syzbot


KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (7)

Status: auto-closed as invalid on 2022/06/29 00:38
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 302d, last: 192d
similar bugs (8):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (6) 32 350d 515d 0/24 auto-closed as invalid on 2022/01/21 16:19
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit 22 991d 1124d 0/24 auto-closed as invalid on 2020/05/25 22:33
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (9) 1 111d 111d 0/24 auto-closed as invalid on 2022/09/18 04:26
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (2) 11 788d 892d 0/24 auto-closed as invalid on 2020/11/10 03:04
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (5) 5 565d 530d 0/24 auto-closed as invalid on 2021/07/05 08:43
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (8) 1 153d 153d 0/24 auto-closed as invalid on 2022/08/06 22:00
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (4) 2 655d 678d 0/24 auto-closed as invalid on 2021/03/23 07:29
upstream KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit (3) 5 714d 722d 0/24 auto-closed as invalid on 2021/01/23 09:54

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit

read-write to 0xffff88813420d158 of 8 bytes by task 10140 on cpu 1:
 ip_tunnel_xmit+0x9e1/0x11c0 net/ipv4/ip_tunnel.c:820
 __gre_xmit net/ipv4/ip_gre.c:469 [inline]
 ipgre_xmit+0x525/0x570 net/ipv4/ip_gre.c:657
 __netdev_start_xmit include/linux/netdevice.h:4775 [inline]
 netdev_start_xmit include/linux/netdevice.h:4789 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3531
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3547
 __dev_queue_xmit+0x7fd/0xea0 net/core/dev.c:4174
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4207
 __bpf_tx_skb net/core/filter.c:2113 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2138 [inline]
 __bpf_redirect+0x554/0x840 net/core/filter.c:2161
 ____bpf_clone_redirect net/core/filter.c:2428 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2400
 ___bpf_prog_run+0x278/0x2d40 kernel/bpf/core.c:1835
 __bpf_prog_run448+0x70/0xa0 kernel/bpf/core.c:2064
 bpf_dispatcher_nop_func include/linux/bpf.h:804 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 bpf_test_run+0x1eb/0x410 net/bpf/test_run.c:402
 bpf_prog_test_run_skb+0x76b/0x9f0 net/bpf/test_run.c:1111
 bpf_prog_test_run+0x22a/0x250 kernel/bpf/syscall.c:3369
 __sys_bpf+0x367/0x600 kernel/bpf/syscall.c:4681
 __do_sys_bpf kernel/bpf/syscall.c:4767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4765 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4765
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

read-write to 0xffff88813420d158 of 8 bytes by task 10139 on cpu 0:
 ip_tunnel_xmit+0x9e1/0x11c0 net/ipv4/ip_tunnel.c:820
 __gre_xmit net/ipv4/ip_gre.c:469 [inline]
 ipgre_xmit+0x525/0x570 net/ipv4/ip_gre.c:657
 __netdev_start_xmit include/linux/netdevice.h:4775 [inline]
 netdev_start_xmit include/linux/netdevice.h:4789 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3531
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3547
 __dev_queue_xmit+0x7fd/0xea0 net/core/dev.c:4174
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4207
 __bpf_tx_skb net/core/filter.c:2113 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2138 [inline]
 __bpf_redirect+0x554/0x840 net/core/filter.c:2161
 ____bpf_clone_redirect net/core/filter.c:2428 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2400
 ___bpf_prog_run+0x278/0x2d40 kernel/bpf/core.c:1835
 __bpf_prog_run448+0x70/0xa0 kernel/bpf/core.c:2064
 bpf_dispatcher_nop_func include/linux/bpf.h:804 [inline]
 __bpf_prog_run include/linux/filter.h:628 [inline]
 bpf_prog_run include/linux/filter.h:635 [inline]
 bpf_test_run+0x1eb/0x410 net/bpf/test_run.c:402
 bpf_prog_test_run_skb+0x76b/0x9f0 net/bpf/test_run.c:1111
 bpf_prog_test_run+0x22a/0x250 kernel/bpf/syscall.c:3369
 __sys_bpf+0x367/0x600 kernel/bpf/syscall.c:4681
 __do_sys_bpf kernel/bpf/syscall.c:4767 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4765 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4765
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x46/0xb0

value changed: 0x0000000000006b40 -> 0x0000000000006b41

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 10139 Comm: syz-executor.4 Not tainted 5.18.0-syzkaller-01444-g0350785b0a09-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (10):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/05/25 00:38 upstream 0350785b0a09 647c0e27 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/05/15 23:44 upstream bc403203d65a 744a39e2 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/05/04 08:26 upstream 107c948d1d3e dc9e5259 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/04/09 17:09 upstream f1b45d8ccb98 e22c3da3 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/03/21 08:36 upstream f443e374ae13 e2d91b1d .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/03/11 09:00 upstream 79b00034e9dc 9e8eaa75 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/03/04 17:39 upstream 38f80f42147f 45a13a73 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/02/22 15:37 upstream 038101e6b2cd 6e821dbf .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/02/08 11:09 upstream 555f3d7be91a a7dab638 .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
ci2-upstream-kcsan-gce 2022/02/03 23:58 upstream c36c04c2e132 30646bfe .config log report info KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit
* Struck through repros no longer work on HEAD.