KCSAN: data-race in __neigh_event_send / ip6_finish

KCSAN: data-race in __neigh_event_send / ip6_finish_output2
Status: auto-closed as invalid on 2020/02/26 12:38
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 642d, last: 642d

similar bugs (3):
Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in __neigh_event_send / ip6_finish_output2 (4)	1	217d	217d	0/22	auto-closed as invalid on 2021/03/22 17:37
upstream	KCSAN: data-race in __neigh_event_send / ip6_finish_output2 (2)	1	379d	379d	0/22	auto-closed as invalid on 2020/10/11 09:30
upstream	KCSAN: data-race in __neigh_event_send / ip6_finish_output2 (3)	1	261d	261d	0/22	auto-closed as invalid on 2021/02/06 17:19

Sample crash report:

==================================================================
BUG: KCSAN: data-race in __neigh_event_send / ip6_finish_output2

read to 0xffff8880a6aa3e85 of 1 bytes by interrupt on cpu 0:
 neigh_output include/net/neighbour.h:508 [inline]
 ip6_finish_output2+0x476/0xf60 net/ipv6/ip6_output.c:116
 ip6_fragment+0xce0/0x1270 net/ipv6/ip6_output.c:919
 __ip6_finish_output net/ipv6/ip6_output.c:140 [inline]
 __ip6_finish_output+0x2f9/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x108/0x290 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip6_xmit+0x6cb/0xcd0 net/ipv6/ip6_output.c:279
 sctp_v6_xmit+0x1af/0x2c0 net/sctp/ipv6.c:217
 sctp_packet_transmit+0x111e/0x1800 net/sctp/output.c:629
 sctp_packet_singleton net/sctp/outqueue.c:772 [inline]
 sctp_outq_flush_ctrl.constprop.0+0x5d4/0x760 net/sctp/outqueue.c:903
 sctp_outq_flush+0xb9/0x14c0 net/sctp/outqueue.c:1185
 sctp_outq_uncork+0x64/0x80 net/sctp/outqueue.c:757
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1786 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1189 [inline]
 sctp_do_sm+0x37f/0x2f10 net/sctp/sm_sideeffect.c:1160
 sctp_generate_timeout_event+0x11c/0x1b0 net/sctp/sm_sideeffect.c:295
 sctp_generate_t1_init_event+0x27/0x30 net/sctp/sm_sideeffect.c:321
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 rest_init+0xec/0xf6 init/main.c:452
 arch_call_rest_init+0x17/0x37
 start_kernel+0x838/0x85e init/main.c:786
 x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:490
 x86_64_start_kernel+0x72/0x76 arch/x86/kernel/head64.c:471
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

write to 0xffff8880a6aa3e85 of 1 bytes by interrupt on cpu 1:
 __neigh_event_send+0x185/0x9f0 net/core/neighbour.c:1128
 neigh_event_send include/net/neighbour.h:445 [inline]
 neigh_resolve_output+0x385/0x4c0 net/core/neighbour.c:1474
 neigh_output include/net/neighbour.h:511 [inline]
 ip6_finish_output2+0x717/0xf60 net/ipv6/ip6_output.c:116
 __ip6_finish_output net/ipv6/ip6_output.c:142 [inline]
 __ip6_finish_output+0x2d7/0x330 net/ipv6/ip6_output.c:127
 ip6_finish_output+0x41/0x160 net/ipv6/ip6_output.c:152
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip6_output+0x108/0x290 net/ipv6/ip6_output.c:175
 dst_output include/net/dst.h:436 [inline]
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip6_xmit+0x6cb/0xcd0 net/ipv6/ip6_output.c:279
 sctp_v6_xmit+0x1af/0x2c0 net/sctp/ipv6.c:217
 sctp_packet_transmit+0x111e/0x1800 net/sctp/output.c:629
 sctp_packet_singleton net/sctp/outqueue.c:772 [inline]
 sctp_outq_flush_ctrl.constprop.0+0x5d4/0x760 net/sctp/outqueue.c:903
 sctp_outq_flush+0xb9/0x14c0 net/sctp/outqueue.c:1185
 sctp_outq_uncork+0x64/0x80 net/sctp/outqueue.c:757
 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1786 [inline]
 sctp_side_effects net/sctp/sm_sideeffect.c:1189 [inline]
 sctp_do_sm+0x37f/0x2f10 net/sctp/sm_sideeffect.c:1160
 sctp_generate_timeout_event+0x11c/0x1b0 net/sctp/sm_sideeffect.c:295
 sctp_generate_t1_init_event+0x27/0x30 net/sctp/sm_sideeffect.c:321
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60
 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:690
 default_idle_call+0x1e/0x40 kernel/sched/idle.c:94
 cpuidle_idle_call kernel/sched/idle.c:154 [inline]
 do_idle+0x1c2/0x290 kernel/sched/idle.c:269
 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:361
 start_secondary+0x168/0x1b0 arch/x86/kernel/smpboot.c:264
 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:242

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-upstream-kcsan-gce	2019/12/18 12:37	https://github.com/google/ktsan.git kcsan	245a43005292	64ca0a37	.config	log	report