syzbot


KCSAN: data-race in wg_xmit / wg_xmit (3)

Status: auto-closed as invalid on 2022/09/06 05:24
Subsystems: wireguard
[Documentation on labels]
First crash: 647d, last: 647d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in wg_xmit / wg_xmit (2) wireguard 1 1208d 1208d 0/26 auto-closed as invalid on 2021/02/22 13:14
upstream KCSAN: data-race in wg_xmit / wg_xmit (4) wireguard 1 182d 177d 25/26 fixed on 2024/01/22 01:16
upstream KCSAN: data-race in wg_xmit / wg_xmit wireguard 1 1305d 1305d 0/26 auto-closed as invalid on 2020/11/17 12:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in wg_xmit / wg_xmit

read-write to 0xffff88811a8fa158 of 8 bytes by interrupt on cpu 0:
 wg_xmit+0x626/0x6b0 drivers/net/wireguard/device.c:229
 __netdev_start_xmit include/linux/netdevice.h:4805 [inline]
 netdev_start_xmit include/linux/netdevice.h:4819 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3590
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606
 __dev_queue_xmit+0x84c/0xfe0 net/core/dev.c:4255
 dev_queue_xmit include/linux/netdevice.h:2994 [inline]
 tipc_l2_send_msg+0x1b1/0x1d0 net/tipc/bearer.c:514
 tipc_bearer_xmit_skb+0x18a/0x1e0 net/tipc/bearer.c:560
 tipc_disc_timeout+0x3ff/0x430 net/tipc/discover.c:335
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
 expire_timers+0x116/0x240 kernel/time/timer.c:1519
 __run_timers+0x350/0x400 kernel/time/timer.c:1790
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
 __do_softirq+0x158/0x2e3 kernel/softirq.c:571
 __irq_exit_rcu kernel/softirq.c:650 [inline]
 irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x16/0x20
 kcsan_setup_watchpoint+0x3e9/0x3f0 kernel/kcsan/core.c:694
 folio_test_anon include/linux/page-flags.h:665 [inline]
 PageAnon include/linux/page-flags.h:670 [inline]
 zap_pte_range+0x4bc/0x1560 mm/memory.c:1436
 zap_pmd_range mm/memory.c:1567 [inline]
 zap_pud_range mm/memory.c:1596 [inline]
 zap_p4d_range mm/memory.c:1617 [inline]
 unmap_page_range+0x3ac/0x730 mm/memory.c:1638
 unmap_single_vma+0x157/0x230 mm/memory.c:1686
 unmap_vmas+0xdf/0x1a0 mm/memory.c:1723
 exit_mmap+0x11f/0x380 mm/mmap.c:3162
 __mmput+0x27/0x1b0 kernel/fork.c:1187
 mmput+0x3d/0x50 kernel/fork.c:1208
 exit_mm+0xdb/0x170 kernel/exit.c:510
 do_exit+0x518/0x1720 kernel/exit.c:782
 __x64_sys_exit_group+0x0/0x20 kernel/exit.c:925
 __do_sys_exit_group kernel/exit.c:936 [inline]
 __se_sys_exit_group kernel/exit.c:934 [inline]
 __x64_sys_exit_group+0x1b/0x20 kernel/exit.c:934
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read-write to 0xffff88811a8fa158 of 8 bytes by interrupt on cpu 1:
 wg_xmit+0x626/0x6b0 drivers/net/wireguard/device.c:229
 __netdev_start_xmit include/linux/netdevice.h:4805 [inline]
 netdev_start_xmit include/linux/netdevice.h:4819 [inline]
 xmit_one+0xc0/0x2a0 net/core/dev.c:3590
 dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3606
 __dev_queue_xmit+0x84c/0xfe0 net/core/dev.c:4255
 dev_queue_xmit include/linux/netdevice.h:2994 [inline]
 tipc_l2_send_msg+0x1b1/0x1d0 net/tipc/bearer.c:514
 tipc_bearer_xmit_skb+0x18a/0x1e0 net/tipc/bearer.c:560
 tipc_disc_timeout+0x3ff/0x430 net/tipc/discover.c:335
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1474
 expire_timers+0x116/0x240 kernel/time/timer.c:1519
 __run_timers+0x350/0x400 kernel/time/timer.c:1790
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1803
 __do_softirq+0x158/0x2e3 kernel/softirq.c:571
 __irq_exit_rcu kernel/softirq.c:650 [inline]
 irq_exit_rcu+0x41/0x70 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x8d/0xb0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x16/0x20
 is_atomic kernel/kcsan/core.c:262 [inline]
 should_watch kernel/kcsan/core.c:275 [inline]
 check_access kernel/kcsan/core.c:741 [inline]
 __tsan_read1+0x132/0x180 kernel/kcsan/core.c:1011
 path_init+0x6d/0x950 fs/namei.c:2371
 path_parentat fs/namei.c:2539 [inline]
 filename_parentat+0x118/0x390 fs/namei.c:2563
 do_unlinkat+0x9d/0x510 fs/namei.c:4231
 __do_sys_unlink fs/namei.c:4308 [inline]
 __se_sys_unlink fs/namei.c:4306 [inline]
 __x64_sys_unlink+0x2c/0x30 fs/namei.c:4306
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x00000000000002cb -> 0x00000000000002cc

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 1441 Comm: udevd Not tainted 5.19.0-syzkaller-00428-g9de1f9c8ca51-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/02 05:24 upstream 9de1f9c8ca51 fef302b1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in wg_xmit / wg_xmit
* Struck through repros no longer work on HEAD.