syzbot


KCSAN: data-race in br_fdb_update / br_fdb_update (3)

Status: auto-closed as invalid on 2022/01/11 04:42
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 386d, last: 361d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (5) 2 62d 68d 0/24 auto-obsoleted due to no activity on 2022/11/05 14:29
upstream KCSAN: data-race in br_fdb_update / br_fdb_update 1 933d 933d 0/24 auto-closed as invalid on 2020/06/18 13:53
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (4) 3 165d 166d 0/24 auto-closed as invalid on 2022/07/25 17:10
upstream KCSAN: data-race in br_fdb_update / br_fdb_update (2) 1 816d 816d 0/24 auto-closed as invalid on 2020/10/13 10:41

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_fdb_update / br_fdb_update

read to 0xffff888132df8bc0 of 8 bytes by interrupt on cpu 1:
 br_fdb_update+0x10d/0x540 net/bridge/br_fdb.c:723
 br_handle_frame_finish+0x1f0/0xbe0 net/bridge/br_input.c:96
 br_nf_hook_thresh+0x194/0x1d0
 br_nf_pre_routing_finish_ipv6+0x4dc/0x500
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing_ipv6+0x1ea/0x280 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0x4d1/0xb30 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:230 [inline]
 br_handle_frame+0x463/0xba0 net/bridge/br_input.c:370
 __netif_receive_skb_core+0xa4b/0x1df0 net/core/dev.c:5359
 __netif_receive_skb_one_core net/core/dev.c:5463 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5579
 process_backlog+0x23f/0x3e0 net/core/dev.c:6455
 __napi_poll+0x65/0x3f0 net/core/dev.c:7023
 napi_poll net/core/dev.c:7090 [inline]
 net_rx_action+0x29e/0x650 net/core/dev.c:7177
 __do_softirq+0x158/0x2de kernel/softirq.c:558
 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:921
 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164
 kthread+0x2c7/0x2e0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

write to 0xffff888132df8bc0 of 8 bytes by interrupt on cpu 0:
 br_fdb_update+0x14b/0x540 net/bridge/br_fdb.c:724
 br_handle_frame_finish+0x1f0/0xbe0 net/bridge/br_input.c:96
 br_nf_hook_thresh+0x194/0x1d0
 br_nf_pre_routing_finish_ipv6+0x4dc/0x500
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing_ipv6+0x1ea/0x280 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0x4d1/0xb30 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:230 [inline]
 br_handle_frame+0x463/0xba0 net/bridge/br_input.c:370
 __netif_receive_skb_core+0xa4b/0x1df0 net/core/dev.c:5359
 __netif_receive_skb_one_core net/core/dev.c:5463 [inline]
 __netif_receive_skb+0x52/0x1b0 net/core/dev.c:5579
 process_backlog+0x23f/0x3e0 net/core/dev.c:6455
 __napi_poll+0x65/0x3f0 net/core/dev.c:7023
 napi_poll net/core/dev.c:7090 [inline]
 net_rx_action+0x29e/0x650 net/core/dev.c:7177
 __do_softirq+0x158/0x2de kernel/softirq.c:558
 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:921
 smpboot_thread_fn+0x308/0x4a0 kernel/smpboot.c:164
 kthread+0x2c7/0x2e0 kernel/kthread.c:327
 ret_from_fork+0x1f/0x30

value changed: 0x00000000ffffdc97 -> 0x00000000ffffdcaa

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 12 Comm: ksoftirqd/0 Not tainted 5.16.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/12/07 04:39 upstream f80ef9e49fdf 0230ba3e .config log report info KCSAN: data-race in br_fdb_update / br_fdb_update
ci2-upstream-kcsan-gce 2021/11/12 04:00 upstream ca2ef2d9f2aa 75b04091 .config log report info KCSAN: data-race in br_fdb_update / br_fdb_update
* Struck through repros no longer work on HEAD.