syzbot

==================================================================
BUG: KCSAN: data-race in mptcp_subflow_get_send / tcp_rearm_rto

write to 0xffff88812bcbb4e2 of 1 bytes by interrupt on cpu 1:
 inet_csk_clear_xmit_timer include/net/inet_connection_sock.h:200 [inline]
 tcp_rearm_rto+0x94/0x370 net/ipv4/tcp_input.c:3273
 tcp_set_xmit_timer net/ipv4/tcp_input.c:3294 [inline]
 tcp_ack+0x2717/0x2f70 net/ipv4/tcp_input.c:4054
 tcp_rcv_established+0x46b/0xef0 net/ipv4/tcp_input.c:6253
 tcp_v4_do_rcv+0x662/0x740 net/ipv4/tcp_ipv4.c:1915
 tcp_v4_rcv+0x1b25/0x1ee0 net/ipv4/tcp_ipv4.c:2350
 ip_protocol_deliver_rcu+0x370/0x720 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x17d/0x210 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_local_deliver+0xec/0x1d0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish+0x193/0x1b0 net/ipv4/ip_input.c:449
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ip_rcv+0x64/0x140 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core net/core/dev.c:5670 [inline]
 __netif_receive_skb+0x10a/0x280 net/core/dev.c:5783
 process_backlog+0x22e/0x440 net/core/dev.c:6115
 __napi_poll+0x63/0x3c0 net/core/dev.c:6779
 napi_poll net/core/dev.c:6848 [inline]
 net_rx_action+0x3a1/0x7f0 net/core/dev.c:6970
 handle_softirqs+0xbf/0x280 kernel/softirq.c:554
 do_softirq+0x5e/0x90 kernel/softirq.c:455
 __local_bh_enable_ip+0x6e/0x70 kernel/softirq.c:382
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 unlock_sock_fast include/net/sock.h:1672 [inline]
 mptcp_subflow_cleanup_rbuf net/mptcp/protocol.c:538 [inline]
 mptcp_cleanup_rbuf net/mptcp/protocol.c:569 [inline]
 mptcp_recvmsg+0x84b/0xf80 net/mptcp/protocol.c:2221
 inet_recvmsg+0x171/0x290 net/ipv4/af_inet.c:885
 sock_recvmsg_nosec net/socket.c:1033 [inline]
 sock_recvmsg+0xfe/0x170 net/socket.c:1055
 __sys_recvfrom+0x126/0x1f0 net/socket.c:2245
 __do_sys_recvfrom net/socket.c:2260 [inline]
 __se_sys_recvfrom net/socket.c:2256 [inline]
 __x64_sys_recvfrom+0x78/0x90 net/socket.c:2256
 x64_sys_call+0x17ea/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:46
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88812bcbb4e2 of 1 bytes by task 25267 on cpu 0:
 mptcp_timeout_from_subflow net/mptcp/protocol.c:488 [inline]
 mptcp_subflow_get_send+0x1ac/0x7f0 net/mptcp/protocol.c:1450
 mptcp_sched_default_get_subflow net/mptcp/sched.c:25 [inline]
 mptcp_sched_get_send+0x218/0x2e0 net/mptcp/sched.c:171
 __mptcp_push_pending+0x100/0x4e0 net/mptcp/protocol.c:1601
 mptcp_sendmsg+0xa70/0xe60 net/mptcp/protocol.c:1921
 inet6_sendmsg+0xc5/0xd0 net/ipv6/af_inet6.c:661
 sock_sendmsg_nosec net/socket.c:711 [inline]
 __sock_sendmsg+0x8b/0x180 net/socket.c:726
 ____sys_sendmsg+0x312/0x410 net/socket.c:2581
 ___sys_sendmsg net/socket.c:2635 [inline]
 __sys_sendmsg+0x19d/0x230 net/socket.c:2667
 __do_sys_sendmsg net/socket.c:2672 [inline]
 __se_sys_sendmsg net/socket.c:2670 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2670
 x64_sys_call+0x2734/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x05 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 25267 Comm: syz.3.18338 Tainted: G        W          6.12.0-syzkaller-00971-g158f238aa69d #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
==================================================================