syzbot


KCSAN: data-race in __neigh_event_send / neigh_resolve_output (2)

Status: auto-closed as invalid on 2020/04/08 18:47
Subsystems: net
[Documentation on labels]
First crash: 1547d, last: 1547d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output (6) net 2 829d 863d 0/26 auto-closed as invalid on 2022/02/20 22:06
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output (4) net 1 1278d 1278d 0/26 auto-closed as invalid on 2020/11/28 17:46
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output net 5 1621d 1644d 0/26 auto-closed as invalid on 2020/01/25 19:36
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output (3) net 1 1405d 1405d 0/26 auto-closed as invalid on 2020/07/24 05:33
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output (5) net 2 1175d 1202d 0/26 auto-closed as invalid on 2021/03/11 01:25
upstream KCSAN: data-race in __neigh_event_send / neigh_resolve_output (7) net 43 379d 352d 22/26 fixed on 2023/06/08 14:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __neigh_event_send / neigh_resolve_output

write to 0xffff8880804f0085 of 1 bytes by interrupt on cpu 1:
 __neigh_event_send+0x185/0x9f0 net/core/neighbour.c:1128
 neigh_event_send include/net/neighbour.h:445 [inline]
 neigh_resolve_output+0x385/0x4c0 net/core/neighbour.c:1474
 neigh_output include/net/neighbour.h:511 [inline]
 ip_finish_output2+0x408/0xea0 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xfe/0x230 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
 sctp_v4_xmit+0xf4/0x110 net/sctp/protocol.c:976
 sctp_packet_transmit+0x111e/0x1800 net/sctp/output.c:629
 sctp_packet_singleton net/sctp/outqueue.c:772 [inline]
 sctp_outq_flush_ctrl.constprop.0+0x5d4/0x760 net/sctp/outqueue.c:903
 sctp_outq_flush+0xb9/0x14c0 net/sctp/outqueue.c:1185
 sctp_outq_uncork+0x64/0x80 net/sctp/outqueue.c:757
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1786 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1189 [inline]
 sctp_do_sm+0x37f/0x2f10 net/sctp/sm_sideeffect.c:1160
 sctp_generate_timeout_event+0x11c/0x1b0 net/sctp/sm_sideeffect.c:295
 sctp_generate_t1_init_event+0x27/0x30 net/sctp/sm_sideeffect.c:321
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 start_secondary+0x168/0x1b0 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

read to 0xffff8880804f0085 of 1 bytes by interrupt on cpu 0:
 neigh_event_send include/net/neighbour.h:444 [inline]
 neigh_resolve_output+0xb5/0x4c0 net/core/neighbour.c:1474
 neigh_output include/net/neighbour.h:511 [inline]
 ip_finish_output2+0x408/0xea0 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:308 [inline]
 __ip_finish_output+0x23a/0x490 net/ipv4/ip_output.c:290
 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:318
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xfe/0x230 net/ipv4/ip_output.c:432
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:532
 sctp_v4_xmit+0xf4/0x110 net/sctp/protocol.c:976
 sctp_packet_transmit+0x111e/0x1800 net/sctp/output.c:629
 sctp_packet_singleton net/sctp/outqueue.c:772 [inline]
 sctp_outq_flush_ctrl.constprop.0+0x5d4/0x760 net/sctp/outqueue.c:903
 sctp_outq_flush+0xb9/0x14c0 net/sctp/outqueue.c:1185
 sctp_outq_uncork+0x64/0x80 net/sctp/outqueue.c:757
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1786 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1189 [inline]
 sctp_do_sm+0x37f/0x2f10 net/sctp/sm_sideeffect.c:1160
 sctp_generate_timeout_event+0x11c/0x1b0 net/sctp/sm_sideeffect.c:295
 sctp_generate_t1_init_event+0x27/0x30 net/sctp/sm_sideeffect.c:321
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 rest_init+0xec/0xf6 init/main.c:452
 arch_call_rest_init+0x17/0x37
 start_kernel+0x838/0x85e init/main.c:786
 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
 x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/29 18:40 https://github.com/google/ktsan.git kcsan 245a43005292 5ed23f9a .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.