syzbot


KCSAN: data-race in __ip6_datagram_connect / __raw_v6_lookup (2)

Status: auto-closed as invalid on 2020/06/18 13:53
Subsystems: net
[Documentation on labels]
First crash: 1447d, last: 1447d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __ip6_datagram_connect / __raw_v6_lookup net 1 1550d 1550d 0/26 auto-closed as invalid on 2020/03/28 17:40

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __ip6_datagram_connect / __raw_v6_lookup

read to 0xffff888097c84b38 of 8 bytes by interrupt on cpu 1:
 ipv6_addr_any include/net/ipv6.h:640 [inline]
 __raw_v6_lookup+0xc7/0x2f0 net/ipv6/raw.c:81
 ipv6_raw_deliver net/ipv6/raw.c:178 [inline]
 raw6_local_deliver+0x1d5/0x610 net/ipv6/raw.c:235
 ip6_protocol_deliver_rcu+0x26d/0xba0 net/ipv6/ip6_input.c:383
 ip6_input_finish+0x2c/0x40 net/ipv6/ip6_input.c:474
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip6_input+0x180/0x190 net/ipv6/ip6_input.c:483
 dst_input include/net/dst.h:441 [inline]
 ip6_rcv_finish+0x10c/0x140 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ipv6_rcv+0x1ae/0x1c0 net/ipv6/ip6_input.c:307
 __netif_receive_skb_one_core+0x9f/0xe0 net/core/dev.c:5187
 __netif_receive_skb+0x33/0xf0 net/core/dev.c:5301
 process_backlog+0x213/0x4c0 net/core/dev.c:6133
 napi_poll net/core/dev.c:6571 [inline]
 net_rx_action+0x3ad/0xac0 net/core/dev.c:6639
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1082
 do_softirq.part.0+0x66/0x70 kernel/softirq.c:337
 do_softirq kernel/softirq.c:329 [inline]
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:690 [inline]
 ip6_finish_output2+0x730/0xf60 net/ipv6/ip6_output.c:118
 __ip6_finish_output net/ipv6/ip6_output.c:143 [inline]
 __ip6_finish_output+0x2cb/0x320 net/ipv6/ip6_output.c:128
 ip6_finish_output+0x3e/0x160 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x104/0x2a0 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:435 [inline]
 ip6_local_out+0x70/0x90 net/ipv6/output_core.c:179
 ip6_send_skb+0x4f/0x110 net/ipv6/ip6_output.c:1865
 ip6_push_pending_frames+0x93/0xb0 net/ipv6/ip6_output.c:1885
 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
 rawv6_sendmsg+0x1e5c/0x2320 net/ipv6/raw.c:956
 inet_sendmsg+0x69/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0x98/0xc0 net/socket.c:672
 ____sys_sendmsg+0x207/0x4c0 net/socket.c:2362
 ___sys_sendmsg+0xb5/0x100 net/socket.c:2416
 __sys_sendmmsg+0x10e/0x310 net/socket.c:2506
 __do_sys_sendmmsg net/socket.c:2535 [inline]
 __se_sys_sendmmsg net/socket.c:2532 [inline]
 __x64_sys_sendmmsg+0x60/0x80 net/socket.c:2532
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff888097c84b38 of 16 bytes by task 27234 on cpu 0:
 __ip6_datagram_connect+0x521/0x9f0 net/ipv6/datagram.c:238
 ip6_datagram_connect+0x35/0x50 net/ipv6/datagram.c:271
 ip6_datagram_connect_v6_only+0x4f/0x70 net/ipv6/datagram.c:283
 inet_dgram_connect+0xc5/0x190 net/ipv4/af_inet.c:571
 __sys_connect_file+0xdc/0xf0 net/socket.c:1859
 __sys_connect+0x11b/0x150 net/socket.c:1876
 __do_sys_connect net/socket.c:1887 [inline]
 __se_sys_connect net/socket.c:1884 [inline]
 __x64_sys_connect+0x48/0x60 net/socket.c:1884
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 27234 Comm: syz-executor.1 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/04/30 04:35 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 2dd552a5 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.