DATA RACE in packetmmap.(*Endpoint).HandlePacket (2)

Status: fixed on 2025/02/11 14:03
Fix commit: d6454b486f82 Lock around packetmmap cooked field and check for PACKET_RESERVE opt size.
First crash: 567d, last: 567d
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor DATA RACE in packetmmap.(*Endpoint).HandlePacket (3) -1 syz, C 4 505d 505d 26/26 fixed on 2025/04/10 23:54
gvisor DATA RACE in packetmmap.(*Endpoint).HandlePacket (5) -1 syz, C 19 471d 477d 26/26 fixed on 2025/05/15 22:29
gvisor DATA RACE in packetmmap.(*Endpoint).HandlePacket -1 syz 3 567d 568d 26/26 fixed on 2025/02/07 11:57
gvisor DATA RACE in packetmmap.(*Endpoint).HandlePacket (4) -1 syz, C 4 480d 481d 26/26 fixed on 2025/05/07 21:58

Sample crash report:
WARNING: DATA RACE
Read at 0x00c0001c1534 by goroutine 1406:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*Endpoint).HandlePacket()
      pkg/sentry/socket/netstack/packetmmap/endpoint.go:196 +0x174
  gvisor.dev/gvisor/pkg/tcpip/transport/packet.(*endpoint).HandlePacket()
      pkg/tcpip/transport/packet/endpoint.go:470 +0x170
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket.func2()
      pkg/tcpip/stack/nic.go:815 +0x2a4
  gvisor.dev/gvisor/pkg/tcpip/stack.(*packetEndpointList).forEach()
      pkg/tcpip/stack/nic.go:146 +0x110
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket()
      pkg/tcpip/stack/nic.go:830 +0x20c
  gvisor.dev/gvisor/pkg/tcpip/link/nested.(*Endpoint).DeliverLinkPacket()
      pkg/tcpip/link/nested/nested.go:71 +0xb0
  gvisor.dev/gvisor/pkg/tcpip/link/packetsocket.(*endpoint).DeliverNetworkPacket()
      pkg/tcpip/link/packetsocket/packetsocket.go:45 +0x4c
  gvisor.dev/gvisor/pkg/tcpip/link/channel.(*Endpoint).InjectInbound()
      pkg/tcpip/link/channel/channel.go:208 +0xa8
  gvisor.dev/gvisor/pkg/tcpip/link/tun.(*Device).Write()
      pkg/tcpip/link/tun/device.go:250 +0x5bc
  gvisor.dev/gvisor/pkg/sentry/devices/tundev.(*tunFD).Write()
      pkg/sentry/devices/tundev/tundev.go:163 +0x3b0
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:682 +0x11c
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xb8
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x258
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x880
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x5c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xa4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x458
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x185c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x2f4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x40

Previous write at 0x00c0001c1534 by goroutine 1404:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*Endpoint).Init()
      pkg/sentry/socket/netstack/packetmmap/endpoint.go:87 +0x108
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.setSockOptPacket()
      pkg/sentry/socket/netstack/netstack.go:2749 +0x5a0
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:1873 +0x2ac
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:634 +0x4d4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.SetSockOpt()
      pkg/sentry/syscalls/linux/sys_socket.go:551 +0x328
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0x880
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x5c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xa4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x458
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x185c
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x2f4
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x40

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/07 19:46 gvisor 53d6f3dd2a22 94926c8d .config console log report syz / log C ci-gvisor-arm64-ptrace-1-race-cover DATA RACE in packetmmap.(*Endpoint).HandlePacket
* Struck through repros no longer work on HEAD.