syzbot


KCSAN: data-race in __neigh_event_send / ip_finish_output2 (2)

Status: auto-closed as invalid on 2020/07/31 03:13
Subsystems: net
[Documentation on labels]
First crash: 1417d, last: 1411d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __neigh_event_send / ip_finish_output2 net 2 1537d 1562d 0/26 auto-closed as invalid on 2020/05/01 10:09
upstream KCSAN: data-race in __neigh_event_send / ip_finish_output2 (3) net 1 927d 925d 20/26 fixed on 2022/03/08 16:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __neigh_event_send / ip_finish_output2

write to 0xffff8881000c8085 of 1 bytes by interrupt on cpu 0:
 __neigh_event_send+0x403/0xb10 net/core/neighbour.c:1126
 neigh_event_send include/net/neighbour.h:443 [inline]
 neigh_resolve_output+0x104/0x400 net/core/neighbour.c:1473
 neigh_output include/net/neighbour.h:509 [inline]
 ip_finish_output2+0x4e2/0xb60 net/ipv4/ip_output.c:228
 __ip_finish_output+0x395/0x3e0 net/ipv4/ip_output.c:306
 ip_finish_output+0x39/0x160 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf6/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:435 [inline]
 ip_local_out net/ipv4/ip_output.c:125 [inline]
 __ip_queue_xmit+0x997/0x9c0 net/ipv4/ip_output.c:530
 ip_queue_xmit+0x34/0x40 include/net/ip.h:237
 __tcp_transmit_skb+0x1320/0x1810 net/ipv4/tcp_output.c:1238
 tcp_transmit_skb net/ipv4/tcp_output.c:1254 [inline]
 tcp_xmit_probe_skb net/ipv4/tcp_output.c:3824 [inline]
 tcp_write_wakeup+0x4c3/0x910 net/ipv4/tcp_output.c:3877
 tcp_send_probe0+0x2c/0x270 net/ipv4/tcp_output.c:3892
 tcp_probe_timer net/ipv4/tcp_timer.c:387 [inline]
 tcp_write_timer_handler+0x420/0x500 net/ipv4/tcp_timer.c:615
 tcp_write_timer+0xb6/0x160 net/ipv4/tcp_timer.c:631
 call_timer_fn+0x30/0x2a0 kernel/time/timer.c:1404
 expire_timers+0x116/0x290 kernel/time/timer.c:1449
 __run_timers+0x443/0x500 kernel/time/timer.c:1773
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1786
 __do_softirq+0x198/0x360 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x5d/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:417
 sysvec_apic_timer_interrupt+0xd9/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:765 [inline]
 kcsan_setup_watchpoint+0x47c/0x4d0 kernel/kcsan/core.c:542
 tomoyo_domain_quota_is_ok+0x79/0x2d0 security/tomoyo/util.c:1037
 tomoyo_supervisor+0x1f4/0xb30 security/tomoyo/common.c:2089
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_perm+0x261/0x330 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x18/0x20 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x7f/0xd0 security/security.c:1278
 vfs_getattr fs/stat.c:121 [inline]
 vfs_statx+0x118/0x2b0 fs/stat.c:206
 vfs_lstat include/linux/fs.h:3301 [inline]
 __do_sys_newlstat fs/stat.c:374 [inline]
 __se_sys_newlstat+0x46/0x250 fs/stat.c:368
 __x64_sys_newlstat+0x2d/0x40 fs/stat.c:368
 do_syscall_64+0x71/0x120 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8881000c8085 of 1 bytes by interrupt on cpu 1:
 neigh_output include/net/neighbour.h:506 [inline]
 ip_finish_output2+0x476/0xb60 net/ipv4/ip_output.c:228
 __ip_finish_output+0x395/0x3e0 net/ipv4/ip_output.c:306
 ip_finish_output+0x39/0x160 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf6/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:435 [inline]
 ip_local_out net/ipv4/ip_output.c:125 [inline]
 __ip_queue_xmit+0x997/0x9c0 net/ipv4/ip_output.c:530
 ip_queue_xmit+0x34/0x40 include/net/ip.h:237
 __tcp_transmit_skb+0x1320/0x1810 net/ipv4/tcp_output.c:1238
 tcp_transmit_skb net/ipv4/tcp_output.c:1254 [inline]
 tcp_xmit_probe_skb net/ipv4/tcp_output.c:3824 [inline]
 tcp_write_wakeup+0x4c3/0x910 net/ipv4/tcp_output.c:3877
 tcp_send_probe0+0x2c/0x270 net/ipv4/tcp_output.c:3892
 tcp_probe_timer net/ipv4/tcp_timer.c:387 [inline]
 tcp_write_timer_handler+0x420/0x500 net/ipv4/tcp_timer.c:615
 tcp_write_timer+0xb6/0x160 net/ipv4/tcp_timer.c:631
 call_timer_fn+0x30/0x2a0 kernel/time/timer.c:1404
 expire_timers+0x116/0x290 kernel/time/timer.c:1449
 __run_timers+0x443/0x500 kernel/time/timer.c:1773
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1786
 __do_softirq+0x198/0x360 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x5d/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:417
 sysvec_apic_timer_interrupt+0xd9/0xf0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
 should_watch kernel/kcsan/core.c:260 [inline]
 check_access kernel/kcsan/core.c:581 [inline]
 __tsan_read8+0x150/0x180 kernel/kcsan/core.c:777
 tomoyo_compare_name_union security/tomoyo/file.c:85 [inline]
 tomoyo_check_path_acl+0x5c/0xe0 security/tomoyo/file.c:260
 tomoyo_check_acl+0xcc/0x220 security/tomoyo/domain.c:175
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_path_perm+0x22f/0x330 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x18/0x20 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x7f/0xd0 security/security.c:1278
 vfs_getattr fs/stat.c:121 [inline]
 vfs_statx+0x118/0x2b0 fs/stat.c:206
 vfs_stat include/linux/fs.h:3296 [inline]
 __do_sys_newstat fs/stat.c:361 [inline]
 __se_sys_newstat+0x46/0x250 fs/stat.c:357
 __x64_sys_newstat+0x2d/0x40 fs/stat.c:357
 do_syscall_64+0x71/0x120 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 20294 Comm: systemd-udevd Not tainted 5.8.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/26 03:12 upstream 4a21185cda0f aea82c00 .config console log report ci2-upstream-kcsan-gce
2020/06/19 19:47 upstream 5e857ce6eae7 123cf502 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.