KCSAN: data-race in fib6_clean_node / ip6_dst

KCSAN: data-race in fib6_clean_node / ip6_dst_check (2)
Status: auto-closed as invalid on 2020/09/13 19:08
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 410d, last: 410d

similar bugs (3):
Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in fib6_clean_node / ip6_dst_check (4)	2	177d	199d	0/22	auto-closed as invalid on 2021/05/04 21:50
upstream	KCSAN: data-race in fib6_clean_node / ip6_dst_check (3)	1	291d	286d	0/22	auto-closed as invalid on 2021/01/10 01:07
upstream	KCSAN: data-race in fib6_clean_node / ip6_dst_check	1	670d	670d	0/22	auto-closed as invalid on 2020/02/01 07:07

Sample crash report:

==================================================================
BUG: KCSAN: data-race in fib6_clean_node / ip6_dst_check

write to 0xffff8880a45a6eac of 4 bytes by task 25861 on cpu 1:
 fib6_clean_node+0xc0/0x260 net/ipv6/ip6_fib.c:2168
 fib6_walk_continue+0x38e/0x430 net/ipv6/ip6_fib.c:2102
 fib6_walk net/ipv6/ip6_fib.c:2150 [inline]
 fib6_clean_tree net/ipv6/ip6_fib.c:2230 [inline]
 __fib6_clean_all+0x188/0x2b0 net/ipv6/ip6_fib.c:2246
 fib6_flush_trees+0x6c/0x80 net/ipv6/ip6_fib.c:2271
 rt_genid_bump_ipv6 include/net/net_namespace.h:458 [inline]
 add_addr+0xf0/0x1d0 net/ipv6/addrconf.c:3092
 sit_add_v4_addrs net/ipv6/addrconf.c:3146 [inline]
 addrconf_sit_config net/ipv6/addrconf.c:3397 [inline]
 addrconf_notify+0x17fa/0x1e30 net/ipv6/addrconf.c:3590
 notifier_call_chain kernel/notifier.c:83 [inline]
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0x53/0xb0 kernel/notifier.c:368
 __dev_notify_flags+0x1cd/0x390 net/core/dev.c:2033
 rtnl_configure_link+0x141/0x150 net/core/rtnetlink.c:3130
 __rtnl_newlink net/core/rtnetlink.c:3460 [inline]
 rtnl_newlink+0xeb1/0x1340 net/core/rtnetlink.c:3500
 rtnetlink_rcv_msg+0x71b/0x7b0 net/core/rtnetlink.c:5563
 netlink_rcv_skb+0x13e/0x240 net/netlink/af_netlink.c:2470
 rtnetlink_rcv+0x18/0x20 net/core/rtnetlink.c:5581
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x5e2/0x6b0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x6d8/0x7a0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0x360/0x4d0 net/socket.c:2359
 ___sys_sendmsg net/socket.c:2413 [inline]
 __sys_sendmsg+0x1df/0x260 net/socket.c:2446
 __do_sys_sendmsg net/socket.c:2455 [inline]
 __se_sys_sendmsg net/socket.c:2453 [inline]
 __x64_sys_sendmsg+0x42/0x50 net/socket.c:2453
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8880a45a6eac of 4 bytes by task 25854 on cpu 0:
 fib6_get_cookie_safe include/net/ip6_fib.h:283 [inline]
 fib6_check net/ipv6/route.c:2577 [inline]
 rt6_dst_from_check net/ipv6/route.c:2608 [inline]
 ip6_dst_check+0x270/0x400 net/ipv6/route.c:2636
 __sk_dst_check+0x67/0xe0 net/core/sock.c:545
 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline]
 inet6_csk_route_socket+0x254/0x3b0 net/ipv6/inet6_connection_sock.c:104
 inet6_csk_xmit+0x7c/0x180 net/ipv6/inet6_connection_sock.c:121
 __tcp_transmit_skb+0x1320/0x1810 net/ipv4/tcp_output.c:1246
 tcp_transmit_skb net/ipv4/tcp_output.c:1264 [inline]
 tcp_write_xmit+0x1a7e/0x3f40 net/ipv4/tcp_output.c:2527
 __tcp_push_pending_frames+0x68/0x1c0 net/ipv4/tcp_output.c:2705
 tcp_push_pending_frames include/net/tcp.h:1865 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5297 [inline]
 tcp_rcv_established+0x6bb/0x1520 net/ipv4/tcp_input.c:5788
 tcp_v6_do_rcv+0x341/0x950 net/ipv6/tcp_ipv6.c:1449
 sk_backlog_rcv include/net/sock.h:1011 [inline]
 __release_sock+0xf5/0x260 net/core/sock.c:2542
 release_sock+0x40/0x110 net/core/sock.c:3065
 sk_stream_wait_memory+0x415/0x6e0 net/core/stream.c:145
 tcp_sendmsg_locked+0x8a5/0x2200 net/ipv4/tcp.c:1401
 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1441
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:638
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 __sys_sendto+0x2ad/0x380 net/socket.c:1994
 __do_sys_sendto net/socket.c:2006 [inline]
 __se_sys_sendto net/socket.c:2002 [inline]
 __x64_sys_sendto+0x74/0x90 net/socket.c:2002
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25854 Comm: syz-executor.3 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-upstream-kcsan-gce	2020/08/09 19:00	upstream	06a81c1c7db9	70301872	.config	log	report