syzbot


KCSAN: data-race in __xfrm_state_delete / xfrm_resolve_and_create_bundle

Status: auto-closed as invalid on 2021/05/02 00:18
Subsystems: net
[Documentation on labels]
First crash: 1124d, last: 1124d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __xfrm_state_delete / xfrm_resolve_and_create_bundle

write to 0xffff88810ddf5d38 of 1 bytes by task 429 on cpu 1:
 __xfrm_state_delete+0x63/0x4a0 net/xfrm/xfrm_state.c:663
 xfrm_state_delete net/xfrm/xfrm_state.c:695 [inline]
 xfrm_state_flush+0x366/0x680 net/xfrm/xfrm_state.c:778
 pfkey_flush+0xb4/0x200 net/key/af_key.c:1770
 pfkey_process net/key/af_key.c:2841 [inline]
 pfkey_sendmsg+0x6aa/0x8c0 net/key/af_key.c:3680
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmsg+0x1ed/0x270 net/socket.c:2433
 __do_sys_sendmsg net/socket.c:2442 [inline]
 __se_sys_sendmsg net/socket.c:2440 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2440
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810ddf5d38 of 1 bytes by task 395 on cpu 0:
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2397 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2439 [inline]
 xfrm_resolve_and_create_bundle+0x4dd/0x1b80 net/xfrm/xfrm_policy.c:2729
 xfrm_lookup_with_ifid+0x184/0x15a0 net/xfrm/xfrm_policy.c:3063
 xfrm_lookup net/xfrm/xfrm_policy.c:3187 [inline]
 xfrm_lookup_route+0x37/0x100 net/xfrm/xfrm_policy.c:3198
 ip_route_output_flow+0x125/0x160 net/ipv4/route.c:2751
 udp_sendmsg+0x100a/0x1560 net/ipv4/udp.c:1206
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:821
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 395 Comm: syz-executor.4 Tainted: G        W         5.12.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/03/28 00:10 upstream 0f4498cef9f5 a8529b82 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __xfrm_state_delete / xfrm_resolve_and_create_bundle
* Struck through repros no longer work on HEAD.