syzbot


KCSAN: data-race in pcpu_alloc / pcpu_chunk_populated (3)

Status: auto-closed as invalid on 2020/04/28 15:17
Subsystems: netfilter
[Documentation on labels]
First crash: 1588d, last: 1521d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in pcpu_alloc / pcpu_chunk_populated (2) block 1 1625d 1625d 0/26 closed as invalid on 2019/11/19 13:54
upstream KCSAN: data-race in pcpu_alloc / pcpu_chunk_populated block 1 1650d 1650d 0/26 closed as invalid on 2019/10/18 14:11
upstream KCSAN: data-race in pcpu_alloc / pcpu_chunk_populated (4) net 2 1415d 1420d 0/26 closed as invalid on 2020/06/18 14:13

Sample crash report:
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_1
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
batman_adv: batadv0: Interface activated: batadv_slave_1
==================================================================
BUG: KCSAN: data-race in pcpu_alloc / pcpu_chunk_populated

write to 0xffffffff86238180 of 4 bytes by task 8111 on cpu 0:
 pcpu_update_empty_pages mm/percpu.c:548 [inline]
 pcpu_chunk_populated+0xed/0x110 mm/percpu.c:1454
 pcpu_alloc+0x959/0xcc0 mm/percpu.c:1693
 __alloc_percpu+0x2e/0x40 mm/percpu.c:1767
 xt_percpu_counter_alloc+0x105/0x130 net/netfilter/x_tables.c:1842
 find_check_entry.isra.0+0x64/0x590 net/ipv6/netfilter/ip6_tables.c:546
 translate_table+0x7a5/0xcd0 net/ipv6/netfilter/ip6_tables.c:734
 ip6t_register_table+0xc3/0x210 net/ipv6/netfilter/ip6_tables.c:1782
 ip6table_filter_table_init.part.0+0xa4/0xd0 net/ipv6/netfilter/ip6table_filter.c:62
 ip6table_filter_table_init+0x54/0x60 net/ipv6/netfilter/ip6table_filter.c:66
 xt_find_table_lock+0x226/0x300 net/netfilter/x_tables.c:1223
 xt_request_find_table_lock+0x35/0xc0 net/netfilter/x_tables.c:1253
 get_info+0xcb/0x430 net/ipv6/netfilter/ip6_tables.c:981
 do_ip6t_get_ctl+0xbf/0x640 net/ipv6/netfilter/ip6_tables.c:1705
 nf_sockopt net/netfilter/nf_sockopt.c:104 [inline]
 nf_getsockopt+0x71/0xb0 net/netfilter/nf_sockopt.c:122
 ipv6_getsockopt net/ipv6/ipv6_sockglue.c:1400 [inline]
 ipv6_getsockopt+0x17c/0x1d0 net/ipv6/ipv6_sockglue.c:1380
 tcp_getsockopt net/ipv4/tcp.c:3699 [inline]
 tcp_getsockopt+0x7c/0xc0 net/ipv4/tcp.c:3693
 sock_common_getsockopt+0x67/0x90 net/core/sock.c:3108
 __sys_getsockopt+0xf1/0x210 net/socket.c:2175
 __do_sys_getsockopt net/socket.c:2190 [inline]
 __se_sys_getsockopt net/socket.c:2187 [inline]
 __x64_sys_getsockopt+0x70/0x90 net/socket.c:2187
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff86238180 of 4 bytes by task 8118 on cpu 1:
 pcpu_alloc+0x3b0/0xcc0 mm/percpu.c:1700
 __alloc_percpu_gfp+0x31/0x50 mm/percpu.c:1754
 fib_nh_common_init+0x58/0x1e0 net/ipv4/fib_semantics.c:579
 fib6_nh_init+0x2ca/0x1090 net/ipv6/route.c:3478
 ip6_route_info_create+0x9cd/0xe40 net/ipv6/route.c:3667
 ip6_route_add+0x30/0x110 net/ipv6/route.c:3707
 addrconf_prefix_route.isra.0+0x1e3/0x260 net/ipv6/addrconf.c:2396
 addrconf_add_linklocal+0x1ba/0x2a0 net/ipv6/addrconf.c:3192
 addrconf_addr_gen+0x1ff/0x230 net/ipv6/addrconf.c:3317
 addrconf_dev_config+0x1c0/0x280 net/ipv6/addrconf.c:3360
 addrconf_notify+0x1fa/0x1550 net/ipv6/addrconf.c:3595
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:83
 __raw_notifier_call_chain kernel/notifier.c:361 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:368
 call_netdevice_notifiers_info net/core/dev.c:1943 [inline]
 call_netdevice_notifiers_info+0x9a/0x120 net/core/dev.c:1928
 call_netdevice_notifiers_extack net/core/dev.c:1955 [inline]
 call_netdevice_notifiers net/core/dev.c:1969 [inline]
 __dev_notify_flags+0xcf/0x200 net/core/dev.c:8193
 dev_change_flags+0xb8/0xe0 net/core/dev.c:8229
 do_setlink+0x64b/0x1ee0 net/core/rtnetlink.c:2596
 __rtnl_newlink+0x956/0x10a0 net/core/rtnetlink.c:3252
 rtnl_newlink+0x63/0x90 net/core/rtnetlink.c:3377
 rtnetlink_rcv_msg+0x1d3/0x500 net/core/rtnetlink.c:5438
 netlink_rcv_skb+0xb0/0x260 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:5456
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x3a6/0x4d0 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x4d3/0x8b0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:672
 __sys_sendto+0x21f/0x320 net/socket.c:1998
 __do_sys_sendto net/socket.c:2010 [inline]
 __se_sys_sendto net/socket.c:2006 [inline]
 __x64_sys_sendto+0x89/0xb0 net/socket.c:2006
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8118 Comm: syz-executor.1 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/18 15:13 https://github.com/google/ktsan.git kcsan b12d66a6c34f 012fbc32 .config console log report ci2-upstream-kcsan-gce
2020/02/05 14:17 https://github.com/google/ktsan.git kcsan 245a43005292 662cf49a .config console log report ci2-upstream-kcsan-gce
2019/12/13 20:57 https://github.com/google/ktsan.git kcsan 245a43005292 a5c1ab05 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.