syzbot


KCSAN: data-race in br_fdb_update / fdb_fill_info

Status: auto-obsoleted due to no activity on 2025/01/03 08:42
Subsystems: bridge
[Documentation on labels]
First crash: 73d, last: 73d

Sample crash report:
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
==================================================================
BUG: KCSAN: data-race in br_fdb_update / fdb_fill_info

write to 0xffff888104422a40 of 8 bytes by interrupt on cpu 0:
 br_fdb_update+0x142/0x480 net/bridge/br_fdb.c:911
 br_handle_frame_finish+0x32e/0xe70 net/bridge/br_input.c:141
 br_nf_hook_thresh+0x1e5/0x220
 br_nf_pre_routing_finish_ipv6+0x575/0x5a0
 NF_HOOK include/linux/netfilter.h:314 [inline]
 br_nf_pre_routing_ipv6+0x1f6/0x2a0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x517/0xbc0 net/bridge/br_netfilter_hooks.c:533
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
 br_handle_frame+0x4dd/0x9a0 net/bridge/br_input.c:424
 __netif_receive_skb_core+0xb00/0x2310 net/core/dev.c:5564
 __netif_receive_skb_one_core net/core/dev.c:5668 [inline]
 __netif_receive_skb+0x5a/0x280 net/core/dev.c:5783
 process_backlog+0x22e/0x440 net/core/dev.c:6115
 __napi_poll+0x63/0x3c0 net/core/dev.c:6779
 napi_poll net/core/dev.c:6848 [inline]
 net_rx_action+0x3a1/0x7f0 net/core/dev.c:6970
 handle_softirqs+0xbf/0x280 kernel/softirq.c:554
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:927
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888104422a40 of 8 bytes by interrupt on cpu 1:
 has_expired net/bridge/br_fdb.c:73 [inline]
 fdb_to_nud net/bridge/br_fdb.c:90 [inline]
 fdb_fill_info+0x26d/0x7b0 net/bridge/br_fdb.c:118
 fdb_notify+0x90/0x120 net/bridge/br_fdb.c:199
 br_fdb_update+0x362/0x480 net/bridge/br_fdb.c:941
 br_handle_frame_finish+0x32e/0xe70 net/bridge/br_input.c:141
 br_nf_hook_thresh+0x1e5/0x220
 br_nf_pre_routing_finish_ipv6+0x575/0x5a0
 NF_HOOK include/linux/netfilter.h:314 [inline]
 br_nf_pre_routing_ipv6+0x1f6/0x2a0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x517/0xbc0 net/bridge/br_netfilter_hooks.c:533
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
 br_handle_frame+0x4dd/0x9a0 net/bridge/br_input.c:424
 __netif_receive_skb_core+0xb00/0x2310 net/core/dev.c:5564
 __netif_receive_skb_one_core net/core/dev.c:5668 [inline]
 __netif_receive_skb+0x5a/0x280 net/core/dev.c:5783
 process_backlog+0x22e/0x440 net/core/dev.c:6115
 __napi_poll+0x63/0x3c0 net/core/dev.c:6779
 napi_poll net/core/dev.c:6848 [inline]
 net_rx_action+0x3a1/0x7f0 net/core/dev.c:6970
 handle_softirqs+0xbf/0x280 kernel/softirq.c:554
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:927
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x00000000ffffc703 -> 0x00000000ffffc704

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 23 Comm: ksoftirqd/1 Not tainted 6.12.0-rc6-syzkaller-00169-g906bd684e4b1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
==================================================================
net_ratelimit: 23406 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
net_ratelimit: 22513 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:00:20:10:00:00:00, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/08 08:35 upstream 906bd684e4b1 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in br_fdb_update / fdb_fill_info
* Struck through repros no longer work on HEAD.