KCSAN: data-race in vti_rcv_cb / vti_rcv

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in vti_rcv_cb / vti_rcv_cb net				2	884d	890d	0/26	auto-closed as invalid on 2021/12/21 07:53
==================================================================
BUG: KCSAN: data-race in vti_rcv_cb / vti_rcv_cb

read-write to 0xffff888137c0a160 of 8 bytes by interrupt on cpu 0:
 vti_rcv_cb+0xa1/0x4b0 net/ipv4/ip_vti.c:111
 tunnel4_rcv_cb+0x9a/0x120 net/ipv4/tunnel4.c:124
 xfrm_rcv_cb net/xfrm/xfrm_input.c:111 [inline]
 xfrm_input+0x2c32/0x3170 net/xfrm/xfrm_input.c:752
 vti_input+0x279/0x2b0 net/ipv4/ip_vti.c:66
 vti_rcv_tunnel+0x72/0x80 net/ipv4/ip_vti.c:479
 tunnel4_rcv+0x6d/0x120 net/ipv4/tunnel4.c:103
 ip_protocol_deliver_rcu+0x25a/0x4d0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x126/0x160 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_local_deliver+0x100/0x1b0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:437 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_rcv+0x1b1/0x260 net/ipv4/ip_input.c:556
 __netif_receive_skb_one_core net/core/dev.c:5405 [inline]
 __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5519
 process_backlog+0x23f/0x3b0 net/core/dev.c:5847
 __napi_poll+0x65/0x390 net/core/dev.c:6413
 napi_poll net/core/dev.c:6480 [inline]
 net_rx_action+0x29e/0x650 net/core/dev.c:6567
 __do_softirq+0x158/0x2e3 kernel/softirq.c:558
 do_softirq+0xb1/0xf0 kernel/softirq.c:459
 __local_bh_enable_ip+0x6f/0x80 kernel/softirq.c:383
 local_bh_enable+0x1b/0x20 include/linux/bottom_half.h:33
 rcu_read_unlock_bh include/linux/rcupdate.h:764 [inline]
 ip_finish_output2+0x752/0x850 net/ipv4/ip_output.c:229
 ip_finish_output+0xf3/0x250 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:451 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 ip_send_skb+0x6e/0xe0 net/ipv4/ip_output.c:1571
 udp_send_skb+0x626/0x860 net/ipv4/udp.c:967
 udp_sendmsg+0x114b/0x1200 net/ipv4/udp.c:1254
 udpv6_sendmsg+0x7b1/0x1440
 inet6_sendmsg+0x5f/0x80 net/ipv6/af_inet6.c:652
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg net/socket.c:725 [inline]
 ____sys_sendmsg+0x38f/0x500 net/socket.c:2413
 ___sys_sendmsg net/socket.c:2467 [inline]
 __sys_sendmmsg+0x27c/0x4a0 net/socket.c:2553
 __do_sys_sendmmsg net/socket.c:2582 [inline]
 __se_sys_sendmmsg net/socket.c:2579 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2579
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read-write to 0xffff888137c0a160 of 8 bytes by interrupt on cpu 1:
 vti_rcv_cb+0xa1/0x4b0 net/ipv4/ip_vti.c:111
 tunnel4_rcv_cb+0x9a/0x120 net/ipv4/tunnel4.c:124
 xfrm_rcv_cb net/xfrm/xfrm_input.c:111 [inline]
 xfrm_input+0x2c32/0x3170 net/xfrm/xfrm_input.c:752
 vti_input+0x279/0x2b0 net/ipv4/ip_vti.c:66
 vti_rcv_tunnel+0x72/0x80 net/ipv4/ip_vti.c:479
 tunnel4_rcv+0x6d/0x120 net/ipv4/tunnel4.c:103
 ip_protocol_deliver_rcu+0x25a/0x4d0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x126/0x160 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_local_deliver+0x100/0x1b0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:461 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:437 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 ip_rcv+0x1b1/0x260 net/ipv4/ip_input.c:556
 __netif_receive_skb_one_core net/core/dev.c:5405 [inline]
 __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5519
 process_backlog+0x23f/0x3b0 net/core/dev.c:5847
 __napi_poll+0x65/0x390 net/core/dev.c:6413
 napi_poll net/core/dev.c:6480 [inline]
 net_rx_action+0x29e/0x650 net/core/dev.c:6567
 __do_softirq+0x158/0x2e3 kernel/softirq.c:558
 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:921
 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

value changed: 0x000000000000a9aa -> 0x000000000000a9ab

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.18.0-rc6-syzkaller-00007-g9be9ed2612b5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================