_xmit+0x735/0xaf0 net/xfrm/xfrm_interface_core.c:536
 __netdev_start_xmit include/linux/netdevice.h:4865 [inline]
 netdev_start_xmit include/linux/netdevice.h:4879 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3583
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3599
 __dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4249
 dev_queue_xmit include/linux/netdevice.h:3035 [inline]
 neigh_connected_output+0x25c/0x2d0 net/core/neighbour.c:1600
 neigh_output include/net/neighbour.h:546 [inline]
 ip_finish_output2+0x74d/0x850 net/ipv4/ip_output.c:228
 ip_finish_output+0xf3/0x250 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0x60/0x80 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x306/0x470 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0x15c7/0x1680 net/ipv4/ip_tunnel.c:813
 __gre_xmit net/ipv4/ip_gre.c:469 [inline]
 ipgre_xmit+0x506/0x560 net/ipv4/ip_gre.c:661
 __netdev_start_xmit include/linux/netdevice.h:4865 [inline]
 netdev_start_xmit include/linux/netdevice.h:4879 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3583
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3599
 __dev_queue_xmit+0x91c/0x11c0 net/core/dev.c:4249
 dev_queue_xmit include/linux/netdevice.h:3035 [inline]
 __bpf_tx_skb net/core/filter.c:2117 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2147 [inline]
 __bpf_redirect+0x541/0x940 net/core/filter.c:2170
 ____bpf_clone_redirect net/core/filter.c:2437 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2409
 ___bpf_prog_run+0x278/0x2da0 kernel/bpf/core.c:1820
 __bpf_prog_run512+0x70/0xa0 kernel/bpf/core.c:2045
 bpf_dispatcher_nop_func include/linux/bpf.h:1082 [inline]
 __bpf_prog_run include/linux/filter.h:600 [inline]
 bpf_prog_run include/linux/filter.h:607 [inline]
 bpf_test_run+0x1eb/0x410 net/bpf/test_run.c:402
 bpf_prog_test_run_skb+0x769/0x9f0 net/bpf/test_run.c:1187
 bpf_prog_test_run+0x22a/0x250 kernel/bpf/syscall.c:3644
 __sys_bpf+0x38a/0x630 kernel/bpf/syscall.c:4997
 __do_sys_bpf kernel/bpf/syscall.c:5083 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5081 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:5081
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x0000000000001d24 -> 0x0000000000001d26

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 26565 Comm: syz-executor.3 Tainted: G        W          6.1.0-syzkaller-14594-g72a85e2b0a1e-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
==================================================================
syz-executor.3 (26565) used greatest stack depth: 9152 bytes left