syzbot


KCSAN: data-race in tcp_check_req / tcp_check_req

Status: fixed on 2023/10/12 12:48
Subsystems: net
[Documentation on labels]
Fix commit: eba20811f326 tcp: annotate data-races around tcp_rsk(req)->ts_recent
First crash: 535d, last: 530d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in tcp_check_req / tcp_check_req

write to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 1:
 tcp_check_req+0x694/0xc70 net/ipv4/tcp_minisocks.c:762
 tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071
 ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:468 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core net/core/dev.c:5493 [inline]
 __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607
 process_backlog+0x21f/0x380 net/core/dev.c:5935
 __napi_poll+0x60/0x3b0 net/core/dev.c:6498
 napi_poll net/core/dev.c:6565 [inline]
 net_rx_action+0x32b/0x750 net/core/dev.c:6698
 __do_softirq+0xc1/0x265 kernel/softirq.c:571
 do_softirq+0x7e/0xb0 kernel/softirq.c:472
 __local_bh_enable_ip+0x64/0x70 kernel/softirq.c:396
 local_bh_enable+0x1f/0x20 include/linux/bottom_half.h:33
 rcu_read_unlock_bh include/linux/rcupdate.h:843 [inline]
 __dev_queue_xmit+0xabb/0x1d10 net/core/dev.c:4271
 dev_queue_xmit include/linux/netdevice.h:3088 [inline]
 neigh_hh_output include/net/neighbour.h:528 [inline]
 neigh_output include/net/neighbour.h:542 [inline]
 ip_finish_output2+0x700/0x840 net/ipv4/ip_output.c:229
 ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:317
 NF_HOOK_COND include/linux/netfilter.h:292 [inline]
 ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:431
 dst_output include/net/dst.h:458 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xa4d/0xa70 net/ipv4/ip_output.c:533
 ip_queue_xmit+0x38/0x40 net/ipv4/ip_output.c:547
 __tcp_transmit_skb+0x1194/0x16e0 net/ipv4/tcp_output.c:1399
 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]
 tcp_write_xmit+0x13ff/0x2fd0 net/ipv4/tcp_output.c:2693
 __tcp_push_pending_frames+0x6a/0x1a0 net/ipv4/tcp_output.c:2877
 tcp_push_pending_frames include/net/tcp.h:1952 [inline]
 __tcp_sock_set_cork net/ipv4/tcp.c:3336 [inline]
 tcp_sock_set_cork+0xe8/0x100 net/ipv4/tcp.c:3343
 rds_tcp_xmit_path_complete+0x3b/0x40 net/rds/tcp_send.c:52
 rds_send_xmit+0xf8d/0x1420 net/rds/send.c:422
 rds_send_worker+0x42/0x1d0 net/rds/threads.c:200
 process_one_work+0x3e6/0x750 kernel/workqueue.c:2408
 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2555
 kthread+0x1d7/0x210 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

read to 0xffff88813c8afb84 of 4 bytes by interrupt on cpu 0:
 tcp_check_req+0x32a/0xc70 net/ipv4/tcp_minisocks.c:622
 tcp_v4_rcv+0x12db/0x1b70 net/ipv4/tcp_ipv4.c:2071
 ip_protocol_deliver_rcu+0x356/0x6d0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x13c/0x1a0 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip_local_deliver+0xec/0x1c0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:468 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:449 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip_rcv+0x197/0x270 net/ipv4/ip_input.c:569
 __netif_receive_skb_one_core net/core/dev.c:5493 [inline]
 __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5607
 process_backlog+0x21f/0x380 net/core/dev.c:5935
 __napi_poll+0x60/0x3b0 net/core/dev.c:6498
 napi_poll net/core/dev.c:6565 [inline]
 net_rx_action+0x32b/0x750 net/core/dev.c:6698
 __do_softirq+0xc1/0x265 kernel/softirq.c:571
 run_ksoftirqd+0x17/0x20 kernel/softirq.c:939
 smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164
 kthread+0x1d7/0x210 kernel/kthread.c:379
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

value changed: 0x1cd237f1 -> 0x1cd237f2

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/26 16:21 upstream 6995e2de6891 4cd5bb25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in tcp_check_req / tcp_check_req
2023/06/21 20:58 upstream e660abd551f1 79782afc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in tcp_check_req / tcp_check_req
* Struck through repros no longer work on HEAD.