syzbot


KCSAN: data-race in fib_release_info / fib_table_lookup

Status: fixed on 2023/10/12 12:48
Subsystems: net
[Documentation on labels]
Fix commit: fce92af1c29d ipv4: annotate data-races around fi->fib_dead
First crash: 272d, last: 272d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in fib_release_info / fib_table_lookup

write to 0xffff888150f31744 of 1 bytes by task 1189 on cpu 0:
 fib_release_info+0x3a0/0x460 net/ipv4/fib_semantics.c:281
 fib_table_delete+0x8d2/0x900 net/ipv4/fib_trie.c:1777
 fib_magic+0x1c1/0x1f0 net/ipv4/fib_frontend.c:1106
 fib_del_ifaddr+0x8cf/0xa60 net/ipv4/fib_frontend.c:1317
 fib_inetaddr_event+0x77/0x200 net/ipv4/fib_frontend.c:1448
 notifier_call_chain kernel/notifier.c:93 [inline]
 blocking_notifier_call_chain+0x90/0x200 kernel/notifier.c:388
 __inet_del_ifa+0x4df/0x800 net/ipv4/devinet.c:432
 inet_del_ifa net/ipv4/devinet.c:469 [inline]
 inetdev_destroy net/ipv4/devinet.c:322 [inline]
 inetdev_event+0x553/0xaf0 net/ipv4/devinet.c:1606
 notifier_call_chain kernel/notifier.c:93 [inline]
 raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
 call_netdevice_notifiers_info net/core/dev.c:1962 [inline]
 call_netdevice_notifiers_mtu+0xd2/0x130 net/core/dev.c:2037
 dev_set_mtu_ext+0x30b/0x3e0 net/core/dev.c:8673
 do_setlink+0x5be/0x2430 net/core/rtnetlink.c:2837
 rtnl_setlink+0x255/0x300 net/core/rtnetlink.c:3177
 rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6445
 netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2549
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6463
 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
 netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365
 netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1914
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg net/socket.c:748 [inline]
 sock_write_iter+0x1aa/0x230 net/socket.c:1129
 do_iter_write+0x4b4/0x7b0 fs/read_write.c:860
 vfs_writev+0x1a8/0x320 fs/read_write.c:933
 do_writev+0xf8/0x220 fs/read_write.c:976
 __do_sys_writev fs/read_write.c:1049 [inline]
 __se_sys_writev fs/read_write.c:1046 [inline]
 __x64_sys_writev+0x45/0x50 fs/read_write.c:1046
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffff888150f31744 of 1 bytes by task 21839 on cpu 1:
 fib_table_lookup+0x2bf/0xd50 net/ipv4/fib_trie.c:1585
 fib_lookup include/net/ip_fib.h:383 [inline]
 ip_route_output_key_hash_rcu+0x38c/0x12c0 net/ipv4/route.c:2751
 ip_route_output_key_hash net/ipv4/route.c:2641 [inline]
 __ip_route_output_key include/net/route.h:134 [inline]
 ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2869
 send4+0x1e7/0x500 drivers/net/wireguard/socket.c:61
 wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
 wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
 wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
 process_one_work+0x434/0x860 kernel/workqueue.c:2600
 worker_thread+0x5f2/0xa10 kernel/workqueue.c:2751
 kthread+0x1d7/0x210 kernel/kthread.c:389
 ret_from_fork+0x2e/0x40 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 21839 Comm: kworker/u4:18 Tainted: G        W          6.5.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/08/28 07:25 upstream 2dde18cd1d8f 7ba13a15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in fib_release_info / fib_table_lookup
* Struck through repros no longer work on HEAD.