syzbot


KCSAN: data-race in tcp_make_synack / tcp_rtx_synack

Status: fixed on 2023/10/12 12:48
Subsystems: net
[Documentation on labels]
Fix commit: 5e5265522a9a tcp: annotate data-races around tcp_rsk(req)->txhash
First crash: 289d, last: 289d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in tcp_make_synack / tcp_rtx_synack

write to 0xffff8881362304bc of 4 bytes by task 32083 on cpu 1:
 tcp_rtx_synack+0x9d/0x2a0 net/ipv4/tcp_output.c:4213
 inet_rtx_syn_ack+0x38/0x80 net/ipv4/inet_connection_sock.c:880
 tcp_check_req+0x379/0xc70 net/ipv4/tcp_minisocks.c:665
 tcp_v6_rcv+0x125b/0x1b20 net/ipv6/tcp_ipv6.c:1673
 ip6_protocol_deliver_rcu+0x92f/0xf30 net/ipv6/ip6_input.c:437
 ip6_input_finish net/ipv6/ip6_input.c:482 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip6_input+0xbd/0x1b0 net/ipv6/ip6_input.c:491
 dst_input include/net/dst.h:468 [inline]
 ip6_rcv_finish+0x1e2/0x2e0 net/ipv6/ip6_input.c:79
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ipv6_rcv+0x74/0x150 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5452 [inline]
 __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566
 netif_receive_skb_internal net/core/dev.c:5652 [inline]
 netif_receive_skb+0x4a/0x310 net/core/dev.c:5711
 tun_rx_batched+0x3bf/0x400
 tun_get_user+0x1d24/0x22b0 drivers/net/tun.c:1997
 tun_chr_write_iter+0x18e/0x240 drivers/net/tun.c:2043
 call_write_iter include/linux/fs.h:1871 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x4ab/0x7d0 fs/read_write.c:584
 ksys_write+0xeb/0x1a0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x42/0x50 fs/read_write.c:646
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff8881362304bc of 4 bytes by task 32078 on cpu 0:
 tcp_make_synack+0x367/0xb40 net/ipv4/tcp_output.c:3663
 tcp_v6_send_synack+0x72/0x420 net/ipv6/tcp_ipv6.c:544
 tcp_conn_request+0x11a8/0x1560 net/ipv4/tcp_input.c:7059
 tcp_v6_conn_request+0x13f/0x180 net/ipv6/tcp_ipv6.c:1175
 tcp_rcv_state_process+0x156/0x1de0 net/ipv4/tcp_input.c:6494
 tcp_v6_do_rcv+0x98a/0xb70 net/ipv6/tcp_ipv6.c:1509
 tcp_v6_rcv+0x17b8/0x1b20 net/ipv6/tcp_ipv6.c:1735
 ip6_protocol_deliver_rcu+0x92f/0xf30 net/ipv6/ip6_input.c:437
 ip6_input_finish net/ipv6/ip6_input.c:482 [inline]
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ip6_input+0xbd/0x1b0 net/ipv6/ip6_input.c:491
 dst_input include/net/dst.h:468 [inline]
 ip6_rcv_finish+0x1e2/0x2e0 net/ipv6/ip6_input.c:79
 NF_HOOK include/linux/netfilter.h:303 [inline]
 ipv6_rcv+0x74/0x150 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core net/core/dev.c:5452 [inline]
 __netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566
 netif_receive_skb_internal net/core/dev.c:5652 [inline]
 netif_receive_skb+0x4a/0x310 net/core/dev.c:5711
 tun_rx_batched+0x3bf/0x400
 tun_get_user+0x1d24/0x22b0 drivers/net/tun.c:1997
 tun_chr_write_iter+0x18e/0x240 drivers/net/tun.c:2043
 call_write_iter include/linux/fs.h:1871 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x4ab/0x7d0 fs/read_write.c:584
 ksys_write+0xeb/0x1a0 fs/read_write.c:637
 __do_sys_write fs/read_write.c:649 [inline]
 __se_sys_write fs/read_write.c:646 [inline]
 __x64_sys_write+0x42/0x50 fs/read_write.c:646
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x91d25731 -> 0xe79325cd

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 32078 Comm: syz-executor.4 Not tainted 6.5.0-rc1-syzkaller-00033-geb26cbb1a754 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
==================================================================
syz-executor.4 (32078) used greatest stack depth: 10040 bytes left

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/07/13 05:54 upstream eb26cbb1a754 86081196 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in tcp_make_synack / tcp_rtx_synack
* Struck through repros no longer work on HEAD.