syzbot

 sign-in | mailing list | source | docs
🐞 Open [983] ≡ Subsystems 🐞 Fixed [5236] 🐞 Invalid [12500] ⬇ Missing Backports [83] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

KCSAN: data-race in __xfrm_policy_check / __xfrm_policy_check

Status: closed as invalid on 2019/11/19 13:44
Subsystems: net
[Documentation on labels]
First crash: 1638d, last: 1633d
▶ ▼ Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __xfrm_policy_check / __xfrm_policy_check (2) net 1 464d 461d 0/26 closed as invalid on 2023/03/21 17:14

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __xfrm_policy_check / __xfrm_policy_check

write to 0xffff88812ac10508 of 8 bytes by interrupt on cpu 1:
 __xfrm_policy_check+0x3ce/0x13e0 net/xfrm/xfrm_policy.c:3585
 __xfrm_policy_check2 include/net/xfrm.h:1101 [inline]
 xfrm_policy_check include/net/xfrm.h:1106 [inline]
 xfrm6_policy_check include/net/xfrm.h:1116 [inline]
 tcp_v6_rcv+0x1a39/0x1ac0 net/ipv6/tcp_ipv6.c:1583
 ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409
 ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459
 dst_input include/net/dst.h:442 [inline]
 ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043
 process_backlog+0x207/0x4b0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6379
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082
 do_softirq.part.0+0x6b/0x80 kernel/softirq.c:337
 do_softirq kernel/softirq.c:329 [inline]
 __local_bh_enable_ip+0x76/0x80 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline]
 ip6_finish_output2+0x7bb/0xec0 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip6_xmit+0x6cb/0xcd0 net/ipv6/ip6_output.c:279
 inet6_csk_xmit+0x170/0x1f0 net/ipv6/inet6_connection_sock.c:135
 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
 tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
 tcp_write_xmit+0xa54/0x3120 net/ipv4/tcp_output.c:2440
 tcp_push_one+0x95/0xb0 net/ipv4/tcp_output.c:2630
 tcp_sendmsg_locked+0x11aa/0x1fb0 net/ipv4/tcp.c:1385
 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1436
 inet6_sendmsg+0x6d/0x90 net/ipv6/af_inet6.c:576
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 __sys_sendto+0x21f/0x320 net/socket.c:1952
 __do_sys_sendto net/socket.c:1964 [inline]
 __se_sys_sendto net/socket.c:1960 [inline]
 __x64_sys_sendto+0x89/0xb0 net/socket.c:1960
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff88812ac10508 of 8 bytes by interrupt on cpu 0:
 __xfrm_policy_check+0x3ce/0x13e0 net/xfrm/xfrm_policy.c:3585
 __xfrm_policy_check2 include/net/xfrm.h:1101 [inline]
 xfrm_policy_check include/net/xfrm.h:1106 [inline]
 xfrm6_policy_check include/net/xfrm.h:1116 [inline]
 tcp_v6_rcv+0x1a39/0x1ac0 net/ipv6/tcp_ipv6.c:1583
 ip6_protocol_deliver_rcu+0x22a/0xbe0 net/ipv6/ip6_input.c:409
 ip6_input_finish+0x30/0x50 net/ipv6/ip6_input.c:450
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip6_input+0x177/0x190 net/ipv6/ip6_input.c:459
 dst_input include/net/dst.h:442 [inline]
 ip6_rcv_finish+0x110/0x140 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043
 process_backlog+0x207/0x4b0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6379
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082
 do_softirq.part.0+0x6b/0x80 kernel/softirq.c:337
 do_softirq kernel/softirq.c:329 [inline]
 __local_bh_enable_ip+0x76/0x80 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:688 [inline]
 ip6_finish_output2+0x7bb/0xec0 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:294 [inline]
 ip6_output+0xf2/0x280 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ip6_xmit+0x6cb/0xcd0 net/ipv6/ip6_output.c:279
 inet6_csk_xmit+0x170/0x1f0 net/ipv6/inet6_connection_sock.c:135
 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169
 __tcp_send_ack+0x246/0x300 net/ipv4/tcp_output.c:3696
 tcp_send_ack+0x34/0x40 net/ipv4/tcp_output.c:3702
 tcp_cleanup_rbuf+0x130/0x360 net/ipv4/tcp.c:1578
 tcp_recvmsg+0x57c/0x1b40 net/ipv4/tcp.c:2091
 inet6_recvmsg+0xbb/0x240 net/ipv6/af_inet6.c:592
 sock_recvmsg_nosec net/socket.c:871 [inline]
 sock_recvmsg net/socket.c:889 [inline]
 sock_recvmsg+0x92/0xb0 net/socket.c:885
 __sys_recvfrom+0x1ae/0x2d0 net/socket.c:2009
 __do_sys_recvfrom net/socket.c:2027 [inline]
 __se_sys_recvfrom net/socket.c:2023 [inline]
 __x64_sys_recvfrom+0x89/0xb0 net/socket.c:2023
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13897 Comm: syz-executor.0 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/05 04:44 https://github.com/google/ktsan.git kcsan 94c006602e13 76630fc9 .config console log report ci2-upstream-kcsan-gce
2019/10/30 23:32 https://github.com/google/ktsan.git kcsan 05f2236801fe a41ca8fa .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.