syzbot


KCSAN: data-race in ieee80211_rx_handlers / ieee80211_sta_last_active

Status: auto-closed as invalid on 2021/02/14 13:07
Subsystems: wireless
[Documentation on labels]
First crash: 1190d, last: 1173d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ieee80211_rx_handlers / ieee80211_sta_last_active (2) wireless 1 1099d 1099d 0/26 auto-closed as invalid on 2021/04/29 16:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ieee80211_rx_handlers / ieee80211_sta_last_active

write to 0xffff88812bbe7220 of 8 bytes by interrupt on cpu 0:
 ieee80211_rx_h_sta_process net/mac80211/rx.c:1741 [inline]
 ieee80211_rx_handlers+0x67d/0x7030 net/mac80211/rx.c:3770
 ieee80211_invoke_rx_handlers net/mac80211/rx.c:3823 [inline]
 ieee80211_prepare_and_rx_handle+0x19e5/0x2f40 net/mac80211/rx.c:4503
 __ieee80211_rx_handle_packet net/mac80211/rx.c:4626 [inline]
 ieee80211_rx_list+0x1398/0x14a0 net/mac80211/rx.c:4744
 ieee80211_rx_napi+0x4f/0x130 net/mac80211/rx.c:4767
 ieee80211_rx include/net/mac80211.h:4507 [inline]
 ieee80211_tasklet_handler+0xef/0x140 net/mac80211/main.c:235
 tasklet_action_common+0x81/0xa0 kernel/softirq.c:555
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 sysvec_apic_timer_interrupt+0x74/0x90 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
 check_kcov_mode kernel/kcov.c:163 [inline]
 __sanitizer_cov_trace_pc+0x2d/0x60 kernel/kcov.c:197
 __find_vmap_area mm/vmalloc.c:507 [inline]
 remove_vm_area+0x95/0x160 mm/vmalloc.c:2180
 vm_remove_mappings mm/vmalloc.c:2215 [inline]
 __vunmap+0x165/0x6d0 mm/vmalloc.c:2277
 __vfree mm/vmalloc.c:2333 [inline]
 vfree+0x5d/0xd0 mm/vmalloc.c:2364
 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:867 [inline]
 get_entries net/ipv4/netfilter/ip_tables.c:1023 [inline]
 do_ipt_get_ctl+0xd78/0xe60 net/ipv4/netfilter/ip_tables.c:1660
 nf_getsockopt+0x18f/0x1b0 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0xf8d/0x1200 net/ipv4/ip_sockglue.c:1777
 tcp_getsockopt+0x13f/0x15d0 net/ipv4/tcp.c:4141
 sock_common_getsockopt+0x53/0x60 net/core/sock.c:3222
 __sys_getsockopt+0x1ed/0x340 net/socket.c:2156
 __do_sys_getsockopt net/socket.c:2171 [inline]
 __se_sys_getsockopt net/socket.c:2168 [inline]
 __x64_sys_getsockopt+0x62/0x70 net/socket.c:2168
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88812bbe7220 of 8 bytes by task 1966 on cpu 1:
 ieee80211_sta_last_active+0x171/0x1b0 net/mac80211/sta_info.c:2546
 ieee80211_sta_active_ibss net/mac80211/ibss.c:664 [inline]
 ieee80211_sta_merge_ibss net/mac80211/ibss.c:1311 [inline]
 ieee80211_ibss_work+0x518/0xd90 net/mac80211/ibss.c:1711
 ieee80211_iface_work+0x628/0x670 net/mac80211/iface.c:1445
 process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
 worker_thread+0x635/0xb90 kernel/workqueue.c:2421
 kthread+0x1fd/0x220 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 1966 Comm: kworker/u4:3 Not tainted 5.11.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy9 ieee80211_iface_work
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/10 12:58 upstream 2ff90100ace8 2c1f2513 .config console log report info ci2-upstream-kcsan-gce
2021/01/03 18:54 upstream 3516bd729358 79264ae3 .config console log report info ci2-upstream-kcsan-gce
2020/12/24 22:12 upstream 58cf05f597b0 c2c1d1dd .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.