syzbot


KCSAN: data-race in pfifo_fast_dequeue / pfifo_fast_enqueue (2)

Status: auto-closed as invalid on 2022/01/31 12:56
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 340d, last: 340d
similar bugs (1):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in pfifo_fast_dequeue / pfifo_fast_enqueue 1 654d 654d 0/24 auto-closed as invalid on 2021/03/24 02:52

Sample crash report:
==================================================================
BUG: KCSAN: data-race in pfifo_fast_dequeue / pfifo_fast_enqueue

write to 0xffff888106234900 of 8 bytes by task 2466 on cpu 1:
 __ptr_ring_discard_one include/linux/ptr_ring.h:280 [inline]
 __ptr_ring_consume include/linux/ptr_ring.h:301 [inline]
 __skb_array_consume include/linux/skb_array.h:98 [inline]
 pfifo_fast_dequeue+0x25f/0x550 net/sched/sch_generic.c:705
 dequeue_skb+0x171/0xfb0 net/sched/sch_generic.c:292
 qdisc_restart net/sched/sch_generic.c:397 [inline]
 __qdisc_run+0x77/0x1c0 net/sched/sch_generic.c:415
 __dev_xmit_skb+0x875/0x1370 net/core/dev.c:3819
 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4262
 llc_sap_action_send_test_c+0x130/0x170 net/llc/llc_s_ac.c:144
 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]
 llc_sap_next_state net/llc/llc_sap.c:182 [inline]
 llc_sap_state_process+0x169/0x400 net/llc/llc_sap.c:209
 llc_build_and_send_test_pkt+0xb8/0xd0 net/llc/llc_sap.c:244
 llc_ui_sendmsg+0x503/0x990 net/llc/af_llc.c:964
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549
 __do_sys_sendmmsg net/socket.c:2578 [inline]
 __se_sys_sendmmsg net/socket.c:2575 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888106234900 of 8 bytes by task 2460 on cpu 0:
 __ptr_ring_produce include/linux/ptr_ring.h:106 [inline]
 ptr_ring_produce include/linux/ptr_ring.h:129 [inline]
 skb_array_produce include/linux/skb_array.h:44 [inline]
 pfifo_fast_enqueue+0xdd/0x300 net/sched/sch_generic.c:678
 dev_qdisc_enqueue net/core/dev.c:3785 [inline]
 __dev_xmit_skb+0x1a3/0x1370 net/core/dev.c:3825
 __dev_queue_xmit+0x590/0xf70 net/core/dev.c:4194
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4262
 llc_sap_action_send_test_c+0x130/0x170 net/llc/llc_s_ac.c:144
 llc_exec_sap_trans_actions net/llc/llc_sap.c:153 [inline]
 llc_sap_next_state net/llc/llc_sap.c:182 [inline]
 llc_sap_state_process+0x169/0x400 net/llc/llc_sap.c:209
 llc_build_and_send_test_pkt+0xb8/0xd0 net/llc/llc_sap.c:244
 llc_ui_sendmsg+0x503/0x990 net/llc/af_llc.c:964
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 ____sys_sendmsg+0x39a/0x510 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549
 __do_sys_sendmmsg net/socket.c:2578 [inline]
 __se_sys_sendmmsg net/socket.c:2575 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff88811a02d700 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 2460 Comm: syz-executor.3 Not tainted 5.16.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/12/27 12:53 upstream fc74e0a40e4f 5140bd58 .config log report info KCSAN: data-race in pfifo_fast_dequeue / pfifo_fast_enqueue
* Struck through repros no longer work on HEAD.