syzbot


KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked (2)

Status: auto-closed as invalid on 2022/01/05 18:07
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 366d, last: 366d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked 1 1106d 1106d 0/24 auto-closed as invalid on 2020/02/01 01:47

Sample crash report:
==================================================================
BUG: KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked

write to 0xffff888130f523f8 of 4 bytes by task 4326 on cpu 1:
 sk_mem_charge include/net/sock.h:1578 [inline]
 skb_copy_to_page_nocache include/net/sock.h:2180 [inline]
 tcp_sendmsg_locked+0x1389/0x25a0 net/ipv4/tcp.c:1334
 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1440
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:644
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 __sys_sendto+0x21e/0x2c0 net/socket.c:2036
 __do_sys_sendto net/socket.c:2048 [inline]
 __se_sys_sendto net/socket.c:2044 [inline]
 __x64_sys_sendto+0x74/0x90 net/socket.c:2044
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888130f523f8 of 4 bytes by task 4327 on cpu 0:
 sk_forward_alloc_get include/net/sock.h:1303 [inline]
 inet_sk_diag_fill+0x4a5/0xc70 net/ipv4/inet_diag.c:274
 sk_diag_fill+0x17c/0x860 net/ipv4/inet_diag.c:508
 inet_diag_dump_icsk+0x93b/0xb50 net/ipv4/inet_diag.c:1142
 tcp_diag_dump+0x28/0x30 net/ipv4/tcp_diag.c:184
 __inet_diag_dump+0x17d/0x220 net/ipv4/inet_diag.c:1180
 inet_diag_dump_compat+0xcf/0x100 net/ipv4/inet_diag.c:1288
 netlink_dump+0x364/0x6b0 net/netlink/af_netlink.c:2265
 __netlink_dump_start+0x3eb/0x4e0 net/netlink/af_netlink.c:2370
 netlink_dump_start include/linux/netlink.h:254 [inline]
 inet_diag_rcv_msg_compat+0x1c4/0x1f0 net/ipv4/inet_diag.c:1322
 sock_diag_rcv_msg+0x12b/0x250
 netlink_rcv_skb+0x14e/0x250 net/netlink/af_netlink.c:2491
 sock_diag_rcv+0x24/0x40 net/core/sock_diag.c:276
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x5fc/0x6c0 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x6e1/0x7d0 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 __sys_sendmsg+0x195/0x230 net/socket.c:2492
 __do_sys_sendmsg net/socket.c:2501 [inline]
 __se_sys_sendmsg net/socket.c:2499 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2499
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x0010e5d0 -> 0x00103180

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 4327 Comm: syz-executor.4 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/12/01 18:02 upstream 58e1100fdc59 5fa3eacc .config log report info KCSAN: data-race in inet_sk_diag_fill / tcp_sendmsg_locked
* Struck through repros no longer work on HEAD.