syzbot


KCSAN: data-race in __tcp_transmit_skb / tcp_delack_timer

Status: auto-closed as invalid on 2020/01/17 07:54
Subsystems: net
[Documentation on labels]
First crash: 1610d, last: 1602d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __tcp_transmit_skb / tcp_delack_timer

write to 0xffff888122b8f70b of 1 bytes by interrupt on cpu 0:
 tcp_delack_timer+0xb5/0x140 net/ipv4/tcp_timer.c:328
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline]
 kcsan_setup_watchpoint+0x205/0x410 kernel/kcsan/core.c:369
 check_access kernel/kcsan/core.c:409 [inline]
 __tsan_read2+0x145/0x1f0 kernel/kcsan/core.c:528
 tomoyo_domain_quota_is_ok+0x29c/0x2b0 security/tomoyo/util.c:1039
 tomoyo_supervisor+0x22b/0xd20 security/tomoyo/common.c:2087
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x121/0x160 security/tomoyo/file.c:573
 tomoyo_path_perm+0x23e/0x390 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x26/0x40 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0x9b/0xd0 security/security.c:1222
 vfs_getattr+0x2e/0x70 fs/stat.c:115
 vfs_statx_fd+0x7a/0xd0 fs/stat.c:145
 vfs_fstat include/linux/fs.h:3258 [inline]
 __do_sys_newfstat+0x49/0xa0 fs/stat.c:378
 __se_sys_newfstat fs/stat.c:375 [inline]
 __x64_sys_newfstat+0x3a/0x50 fs/stat.c:375
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffff888122b8f70b of 1 bytes by task 8123 on cpu 1:
 inet_csk_clear_xmit_timer include/net/inet_connection_sock.h:205 [inline]
 tcp_event_ack_sent net/ipv4/tcp_output.c:194 [inline]
 __tcp_transmit_skb+0xb7e/0x1d60 net/ipv4/tcp_output.c:1144
 tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline]
 tcp_write_xmit+0xa54/0x3120 net/ipv4/tcp_output.c:2440
 __tcp_push_pending_frames+0x7b/0x1d0 net/ipv4/tcp_output.c:2616
 tcp_push+0x1e9/0x3d0 net/ipv4/tcp.c:726
 tcp_sendmsg_locked+0x1d2b/0x1fb0 net/ipv4/tcp.c:1405
 tcp_sendmsg+0x39/0x60 net/ipv4/tcp.c:1436
 inet_sendmsg+0x6d/0x90 net/ipv4/af_inet.c:807
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 sock_write_iter+0x16b/0x210 net/socket.c:989
 call_write_iter include/linux/fs.h:1895 [inline]
 new_sync_write+0x388/0x4a0 fs/read_write.c:483
 __vfs_write+0xb1/0xc0 fs/read_write.c:496
 vfs_write fs/read_write.c:558 [inline]
 vfs_write+0x18a/0x390 fs/read_write.c:542
 ksys_write+0xd5/0x1b0 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x4c/0x60 fs/read_write.c:620
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8123 Comm: syz-fuzzer Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/08 07:50 https://github.com/google/ktsan.git kcsan 94c006602e13 1e35461e .config console log report ci2-upstream-kcsan-gce
2019/10/31 12:32 https://github.com/google/ktsan.git kcsan 05f2236801fe a41ca8fa .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.