syzbot


KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (3)

Status: auto-closed as invalid on 2020/12/03 02:00
Subsystems: net
[Documentation on labels]
First crash: 1281d, last: 1274d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (6) net 1 775d 775d 0/26 auto-closed as invalid on 2022/04/15 20:54
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (8) net 2 636d 644d 0/26 auto-closed as invalid on 2022/09/02 16:35
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (5) net 9 830d 894d 0/26 auto-closed as invalid on 2022/02/20 15:36
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit net 10 1503d 1638d 0/26 auto-closed as invalid on 2020/05/22 23:22
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (2) net 2 1374d 1375d 0/26 auto-closed as invalid on 2020/08/24 20:07
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (4) net 1 1115d 1115d 0/26 auto-closed as invalid on 2021/05/17 09:21
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (7) net 1 716d 716d 0/26 auto-closed as invalid on 2022/06/14 13:17
upstream KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit (9) net 3 506d 529d 0/26 auto-obsoleted due to no activity on 2023/01/13 04:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ip6_tnl_start_xmit / ip6_tnl_start_xmit

read-write to 0xffff888021cf7130 of 8 bytes by task 25992 on cpu 1:
 ip6_tnl_start_xmit+0x7f9/0x9e0 net/ipv6/ip6_tunnel.c:1468
 __netdev_start_xmit include/linux/netdevice.h:4718 [inline]
 netdev_start_xmit include/linux/netdevice.h:4732 [inline]
 xmit_one+0xf9/0x2e0 net/core/dev.c:3564
 dev_hard_start_xmit net/core/dev.c:3580 [inline]
 __dev_queue_xmit+0xeef/0x1510 net/core/dev.c:4140
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4173
 neigh_connected_output+0x264/0x290 net/core/neighbour.c:1518
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x984/0xb20 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x2f1/0x320 net/ipv6/ip6_output.c:143
 ip6_finish_output+0x39/0x160 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:443 [inline]
 ip6_local_out+0x60/0x80 net/ipv6/output_core.c:179
 ip6_send_skb net/ipv6/ip6_output.c:1865 [inline]
 ip6_push_pending_frames+0xb6/0x170 net/ipv6/ip6_output.c:1885
 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
 rawv6_sendmsg+0x1283/0x1320 net/ipv6/raw.c:956
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:817
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0x352/0x4c0 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmmsg+0x335/0x4b0 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2523
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read-write to 0xffff888021cf7130 of 8 bytes by task 25999 on cpu 0:
 ip6_tnl_start_xmit+0x7f9/0x9e0 net/ipv6/ip6_tunnel.c:1468
 __netdev_start_xmit include/linux/netdevice.h:4718 [inline]
 netdev_start_xmit include/linux/netdevice.h:4732 [inline]
 xmit_one+0xf9/0x2e0 net/core/dev.c:3564
 dev_hard_start_xmit net/core/dev.c:3580 [inline]
 __dev_queue_xmit+0xeef/0x1510 net/core/dev.c:4140
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4173
 neigh_connected_output+0x264/0x290 net/core/neighbour.c:1518
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x984/0xb20 net/ipv6/ip6_output.c:117
 __ip6_finish_output+0x2f1/0x320 net/ipv6/ip6_output.c:143
 ip6_finish_output+0x39/0x160 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x10e/0x210 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:443 [inline]
 ip6_local_out+0x60/0x80 net/ipv6/output_core.c:179
 ip6_send_skb net/ipv6/ip6_output.c:1865 [inline]
 ip6_push_pending_frames+0xb6/0x170 net/ipv6/ip6_output.c:1885
 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
 rawv6_sendmsg+0x1283/0x1320 net/ipv6/raw.c:956
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:817
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0x352/0x4c0 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmmsg+0x335/0x4b0 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2523
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25999 Comm: syz-executor.1 Not tainted 5.10.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/10/29 01:56 upstream ed8780e3f2ec f24824d3 .config console log report info ci2-upstream-kcsan-gce
2020/10/22 17:07 upstream f804b3159482 be6b1582 .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.