==================================================================
BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit

write to 0xffff8881315c11b8 of 8 bytes by task 25341 on cpu 1:
 ip_tunnel_xmit+0x5ea/0x1220 net/ipv4/ip_tunnel.c:749
 ipip_tunnel_xmit+0x266/0x2d0 net/ipv4/ipip.c:307
 __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
 netdev_start_xmit include/linux/netdevice.h:4697 [inline]
 xmit_one+0x105/0x2f0 net/core/dev.c:3473
 dev_hard_start_xmit net/core/dev.c:3489 [inline]
 __dev_queue_xmit+0x86d/0xfa0 net/core/dev.c:4116
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4149
 neigh_connected_output+0x264/0x2a0 net/core/neighbour.c:1557
 neigh_output include/net/neighbour.h:549 [inline]
 ip_finish_output2+0x741/0xb70 net/ipv4/ip_output.c:228
 ip_finish_output+0xfb/0x240 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:451 [inline]
 ip_local_out+0x60/0x80 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x349/0x4f0 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0xf86/0x1220 net/ipv4/ip_tunnel.c:810
 __gre_xmit net/ipv4/ip_gre.c:471 [inline]
 ipgre_xmit+0x555/0x5a0 net/ipv4/ip_gre.c:659
 __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
 netdev_start_xmit include/linux/netdevice.h:4697 [inline]
 xmit_one+0x105/0x2f0 net/core/dev.c:3473
 dev_hard_start_xmit net/core/dev.c:3489 [inline]
 __dev_queue_xmit+0x86d/0xfa0 net/core/dev.c:4116
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4149
 __bpf_tx_skb net/core/filter.c:2113 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2138 [inline]
 __bpf_redirect+0x5a9/0x850 net/core/filter.c:2161
 ____bpf_clone_redirect net/core/filter.c:2428 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2400
 ___bpf_prog_run+0xc87/0x30c0 kernel/bpf/core.c:1558
 __bpf_prog_run512+0x70/0xa0 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline]
 __bpf_prog_run include/linux/filter.h:626 [inline]
 bpf_prog_run include/linux/filter.h:633 [inline]
 bpf_test_run+0x18b/0x400 net/bpf/test_run.c:120
 bpf_prog_test_run_skb+0x73d/0xed0 net/bpf/test_run.c:666
 bpf_prog_test_run kernel/bpf/syscall.c:3353 [inline]
 __sys_bpf+0x3caa/0xa3c0 kernel/bpf/syscall.c:4655
 __do_sys_bpf kernel/bpf/syscall.c:4741 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4739 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4739
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff8881315c11b8 of 8 bytes by task 25356 on cpu 0:
 ip_tunnel_xmit+0x5d8/0x1220 net/ipv4/ip_tunnel.c:749
 ipip_tunnel_xmit+0x266/0x2d0 net/ipv4/ipip.c:307
 __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
 netdev_start_xmit include/linux/netdevice.h:4697 [inline]
 xmit_one+0x105/0x2f0 net/core/dev.c:3473
 dev_hard_start_xmit net/core/dev.c:3489 [inline]
 __dev_queue_xmit+0x86d/0xfa0 net/core/dev.c:4116
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4149
 neigh_connected_output+0x264/0x2a0 net/core/neighbour.c:1557
 neigh_output include/net/neighbour.h:549 [inline]
 ip_finish_output2+0x741/0xb70 net/ipv4/ip_output.c:228
 ip_finish_output+0xfb/0x240 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 ip_output+0xf3/0x1a0 net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:451 [inline]
 ip_local_out+0x60/0x80 net/ipv4/ip_output.c:126
 iptunnel_xmit+0x349/0x4f0 net/ipv4/ip_tunnel_core.c:82
 ip_tunnel_xmit+0xf86/0x1220 net/ipv4/ip_tunnel.c:810
 __gre_xmit net/ipv4/ip_gre.c:471 [inline]
 ipgre_xmit+0x555/0x5a0 net/ipv4/ip_gre.c:659
 __netdev_start_xmit include/linux/netdevice.h:4683 [inline]
 netdev_start_xmit include/linux/netdevice.h:4697 [inline]
 xmit_one+0x105/0x2f0 net/core/dev.c:3473
 dev_hard_start_xmit net/core/dev.c:3489 [inline]
 __dev_queue_xmit+0x86d/0xfa0 net/core/dev.c:4116
 dev_queue_xmit+0x13/0x20 net/core/dev.c:4149
 __bpf_tx_skb net/core/filter.c:2113 [inline]
 __bpf_redirect_no_mac net/core/filter.c:2138 [inline]
 __bpf_redirect+0x5a9/0x850 net/core/filter.c:2161
 ____bpf_clone_redirect net/core/filter.c:2428 [inline]
 bpf_clone_redirect+0x168/0x1c0 net/core/filter.c:2400
 ___bpf_prog_run+0xc87/0x30c0 kernel/bpf/core.c:1558
 __bpf_prog_run512+0x70/0xa0 kernel/bpf/core.c:1787
 bpf_dispatcher_nop_func include/linux/bpf.h:784 [inline]
 __bpf_prog_run include/linux/filter.h:626 [inline]
 bpf_prog_run include/linux/filter.h:633 [inline]
 bpf_test_run+0x18b/0x400 net/bpf/test_run.c:120
 bpf_prog_test_run_skb+0x73d/0xed0 net/bpf/test_run.c:666
 bpf_prog_test_run kernel/bpf/syscall.c:3353 [inline]
 __sys_bpf+0x3caa/0xa3c0 kernel/bpf/syscall.c:4655
 __do_sys_bpf kernel/bpf/syscall.c:4741 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4739 [inline]
 __x64_sys_bpf+0x3f/0x50 kernel/bpf/syscall.c:4739
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0x000000000004cbe1 -> 0x000000000004cbe2

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25356 Comm: syz-executor.3 Not tainted 5.17.0-rc6-syzkaller-00184-g38f80f42147f-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================
syz-executor.3 (25356) used greatest stack depth: 9168 bytes left