syzbot


KCSAN: data-race in pcpu_alloc / pcpu_free_area

Status: closed as invalid on 2019/10/15 15:50
Subsystems: netfilter
[Documentation on labels]
First crash: 1896d, last: 1887d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in pcpu_alloc / pcpu_free_area (2) netfilter 574 1284d 1862d 0/28 closed as invalid on 2021/06/07 13:54
upstream KCSAN: data-race in pcpu_alloc / pcpu_free_area (3) netfilter syz 1402 208d 1109d 0/28 moderation: reported syz repro on 2021/11/29 17:24

Sample crash report:
==================================================================
BUG: KCSAN: data-race in pcpu_alloc / pcpu_free_area

write to 0xffffffff86043740 of 4 bytes by task 7306 on cpu 1:
 pcpu_update_empty_pages mm/percpu.c:575 [inline]
 pcpu_block_update_hint_free mm/percpu.c:1012 [inline]
 pcpu_free_area+0x448/0x6a0 mm/percpu.c:1267
 free_percpu mm/percpu.c:1975 [inline]
 free_percpu+0x152/0x440 mm/percpu.c:1955
 xt_percpu_counter_free+0x82/0xa0 net/netfilter/x_tables.c:1862
 cleanup_entry+0x11b/0x150 net/ipv4/netfilter/ip_tables.c:655
 __do_replace+0x426/0x500 net/ipv4/netfilter/ip_tables.c:1085
 do_replace net/ipv4/netfilter/ip_tables.c:1140 [inline]
 do_ipt_set_ctl+0x26d/0x30b net/ipv4/netfilter/ip_tables.c:1672
 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
 nf_setsockopt+0x6e/0xb0 net/netfilter/nf_sockopt.c:115
 ip_setsockopt net/ipv4/ip_sockglue.c:1260 [inline]
 ip_setsockopt+0xed/0x100 net/ipv4/ip_sockglue.c:1240
 tcp_setsockopt net/ipv4/tcp.c:3146 [inline]
 tcp_setsockopt+0x7c/0xc0 net/ipv4/tcp.c:3140
 sock_common_setsockopt+0x67/0x90 net/core/sock.c:3139
 __sys_setsockopt+0x1ce/0x370 net/socket.c:2084
 __do_sys_setsockopt net/socket.c:2100 [inline]
 __se_sys_setsockopt net/socket.c:2097 [inline]
 __x64_sys_setsockopt+0x70/0x90 net/socket.c:2097
 do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffffffff86043740 of 4 bytes by task 7301 on cpu 0:
 pcpu_alloc+0x3b0/0xcf0 mm/percpu.c:1729
 __alloc_percpu+0x2e/0x40 mm/percpu.c:1796
 xt_percpu_counter_alloc+0x105/0x130 net/netfilter/x_tables.c:1842
 find_check_entry.isra.0+0x61/0x550 net/ipv4/netfilter/ip_tables.c:527
 translate_table+0x762/0xc30 net/ipv4/netfilter/ip_tables.c:717
 do_replace net/ipv4/netfilter/ip_tables.c:1136 [inline]
 do_ipt_set_ctl+0x219/0x30b net/ipv4/netfilter/ip_tables.c:1672
 nf_sockopt net/netfilter/nf_sockopt.c:106 [inline]
 nf_setsockopt+0x6e/0xb0 net/netfilter/nf_sockopt.c:115
 ip_setsockopt net/ipv4/ip_sockglue.c:1260 [inline]
 ip_setsockopt+0xed/0x100 net/ipv4/ip_sockglue.c:1240
 tcp_setsockopt net/ipv4/tcp.c:3146 [inline]
 tcp_setsockopt+0x7c/0xc0 net/ipv4/tcp.c:3140
 sock_common_setsockopt+0x67/0x90 net/core/sock.c:3139
 __sys_setsockopt+0x1ce/0x370 net/socket.c:2084
 __do_sys_setsockopt net/socket.c:2100 [inline]
 __se_sys_setsockopt net/socket.c:2097 [inline]
 __x64_sys_setsockopt+0x70/0x90 net/socket.c:2097
 do_syscall_64+0xcf/0x2f0 arch/x86/entry/common.c:296

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 7301 Comm: syz-executor.1 Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/10/13 09:13 https://github.com/google/ktsan.git kcsan d724f94f63de 2f661ec4 .config console log report ci2-upstream-kcsan-gce
2019/10/04 14:18 https://github.com/google/ktsan.git kcsan b4bd934316dc c86336cf .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.