syzbot


KCSAN: data-race in __neigh_event_send / ip_finish_output2

Status: auto-closed as invalid on 2020/05/01 10:09
Subsystems: net
[Documentation on labels]
First crash: 1829d, last: 1803d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __neigh_event_send / ip_finish_output2 (2) net 2 1678d 1684d 0/28 auto-closed as invalid on 2020/07/31 03:13
upstream KCSAN: data-race in __neigh_event_send / ip_finish_output2 (3) net 1 1194d 1191d 20/28 fixed on 2022/03/08 16:11

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __neigh_event_send / ip_finish_output2

write to 0xffff8881219f3c85 of 1 bytes by interrupt on cpu 0:
 __neigh_event_send+0x188/0xa00 net/core/neighbour.c:1125
 neigh_event_send include/net/neighbour.h:444 [inline]
 neigh_resolve_output+0x385/0x4c0 net/core/neighbour.c:1471
 neigh_output include/net/neighbour.h:510 [inline]
 ip_finish_output2+0x408/0xea0 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:306 [inline]
 __ip_finish_output+0x23a/0x4b0 net/ipv4/ip_output.c:288
 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xfe/0x230 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:530
 ip_queue_xmit+0x45/0x60 include/net/ip.h:237
 __tcp_transmit_skb+0xea3/0x1df0 net/ipv4/tcp_output.c:1234
 tcp_transmit_skb net/ipv4/tcp_output.c:1250 [inline]
 __tcp_retransmit_skb+0x4c3/0x1650 net/ipv4/tcp_output.c:3049
 tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:3072
 tcp_retransmit_timer+0x77f/0x1770 net/ipv4/tcp_timer.c:528
 tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:611
 tcp_write_timer+0x176/0x1c0 net/ipv4/tcp_timer.c:631
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1405
 expire_timers kernel/time/timer.c:1450 [inline]
 __run_timers kernel/time/timer.c:1774 [inline]
 __run_timers kernel/time/timer.c:1741 [inline]
 run_timer_softirq+0xbe3/0xcb0 kernel/time/timer.c:1787
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 find_watchpoint kernel/kcsan/core.c:124 [inline]
 check_access kernel/kcsan/core.c:551 [inline]
 __tsan_unaligned_write8+0x63/0x110 kernel/kcsan/core.c:700
 do_wait+0x1f9/0x4c0 kernel/exit.c:1468
 kernel_wait4+0x156/0x240 kernel/exit.c:1617
 __do_sys_wait4+0xea/0x100 kernel/exit.c:1629
 __se_sys_wait4 kernel/exit.c:1625 [inline]
 __x64_sys_wait4+0x5e/0x80 kernel/exit.c:1625
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8881219f3c85 of 1 bytes by interrupt on cpu 1:
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0x381/0xea0 net/ipv4/ip_output.c:228
 __ip_finish_output net/ipv4/ip_output.c:306 [inline]
 __ip_finish_output+0x23a/0x4b0 net/ipv4/ip_output.c:288
 ip_finish_output+0x41/0x160 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xfe/0x230 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:436 [inline]
 ip_local_out+0x74/0x90 net/ipv4/ip_output.c:125
 __ip_queue_xmit+0x3a8/0xa40 net/ipv4/ip_output.c:530
 ip_queue_xmit+0x45/0x60 include/net/ip.h:237
 __tcp_transmit_skb+0xea3/0x1df0 net/ipv4/tcp_output.c:1234
 tcp_transmit_skb net/ipv4/tcp_output.c:1250 [inline]
 __tcp_retransmit_skb+0x4c3/0x1650 net/ipv4/tcp_output.c:3049
 tcp_retransmit_skb+0x36/0x1a0 net/ipv4/tcp_output.c:3072
 tcp_retransmit_timer+0x77f/0x1770 net/ipv4/tcp_timer.c:528
 tcp_write_timer_handler+0x42d/0x510 net/ipv4/tcp_timer.c:611
 tcp_write_timer+0x176/0x1c0 net/ipv4/tcp_timer.c:631
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1405
 expire_timers kernel/time/timer.c:1450 [inline]
 __run_timers kernel/time/timer.c:1774 [inline]
 __run_timers kernel/time/timer.c:1741 [inline]
 run_timer_softirq+0xbe3/0xcb0 kernel/time/timer.c:1787
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 wait_consider_task+0x119/0x1c60 kernel/exit.c:1358
 do_wait_thread kernel/exit.c:1374 [inline]
 do_wait+0x1c9/0x4c0 kernel/exit.c:1445
 kernel_wait4+0x156/0x240 kernel/exit.c:1617
 __do_sys_wait4+0xea/0x100 kernel/exit.c:1629
 __se_sys_wait4 kernel/exit.c:1625 [inline]
 __x64_sys_wait4+0x5e/0x80 kernel/exit.c:1625
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8079 Comm: syz-executor.5 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/21 10:04 https://github.com/google/ktsan.git kcsan b12d66a6c34f bd2a74a3 .config console log report ci2-upstream-kcsan-gce
2020/01/26 18:04 https://github.com/google/ktsan.git kcsan 245a43005292 dd56146d .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.