syzbot

==================================================================
BUG: KCSAN: data-race in xfrm_lookup_with_ifid / xfrm_policy_delete

read-write to 0xffff888134a45934 of 4 bytes by interrupt on cpu 0:
 __xfrm_policy_unlink net/xfrm/xfrm_policy.c:2340 [inline]
 xfrm_policy_delete+0x1f7/0x240 net/xfrm/xfrm_policy.c:2360
 xfrm_policy_timer+0x280/0x4d0 net/xfrm/xfrm_policy.c:419
 call_timer_fn+0x3b/0x240 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x415/0x5f0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2405
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1061
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
 instrument_read_write include/linux/instrumented.h:56 [inline]
 atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1301 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:111 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:159 [inline]
 _raw_spin_lock+0x4a/0xa0 kernel/locking/spinlock.c:158
 spin_lock include/linux/spinlock.h:342 [inline]
 d_alloc_parallel+0xab/0xce0 fs/dcache.c:2679
 __lookup_slow+0x96/0x260 fs/namei.c:1900
 lookup_slow+0x3c/0x60 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x2f7/0x500 fs/namei.c:2809
 filename_lookup+0x190/0x390 fs/namei.c:2838
 vfs_statx+0x96/0x170 fs/stat.c:353
 vfs_fstatat+0x118/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat+0x55/0x3e0 fs/stat.c:532
 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:532
 x64_sys_call+0x2c64/0x3020 arch/x86/include/generated/asm/syscalls_64.h:263
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888134a45934 of 4 bytes by task 9151 on cpu 1:
 xfrm_lookup_with_ifid+0x5b4/0x1590 net/xfrm/xfrm_policy.c:3225
 xfrm_lookup+0x38/0x50 net/xfrm/xfrm_policy.c:3327
 icmpv6_route_lookup+0x10b/0x3e0 net/ipv6/icmp.c:381
 icmp6_send+0xc63/0x1100 net/ipv6/icmp.c:793
 icmpv6_param_prob_reason+0x32/0x50 net/ipv6/icmp.c:848
 ip6_tlvopt_unknown net/ipv6/exthdrs.c:94 [inline]
 ip6_parse_tlv+0xf70/0x1080 net/ipv6/exthdrs.c:-1
 ipv6_parse_hopopts+0x1e5/0x320 net/ipv6/exthdrs.c:1084
 ip6_rcv_core+0x8e9/0xab0 net/ipv6/ip6_input.c:321
 ipv6_list_rcv+0x11f/0x2a0 net/ipv6/ip6_input.c:378
 __netif_receive_skb_list_ptype net/core/dev.c:6245 [inline]
 __netif_receive_skb_list_core+0x3b0/0x500 net/core/dev.c:6292
 __netif_receive_skb_list net/core/dev.c:6344 [inline]
 netif_receive_skb_list_internal+0x47d/0x5f0 net/core/dev.c:6435
 netif_receive_skb_list+0x33/0x1c0 net/core/dev.c:6487
 xdp_recv_frames net/bpf/test_run.c:269 [inline]
 xdp_test_run_batch net/bpf/test_run.c:350 [inline]
 bpf_test_run_xdp_live+0x104c/0x1360 net/bpf/test_run.c:379
 bpf_prog_test_run_xdp+0x57b/0xa10 net/bpf/test_run.c:1430
 bpf_prog_test_run+0x204/0x340 kernel/bpf/syscall.c:4742
 __sys_bpf+0x52e/0x7e0 kernel/bpf/syscall.c:6292
 __do_sys_bpf kernel/bpf/syscall.c:6387 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6385 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6385
 x64_sys_call+0x10cb/0x3020 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9151 Comm: syz.7.9538 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================