syzbot


KCSAN: data-race in fib6_ifup / find_match

Status: closed as invalid on 2019/11/19 14:14
Subsystems: net
[Documentation on labels]
First crash: 1640d, last: 1625d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in fib6_ifup / find_match (2) net 8 1539d 1598d 0/26 auto-closed as invalid on 2020/04/15 03:00

Sample crash report:
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
==================================================================
BUG: KCSAN: data-race in fib6_ifup / find_match

read to 0xffff8880a58a78af of 1 bytes by interrupt on cpu 0:
 find_match+0x52/0x790 net/ipv6/route.c:740
 __find_rr_leaf+0xe3/0x780 net/ipv6/route.c:831
 find_rr_leaf net/ipv6/route.c:852 [inline]
 rt6_select net/ipv6/route.c:896 [inline]
 fib6_table_lookup+0x383/0x650 net/ipv6/route.c:2164
 ip6_pol_route+0xee/0x5c0 net/ipv6/route.c:2200
 ip6_pol_route_input+0x4d/0x70 net/ipv6/route.c:2258
 fib6_rule_lookup+0x95/0x470 net/ipv6/fib6_rules.c:113
 ip6_route_input_lookup+0x9f/0xc0 net/ipv6/route.c:2270
 ip6_route_input+0x41e/0x4b0 net/ipv6/route.c:2442
 ip6_rcv_finish_core.isra.0+0x97/0x1f0 net/ipv6/ip6_input.c:63
 ip6_rcv_finish+0xee/0x140 net/ipv6/ip6_input.c:74
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ipv6_rcv+0x1a1/0x1b0 net/ipv6/ip6_input.c:284
 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:4929
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5043
 process_backlog+0x207/0x4b0 net/core/dev.c:5874
 napi_poll net/core/dev.c:6311 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6379
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

write to 0xffff8880a58a78af of 1 bytes by task 6423 on cpu 1:
 fib6_ifup+0xd7/0x100 net/ipv6/route.c:4588
 fib6_clean_node+0x194/0x310 net/ipv6/ip6_fib.c:2077
 fib6_walk_continue+0x2e3/0x440 net/ipv6/ip6_fib.c:2002
 fib6_walk+0x10d/0x160 net/ipv6/ip6_fib.c:2050
 fib6_clean_tree+0xef/0x120 net/ipv6/ip6_fib.c:2130
 __fib6_clean_all+0xbd/0x150 net/ipv6/ip6_fib.c:2146
 fib6_clean_all+0x34/0x50 net/ipv6/ip6_fib.c:2157
 rt6_sync_up+0x9f/0x110 net/ipv6/route.c:4608
 addrconf_notify+0x111f/0x1480 net/ipv6/addrconf.c:3567
 notifier_call_chain+0xd7/0x160 kernel/notifier.c:95
 __raw_notifier_call_chain kernel/notifier.c:396 [inline]
 raw_notifier_call_chain+0x37/0x50 kernel/notifier.c:403
 call_netdevice_notifiers_info+0x48/0xc0 net/core/dev.c:1668
 netdev_state_change net/core/dev.c:1271 [inline]
 netdev_state_change+0xb2/0xd0 net/core/dev.c:1264
 do_setlink+0x1c71/0x1e30 net/core/rtnetlink.c:2716
 rtnl_group_changelink net/core/rtnetlink.c:2979 [inline]
 __rtnl_newlink+0xa76/0x1010 net/core/rtnetlink.c:3135
 rtnl_newlink+0x63/0x90 net/core/rtnetlink.c:3255
 rtnetlink_rcv_msg+0x1d3/0x500 net/core/rtnetlink.c:5224
 netlink_rcv_skb+0xb0/0x260 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x26/0x30 net/core/rtnetlink.c:5242
 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
 netlink_unicast+0x354/0x430 net/netlink/af_netlink.c:1328
 netlink_sendmsg+0x456/0x770 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0x9f/0xc0 net/socket.c:657
 ___sys_sendmsg+0x59d/0x5d0 net/socket.c:2311
 __sys_sendmsg+0xa0/0x160 net/socket.c:2356
 __do_sys_sendmsg net/socket.c:2365 [inline]
 __se_sys_sendmsg net/socket.c:2363 [inline]
 __x64_sys_sendmsg+0x51/0x70 net/socket.c:2363
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 6423 Comm: syz-executor.5 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/10 12:03 https://github.com/google/ktsan.git kcsan 94c006602e13 dc438b91 .config console log report ci2-upstream-kcsan-gce
2019/11/08 06:23 https://github.com/google/ktsan.git kcsan 94c006602e13 f39aff9e .config console log report ci2-upstream-kcsan-gce
2019/10/26 13:56 https://github.com/google/ktsan.git kcsan 05f2236801fe 25bb509e .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.