syzbot


KCSAN: data-race in can_receive / can_stat_update (9)

Status: auto-obsoleted due to no activity on 2024/05/09 16:43
Subsystems: can
[Documentation on labels]
First crash: 360d, last: 351d
Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in can_receive / can_stat_update (4) can 2 977d 990d 0/28 auto-closed as invalid on 2022/08/22 20:20
upstream KCSAN: data-race in can_receive / can_stat_update (2) can 1 1452d 1452d 0/28 auto-closed as invalid on 2021/05/04 12:50
upstream KCSAN: data-race in can_receive / can_stat_update (3) can 5 1031d 1105d 0/28 auto-closed as invalid on 2022/06/29 13:32
upstream KCSAN: data-race in can_receive / can_stat_update (11) can 1 199d 199d 0/28 auto-obsoleted due to no activity on 2024/10/09 05:23
upstream KCSAN: data-race in can_receive / can_stat_update (10) can 6 252d 282d 0/28 auto-obsoleted due to no activity on 2024/08/17 04:05
upstream KCSAN: data-race in can_receive / can_stat_update (7) can 2 711d 730d 0/28 auto-obsoleted due to no activity on 2023/05/15 22:30
upstream KCSAN: data-race in can_receive / can_stat_update can 3 1878d 1900d 0/28 auto-closed as invalid on 2020/04/09 06:18
upstream KCSAN: data-race in can_receive / can_stat_update (6) can 1 781d 781d 0/28 auto-obsoleted due to no activity on 2023/03/13 11:08
upstream KCSAN: data-race in can_receive / can_stat_update (8) can 2 660d 673d 0/28 auto-obsoleted due to no activity on 2023/07/05 18:24
upstream KCSAN: data-race in can_receive / can_stat_update (5) can 1 932d 932d 0/28 auto-closed as invalid on 2022/10/06 14:19
upstream KCSAN: data-race in can_receive / can_stat_update (12) can 11 9d17h 12d 0/28 moderation: reported on 2025/03/09 10:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in can_receive / can_stat_update

read to 0xffff88810434c5e8 of 8 bytes by interrupt on cpu 0:
 can_stat_update+0x444/0x6b0 net/can/proc.c:152
 call_timer_fn+0x3a/0x300 kernel/time/timer.c:1793
 expire_timers kernel/time/timer.c:1844 [inline]
 __run_timers kernel/time/timer.c:2418 [inline]
 __run_timer_base+0x417/0x640 kernel/time/timer.c:2429
 run_timer_base kernel/time/timer.c:2438 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2448
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 do_softirq+0x5e/0x90 kernel/softirq.c:455
 __local_bh_enable_ip+0x6e/0x70 kernel/softirq.c:382
 __raw_write_unlock_bh include/linux/rwlock_api_smp.h:281 [inline]
 _raw_write_unlock_bh+0x1f/0x30 kernel/locking/spinlock.c:366
 neigh_periodic_work+0x55a/0x600 net/core/neighbour.c:1017
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

read-write to 0xffff88810434c5e8 of 8 bytes by interrupt on cpu 1:
 can_receive+0x62/0x1f0 net/can/af_can.c:650
 can_rcv+0xe7/0x180 net/can/af_can.c:687
 __netif_receive_skb_one_core net/core/dev.c:5538 [inline]
 __netif_receive_skb+0x123/0x280 net/core/dev.c:5652
 process_backlog+0x21f/0x380 net/core/dev.c:5981
 __napi_poll+0x63/0x3c0 net/core/dev.c:6632
 napi_poll net/core/dev.c:6701 [inline]
 net_rx_action+0x324/0x720 net/core/dev.c:6816
 __do_softirq+0xc8/0x285 kernel/softirq.c:554
 do_softirq+0x5e/0x90 kernel/softirq.c:455
 __local_bh_enable_ip+0x6e/0x70 kernel/softirq.c:382
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:186 [inline]
 batadv_dat_purge+0x1dd/0x260 net/batman-adv/distributed-arp-table.c:205
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243

value changed: 0x0000000000012e87 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 27 Comm: kworker/u8:1 Tainted: G        W          6.9.0-rc2-syzkaller-00080-gc85af715cac0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Workqueue: bat_events batadv_dat_purge
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/04/04 16:34 upstream c85af715cac0 0ee3535e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_receive / can_stat_update
2024/03/27 06:41 upstream 7033999ecd7b 454571b6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in can_receive / can_stat_update
* Struck through repros no longer work on HEAD.