syzbot


KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (5)

Status: auto-closed as invalid on 2021/03/30 00:44
Subsystems: bridge
[Documentation on labels]
First crash: 1352d, last: 1320d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (4) bridge 3 1413d 1394d 0/28 auto-closed as invalid on 2020/12/27 17:42
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (3) bridge 11 1463d 1549d 0/28 auto-closed as invalid on 2020/11/07 07:33
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (7) bridge 92 435d 874d 0/28 auto-obsoleted due to no activity on 2023/09/01 04:22
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (8) bridge 1 384d 383d 25/28 fixed on 2023/12/21 01:43
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish bridge 3 1705d 1785d 0/28 auto-closed as invalid on 2020/04/14 05:00
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (2) bridge 1 1580d 1580d 0/28 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (6) bridge 7 937d 1059d 0/28 auto-closed as invalid on 2022/04/16 22:53

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish

write to 0xffff888010a6b168 of 8 bytes by interrupt on cpu 1:
 br_handle_frame_finish+0x985/0xa60 net/bridge/br_input.c:142
 br_nf_hook_thresh+0x184/0x1c0 net/bridge/br_netfilter_hooks.c:1024
 br_nf_pre_routing_finish_ipv6+0x4ab/0x4c0 net/bridge/br_netfilter_ipv6.c:187
 NF_HOOK include/linux/netfilter.h:301 [inline]
 br_nf_pre_routing_ipv6+0x1ed/0x280 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0x4d6/0xb40 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:136 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:224 [inline]
 br_handle_frame+0x483/0xbb0 net/bridge/br_input.c:367
 __netif_receive_skb_core+0xa29/0x1e10 net/core/dev.c:5260
 __netif_receive_skb_one_core net/core/dev.c:5363 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5479
 process_backlog+0x23f/0x3e0 net/core/dev.c:6346
 __napi_poll+0x77/0x510 net/core/dev.c:6892
 napi_poll net/core/dev.c:6959 [inline]
 net_rx_action+0x29f/0x680 net/core/dev.c:7036
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 run_ksoftirqd+0x13/0x20 kernel/softirq.c:650
 smpboot_thread_fn+0x34f/0x520 kernel/smpboot.c:165
 kthread+0x20b/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

read to 0xffff888010a6b168 of 8 bytes by interrupt on cpu 0:
 br_handle_frame_finish+0x973/0xa60 net/bridge/br_input.c:142
 br_nf_hook_thresh+0x184/0x1c0 net/bridge/br_netfilter_hooks.c:1024
 br_nf_pre_routing_finish_ipv6+0x4ab/0x4c0 net/bridge/br_netfilter_ipv6.c:187
 NF_HOOK include/linux/netfilter.h:301 [inline]
 br_nf_pre_routing_ipv6+0x1ed/0x280 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0x4d6/0xb40 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:136 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:224 [inline]
 br_handle_frame+0x483/0xbb0 net/bridge/br_input.c:367
 __netif_receive_skb_core+0xa29/0x1e10 net/core/dev.c:5260
 __netif_receive_skb_one_core net/core/dev.c:5363 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5479
 process_backlog+0x23f/0x3e0 net/core/dev.c:6346
 __napi_poll+0x77/0x510 net/core/dev.c:6892
 napi_poll net/core/dev.c:6959 [inline]
 net_rx_action+0x29f/0x680 net/core/dev.c:7036
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 run_ksoftirqd+0x13/0x20 kernel/softirq.c:650
 smpboot_thread_fn+0x34f/0x520 kernel/smpboot.c:165
 kthread+0x20b/0x230 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted 5.11.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/23 00:38 upstream 31caf8b2a847 c26fb06b .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish
2021/01/22 04:53 upstream 83d09ad4b950 d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish
* Struck through repros no longer work on HEAD.