syzbot


KCSAN: data-race in dccp_rcv_reset / sock_alloc_send_pskb (3)

Status: auto-closed as invalid on 2021/01/14 23:06
Subsystems: dccp
[Documentation on labels]
First crash: 1222d, last: 1222d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in dccp_rcv_reset / sock_alloc_send_pskb dccp 5 1517d 1631d 0/26 auto-closed as invalid on 2020/04/30 04:18
upstream KCSAN: data-race in dccp_rcv_reset / sock_alloc_send_pskb (4) dccp 1 1185d 1185d 0/26 auto-closed as invalid on 2021/02/21 07:14
upstream KCSAN: data-race in dccp_rcv_reset / sock_alloc_send_pskb (2) dccp 1 1433d 1433d 0/26 closed as invalid on 2020/06/18 14:13

Sample crash report:
==================================================================
BUG: KCSAN: data-race in dccp_rcv_reset / sock_alloc_send_pskb

write to 0xffff88802b3af930 of 4 bytes by interrupt on cpu 1:
 dccp_rcv_reset+0x9b/0x190 net/dccp/input.c:149
 dccp_rcv_state_process+0x318/0xde0 net/dccp/input.c:662
 dccp_v4_do_rcv+0x8f/0xd0 net/dccp/ipv4.c:686
 sk_backlog_rcv include/net/sock.h:1010 [inline]
 __sk_receive_skb+0x229/0x550 net/core/sock.c:509
 dccp_v4_rcv+0xcbb/0xe90 net/dccp/ipv4.c:880
 ip_protocol_deliver_rcu+0x1f9/0x3e0 net/ipv4/ip_input.c:204
 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x1c0/0x280 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:449 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:428 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_rcv+0x1a6/0x250 net/ipv4/ip_input.c:539
 __netif_receive_skb_one_core net/core/dev.c:5311 [inline]
 __netif_receive_skb+0x8b/0x1b0 net/core/dev.c:5425
 process_backlog+0x23f/0x3d0 net/core/dev.c:6315
 napi_poll+0x178/0x4c0 net/core/dev.c:6759
 net_rx_action+0x17a/0x480 net/core/dev.c:6829
 __do_softirq+0x12c/0x2b1 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 do_softirq kernel/softirq.c:343 [inline]
 __local_bh_enable_ip+0xba/0xd0 kernel/softirq.c:195
 local_bh_enable+0x1b/0x20 include/linux/bottom_half.h:32
 inet_csk_listen_stop+0x1b4/0x380 net/ipv4/inet_connection_sock.c:1037
 dccp_close+0x372/0xb60 net/dccp/proto.c:993
 inet_release+0xed/0x130 net/ipv4/af_inet.c:431
 inet6_release+0x3a/0x50 net/ipv6/af_inet6.c:475
 __sock_release net/socket.c:596 [inline]
 sock_close+0x6c/0x150 net/socket.c:1277
 __fput+0x243/0x4d0 fs/file_table.c:281
 ____fput+0x11/0x20 fs/file_table.c:314
 task_work_run+0x8e/0x110 kernel/task_work.c:151
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
 exit_to_user_mode_prepare+0x13c/0x170 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x16/0x30 kernel/entry/common.c:266
 do_syscall_64+0x45/0x80 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88802b3af930 of 4 bytes by task 13957 on cpu 0:
 sock_error include/net/sock.h:2217 [inline]
 sock_alloc_send_pskb+0xe0/0x470 net/core/sock.c:2309
 sock_alloc_send_skb+0x2d/0x40 net/core/sock.c:2346
 dccp_sendmsg+0x193/0x690 net/dccp/proto.c:768
 inet_sendmsg+0x5f/0x80 net/ipv4/af_inet.c:817
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg net/socket.c:671 [inline]
 ____sys_sendmsg+0x352/0x4c0 net/socket.c:2353
 ___sys_sendmsg net/socket.c:2407 [inline]
 __sys_sendmmsg+0x335/0x4b0 net/socket.c:2497
 __do_sys_sendmmsg net/socket.c:2526 [inline]
 __se_sys_sendmmsg net/socket.c:2523 [inline]
 __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2523
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 13957 Comm: syz-executor.2 Not tainted 5.10.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/10 22:56 upstream a2f5ea9e314b 2a55c22b .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.