syzbot


KCSAN: data-race in br_fdb_update / br_fdb_update (4)

Status: auto-closed as invalid on 2022/07/25 17:10
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 160d, last: 159d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (5) 2 56d 61d 0/24 auto-obsoleted due to no activity on 2022/11/05 14:29
upstream KCSAN: data-race in br_fdb_update / br_fdb_update 1 926d 926d 0/24 auto-closed as invalid on 2020/06/18 13:53
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (2) 1 809d 809d 0/24 auto-closed as invalid on 2020/10/13 10:41
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (3) 2 354d 379d 0/24 auto-closed as invalid on 2022/01/11 04:42

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_fdb_update / br_fdb_update

read to 0xffff88812a832cc0 of 8 bytes by interrupt on cpu 0:
 br_fdb_update+0x110/0x3e0 net/bridge/br_fdb.c:866
 br_handle_frame_finish+0x2d3/0xbc0 net/bridge/br_input.c:121
 br_nf_pre_routing_finish+0x7d5/0xb20 net/bridge/br_netfilter_hooks.c:422
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing+0x9fd/0xa90 net/bridge/br_netfilter_hooks.c:531
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:255 [inline]
 br_handle_frame+0x483/0x7d0 net/bridge/br_input.c:399
 __netif_receive_skb_core+0xa4e/0x1cc0 net/core/dev.c:5372
 __netif_receive_skb_one_core net/core/dev.c:5476 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5592
 process_backlog+0x23f/0x3b0 net/core/dev.c:5920
 __napi_poll+0x65/0x390 net/core/dev.c:6486
 napi_poll net/core/dev.c:6553 [inline]
 net_rx_action+0x37e/0x730 net/core/dev.c:6664
 __do_softirq+0x158/0x2e3 kernel/softirq.c:571
 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:934
 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

write to 0xffff88812a832cc0 of 8 bytes by interrupt on cpu 1:
 br_fdb_update+0x145/0x3e0 net/bridge/br_fdb.c:867
 br_handle_frame_finish+0x2d3/0xbc0 net/bridge/br_input.c:121
 br_nf_pre_routing_finish+0x7d5/0xb20 net/bridge/br_netfilter_hooks.c:422
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing+0x9fd/0xa90 net/bridge/br_netfilter_hooks.c:531
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:255 [inline]
 br_handle_frame+0x483/0x7d0 net/bridge/br_input.c:399
 __netif_receive_skb_core+0xa4e/0x1cc0 net/core/dev.c:5372
 __netif_receive_skb_one_core net/core/dev.c:5476 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5592
 process_backlog+0x23f/0x3b0 net/core/dev.c:5920
 __napi_poll+0x65/0x390 net/core/dev.c:6486
 napi_poll net/core/dev.c:6553 [inline]
 net_rx_action+0x37e/0x730 net/core/dev.c:6664
 __do_softirq+0x158/0x2e3 kernel/softirq.c:571
 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:934
 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

value changed: 0x0000000100003ae6 -> 0x0000000100003ae7

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 20 Comm: ksoftirqd/1 Tainted: G        W         5.19.0-rc3-syzkaller-00027-g78ca55889a54-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/06/20 17:09 upstream 78ca55889a54 b9406563 .config log report info KCSAN: data-race in br_fdb_update / br_fdb_update
ci2-upstream-kcsan-gce 2022/06/20 06:59 upstream a111daf0c53a 8f633d84 .config log report info KCSAN: data-race in br_fdb_update / br_fdb_update
ci2-upstream-kcsan-gce 2022/06/19 18:16 upstream 05c6ca8512f2 8f633d84 .config log report info KCSAN: data-race in br_fdb_update / br_fdb_update
* Struck through repros no longer work on HEAD.