syzbot


KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked

Status: auto-closed as invalid on 2020/02/01 01:47
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 1168d, last: 1168d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked (2) 1 428d 428d 0/24 auto-closed as invalid on 2022/01/05 18:07

Sample crash report:
==================================================================
BUG: KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked

read to 0xffff8880a1b53400 of 4 bytes by task 20449 on cpu 1:
 inet_sk_diag_fill+0x7a9/0xb10 net/ipv4/inet_diag.c:197
 inet_csk_diag_fill net/ipv4/inet_diag.c:323 [inline]
 sk_diag_fill net/ipv4/inet_diag.c:416 [inline]
 sk_diag_fill+0xdb/0x550 net/ipv4/inet_diag.c:402
 inet_diag_dump_icsk+0xbc7/0xd40 net/ipv4/inet_diag.c:1019
 tcp_diag_dump+0x3d/0x50 net/ipv4/tcp_diag.c:184
 __inet_diag_dump+0x72/0xd0 net/ipv4/inet_diag.c:1055
 inet_diag_dump+0x98/0xc0 net/ipv4/inet_diag.c:1071
 netlink_dump+0x315/0x800 net/netlink/af_netlink.c:2244
 __netlink_dump_start+0x35f/0x400 net/netlink/af_netlink.c:2352
 netlink_dump_start include/linux/netlink.h:233 [inline]
 inet_diag_handler_cmd+0x1b7/0x1d0 net/ipv4/inet_diag.c:1176
 __sock_diag_cmd net/core/sock_diag.c:233 [inline]
 sock_diag_rcv_msg+0x242/0x2a0 net/core/sock_diag.c:264
 netlink_rcv_skb+0xb0/0x260 net/netlink/af_netlink.c:2477
 sock_diag_rcv+0x32/0x50 net/core/sock_diag.c:275
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x354/0x430 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x456/0x770 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 sock_write_iter+0x16b/0x210 net/socket.c:989
 call_write_iter include/linux/fs.h:1895 [inline]
 do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693
 do_iter_write fs/read_write.c:970 [inline]
 do_iter_write+0x13b/0x3c0 fs/read_write.c:951
 vfs_writev+0x118/0x1c0 fs/read_write.c:1015
 do_writev+0xe3/0x250 fs/read_write.c:1058
 __do_sys_writev fs/read_write.c:1131 [inline]
 __se_sys_writev fs/read_write.c:1128 [inline]
 __x64_sys_writev+0x4e/0x60 fs/read_write.c:1128
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff8880a1b53400 of 4 bytes by task 20446 on cpu 0:
 sk_mem_charge include/net/sock.h:1451 [inline]
 skb_copy_to_page_nocache include/net/sock.h:2023 [inline]
 tcp_sendmsg_locked+0xe23/0x1fb0 net/ipv4/tcp.c:1337
 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1436
 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 __sys_sendto+0x21f/0x320 net/socket.c:1952
 __do_sys_sendto net/socket.c:1964 [inline]
 __se_sys_sendto net/socket.c:1960 [inline]
 __x64_sys_sendto+0x89/0xb0 net/socket.c:1960
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 20446 Comm: syz-executor.5 Not tainted 5.4.0-rc7+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-kcsan-gce 2019/11/23 01:38 https://github.com/google/ktsan.git kcsan 5863cc791e4c 598ca6c8 .config console log report
* Struck through repros no longer work on HEAD.