syzbot


KCSAN: data-race in __inet_hash_connect / inet_send_prepare (4)

Status: fixed on 2021/11/10 00:50
Subsystems: net
[Documentation on labels]
Fix commit: dcd01eeac144 inet: annotate data race in inet_send_prepare() and inet_dgram_connect()
First crash: 1151d, last: 1096d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __inet_hash_connect / inet_send_prepare net 2 1619d 1655d 0/28 auto-closed as invalid on 2020/03/17 07:16
upstream KCSAN: data-race in __inet_hash_connect / inet_send_prepare (2) net 1 1343d 1343d 0/28 auto-closed as invalid on 2020/11/12 23:57
upstream KCSAN: data-race in __inet_hash_connect / inet_send_prepare (3) net 3 1258d 1274d 0/28 auto-closed as invalid on 2021/02/06 14:09

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __inet_hash_connect / inet_send_prepare

write to 0xffff888107c2e98e of 2 bytes by task 18238 on cpu 1:
 inet_bind_hash net/ipv4/inet_hashtables.c:98 [inline]
 __inet_hash_connect+0x716/0x900 net/ipv4/inet_hashtables.c:829
 inet6_hash_connect+0x77/0x80 net/ipv6/inet6_hashtables.c:327
 tcp_v6_connect+0x983/0xbb0 net/ipv6/tcp_ipv6.c:311
 __inet_stream_connect+0x156/0x6d0 net/ipv4/af_inet.c:664
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1190 [inline]
 tcp_sendmsg_locked+0x22e9/0x23f0 net/ipv4/tcp.c:1232
 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1458
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:642
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888107c2e98e of 2 bytes by task 18239 on cpu 0:
 inet_send_prepare+0x21/0x210 net/ipv4/af_inet.c:806
 inet6_sendmsg+0x29/0x80 net/ipv6/af_inet6.c:639
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x315/0x4b0 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2516
 do_syscall_64+0x4a/0x90 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0000 -> 0xbb7c

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 18239 Comm: syz-executor.3 Not tainted 5.13.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/06/13 16:35 upstream 8ecfa36cd4db 1ba81399 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/06/09 14:36 upstream 368094df48e6 84fe5d96 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/06/07 17:09 upstream 614124bea77e e59537be .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/05/26 03:42 upstream a050a6d2b7e8 93d3a9f6 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/04/21 05:39 upstream 1fe5501ba1ab c0ced557 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/04/20 00:35 upstream 7af08140979a 4285c989 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
2021/04/18 23:53 upstream bf05bf16c76b 7e2b734b .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in __inet_hash_connect / inet_send_prepare
* Struck through repros no longer work on HEAD.