KCSAN: data-race in do_recvmmsg / do_recvmmsg (2)

Status: fixed on 2023/07/01 16:05
Subsystems: net
[Documentation on labels]
Fix commit: e05a5f510f26 net: annotate sk->sk_err write from do_recvmmsg()
First crash: 1199d, last: 1199d
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in do_recvmmsg / do_recvmmsg net 6 1 1894d 1894d 0/29 auto-closed as invalid on 2021/06/21 21:01

Sample crash report:
==================================================================
BUG: KCSAN: data-race in do_recvmmsg / do_recvmmsg

write to 0xffff88810491b0e0 of 4 bytes by task 24891 on cpu 0:
 do_recvmmsg+0x653/0x710 net/socket.c:2912
 __sys_recvmmsg net/socket.c:2935 [inline]
 __do_sys_recvmmsg net/socket.c:2958 [inline]
 __se_sys_recvmmsg net/socket.c:2951 [inline]
 __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to 0xffff88810491b0e0 of 4 bytes by task 24875 on cpu 1:
 do_recvmmsg+0x653/0x710 net/socket.c:2912
 __sys_recvmmsg net/socket.c:2935 [inline]
 __do_sys_recvmmsg net/socket.c:2958 [inline]
 __se_sys_recvmmsg net/socket.c:2951 [inline]
 __x64_sys_recvmmsg+0xe2/0x160 net/socket.c:2951
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000 -> 0x0000005a

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 24875 Comm: syz-executor.2 Not tainted 6.3.0-rc6-syzkaller-00035-g0bcc40255504 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/04/13 00:05 upstream 0bcc40255504 82d5e53e .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in do_recvmmsg / do_recvmmsg
* Struck through repros no longer work on HEAD.