syzbot


KCSAN: data-race in __dev_change_flags / ip_route_output_key_hash_rcu (2)

Status: auto-obsoleted due to no activity on 2025/05/01 20:25
Subsystems: net
[Documentation on labels]
First crash: 168d, last: 168d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __dev_change_flags / ip_route_output_key_hash_rcu net 6 1 863d 863d 0/29 auto-obsoleted due to no activity on 2023/05/23 08:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __dev_change_flags / ip_route_output_key_hash_rcu

read to 0xffff88811915f0b0 of 4 bytes by task 7947 on cpu 1:
 ip_route_output_key_hash_rcu+0x184/0x12e0 net/ipv4/route.c:2760
 ip_route_output_key_hash net/ipv4/route.c:2683 [inline]
 __ip_route_output_key include/net/route.h:169 [inline]
 ip_route_output_flow+0x76/0x120 net/ipv4/route.c:2911
 raw_sendmsg+0x9e1/0xe70 net/ipv4/raw.c:628
 inet_sendmsg+0xc5/0xd0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0x102/0x180 net/socket.c:733
 ____sys_sendmsg+0x326/0x4b0 net/socket.c:2573
 ___sys_sendmsg net/socket.c:2627 [inline]
 __sys_sendmmsg+0x227/0x4b0 net/socket.c:2716
 __do_sys_sendmmsg net/socket.c:2743 [inline]
 __se_sys_sendmmsg net/socket.c:2740 [inline]
 __x64_sys_sendmmsg+0x57/0x70 net/socket.c:2740
 x64_sys_call+0x29aa/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:308
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read-write to 0xffff88811915f0b0 of 4 bytes by task 7949 on cpu 0:
 __dev_change_flags+0x9a/0x410 net/core/dev.c:9228
 dev_change_flags+0x59/0xd0 net/core/dev.c:9326
 do_setlink+0x7a1/0x2370 net/core/rtnetlink.c:3118
 rtnl_group_changelink net/core/rtnetlink.c:3747 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3894 [inline]
 rtnl_newlink+0xcf9/0x1250 net/core/rtnetlink.c:4022
 rtnetlink_rcv_msg+0x651/0x710 net/core/rtnetlink.c:6912
 netlink_rcv_skb+0x12c/0x230 net/netlink/af_netlink.c:2533
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:6939
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x599/0x670 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x5cc/0x6e0 net/netlink/af_netlink.c:1882
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg+0x140/0x180 net/socket.c:733
 ____sys_sendmsg+0x326/0x4b0 net/socket.c:2573
 ___sys_sendmsg net/socket.c:2627 [inline]
 __sys_sendmsg+0x19d/0x230 net/socket.c:2659
 __do_sys_sendmsg net/socket.c:2664 [inline]
 __se_sys_sendmsg net/socket.c:2662 [inline]
 __x64_sys_sendmsg+0x46/0x50 net/socket.c:2662
 x64_sys_call+0x2734/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 7949 Comm: syz.5.1655 Not tainted 6.14.0-rc5-syzkaller-00039-g848e07631744 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================
bridge0: port 2(bridge_slave_1) entered disabled state
bridge0: port 1(bridge_slave_0) entered disabled state
0ĒXšĻĀ: left allmulticast mode
netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
syzkaller0: left allmulticast mode

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/06 20:20 upstream 848e07631744 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __dev_change_flags / ip_route_output_key_hash_rcu
* Struck through repros no longer work on HEAD.