syzbot

 sign-in | mailing list | source | docs
🐞 Open [13]
🐞 Fixed [525]
🐞 Invalid [406]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

DATA RACE in packetmmap.(*ringBuffer).init (3)

Status: fixed on 2025/05/15 22:29
Fix commit: a98032f6cc71 Add locking around ringbuffer fields and reserve in packetmmap endpoint.
First crash: 116d, last: 110d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor DATA RACE in packetmmap.(*ringBuffer).init -1 2 207d 207d 26/26 fixed on 2025/02/07 11:57
gvisor DATA RACE in packetmmap.(*ringBuffer).init (2) -1 2 206d 206d 26/26 fixed on 2025/02/08 00:18

Sample crash report:
WARNING: DATA RACE
Write at 0x00c00073401c by goroutine 555:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*ringBuffer).init()
      pkg/sentry/socket/netstack/packetmmap/ring_buffer.go:62 +0x97
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*Endpoint).Init()
      pkg/sentry/socket/netstack/packetmmap/endpoint.go:147 +0xae4
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.setSockOptPacket()
      pkg/sentry/socket/netstack/netstack.go:2974 +0x907
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:1940 +0x365
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).SetSockOpt()
      pkg/sentry/socket/netstack/netstack.go:672 +0x6a9
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.SetSockOpt()
      pkg/sentry/syscalls/linux/sys_socket.go:551 +0x46b
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2274
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x44

Previous read at 0x00c00073401c by goroutine 557:
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*ringBuffer).internalMappingsForFrame()
      pkg/sentry/socket/netstack/packetmmap/ring_buffer.go:235 +0x18c
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*ringBuffer).writeFrame()
      pkg/sentry/socket/netstack/packetmmap/ring_buffer.go:151 +0xad
  gvisor.dev/gvisor/pkg/sentry/socket/netstack/packetmmap.(*Endpoint).HandlePacket()
      pkg/sentry/socket/netstack/packetmmap/endpoint.go:288 +0xa15
  gvisor.dev/gvisor/pkg/tcpip/transport/packet.(*endpoint).HandlePacket()
      pkg/tcpip/transport/packet/endpoint.go:495 +0x161
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket.func2()
      pkg/tcpip/stack/nic.go:826 +0x391
  gvisor.dev/gvisor/pkg/tcpip/stack.(*packetEndpointList).forEach()
      pkg/tcpip/stack/nic.go:147 +0x142
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).DeliverLinkPacket()
      pkg/tcpip/stack/nic.go:841 +0x2e6
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).writeRawPacket()
      pkg/tcpip/stack/nic.go:429 +0xb0
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).writePacket()
      pkg/tcpip/stack/nic.go:414 +0x6a
  gvisor.dev/gvisor/pkg/tcpip/stack.(*nic).WritePacket()
      pkg/tcpip/stack/nic.go:375 +0x22b
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacketPostRouting()
      pkg/tcpip/network/ipv4/ipv4.go:608 +0x616
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).writePacket()
      pkg/tcpip/network/ipv4/ipv4.go:558 +0x2dd
  gvisor.dev/gvisor/pkg/tcpip/network/ipv4.(*endpoint).WritePacket()
      pkg/tcpip/network/ipv4/ipv4.go:526 +0x244
  gvisor.dev/gvisor/pkg/tcpip/stack.(*Route).WritePacket()
      pkg/tcpip/stack/route.go:507 +0x172
  gvisor.dev/gvisor/pkg/tcpip/transport/internal/network.(*WriteContext).WritePacket()
      pkg/tcpip/transport/internal/network/endpoint.go:359 +0x3ca
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).write()
      pkg/tcpip/transport/udp/endpoint.go:517 +0x593
  gvisor.dev/gvisor/pkg/tcpip/transport/udp.(*endpoint).Write()
      pkg/tcpip/transport/udp/endpoint.go:362 +0x91
  gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).Write()
      pkg/sentry/socket/netstack/netstack.go:546 +0x4e5
  gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).Write()
      pkg/sentry/vfs/file_description.go:682 +0x144
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.write()
      pkg/sentry/syscalls/linux/sys_read_write.go:347 +0xa4
  gvisor.dev/gvisor/pkg/sentry/syscalls/linux.Write()
      pkg/sentry/syscalls/linux/sys_read_write.go:316 +0x38e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).executeSyscall()
      pkg/sentry/kernel/task_syscall.go:143 +0xb9e
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallInvoke()
      pkg/sentry/kernel/task_syscall.go:323 +0x84
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscallEnter()
      pkg/sentry/kernel/task_syscall.go:283 +0xc6
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).doSyscall()
      pkg/sentry/kernel/task_syscall.go:258 +0x549
  gvisor.dev/gvisor/pkg/sentry/kernel.(*runApp).execute()
      pkg/sentry/kernel/task_run.go:269 +0x2274
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).run()
      pkg/sentry/kernel/task_run.go:97 +0x41a
  gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).Start.gowrap1()
      pkg/sentry/kernel/task_start.go:412 +0x44

Crashes (9):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/05/13 22:46 gvisor ab0097c4d068 9497799b .config console log report syz / log C ci-gvisor-systrap-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/11 04:24 gvisor e4c059533a2a 77908e5f .config console log report syz / log C ci-gvisor-ptrace-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/11 04:18 gvisor e4c059533a2a 77908e5f .config console log report syz / log C ci-gvisor-ptrace-2-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/13 22:40 gvisor ab0097c4d068 9497799b .config console log report syz / log ci-gvisor-ptrace-2-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/08 20:13 gvisor 06acafc42203 bb813bcc .config console log report syz / log ci-gvisor-systrap-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/08 20:02 gvisor 06acafc42203 bb813bcc .config console log report syz / log ci-gvisor-systrap-1-race DATA RACE in packetmmap.(*ringBuffer).init
2025/05/14 00:43 gvisor ab0097c4d068 9497799b .config console log report info ci-gvisor-ptrace-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/09 22:14 gvisor f585db6bbfc5 77908e5f .config console log report info ci-gvisor-ptrace-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
2025/05/09 12:08 gvisor f585db6bbfc5 03411e4e .config console log report info ci-gvisor-systrap-1-race-cover DATA RACE in packetmmap.(*ringBuffer).init
* Struck through repros no longer work on HEAD.