KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish

Status: auto-closed as invalid on 2020/04/14 05:00
Subsystems: bridge
[Documentation on labels]
First crash: 2459d, last: 2380d
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (4) bridge 6 3 2087d 2068d 0/29 auto-closed as invalid on 2020/12/27 17:42
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (3) bridge 6 11 2138d 2223d 0/29 auto-closed as invalid on 2020/11/07 07:33
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (7) bridge 6 92 1110d 1548d 0/29 auto-obsoleted due to no activity on 2023/09/01 04:22
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (5) bridge 6 2 1995d 2027d 0/29 auto-closed as invalid on 2021/03/30 00:44
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (8) bridge 6 1 1059d 1058d 25/29 fixed on 2023/12/21 01:43
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (2) bridge 6 1 2255d 2255d 0/29 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish (6) bridge 6 7 1612d 1734d 0/29 auto-closed as invalid on 2022/04/16 22:53

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_handle_frame_finish / br_handle_frame_finish

write to 0xffff888121b54148 of 8 bytes by interrupt on cpu 0:
 br_handle_frame_finish+0x7bf/0xa90 net/bridge/br_input.c:142
 br_nf_hook_thresh+0x1f8/0x210 net/bridge/br_netfilter_hooks.c:1019
 br_nf_pre_routing_finish+0x57c/0x810 net/bridge/br_netfilter_hooks.c:422
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 br_nf_pre_routing+0x660/0xd75 net/bridge/br_netfilter_hooks.c:531
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:224 [inline]
 br_handle_frame+0x432/0x890 net/bridge/br_input.c:349
 __netif_receive_skb_core+0xc6d/0x1ed0 net/core/dev.c:5051
 __netif_receive_skb_one_core+0x67/0xe0 net/core/dev.c:5148
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5264
 process_backlog+0x207/0x4b0 net/core/dev.c:6095
 napi_poll net/core/dev.c:6532 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6600
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

read to 0xffff888121b54148 of 8 bytes by interrupt on cpu 1:
 br_handle_frame_finish+0x7ac/0xa90 net/bridge/br_input.c:142
 br_nf_hook_thresh+0x1f8/0x210 net/bridge/br_netfilter_hooks.c:1019
 br_nf_pre_routing_finish_ipv6+0x3cb/0x520 net/bridge/br_netfilter_ipv6.c:206
 NF_HOOK include/linux/netfilter.h:307 [inline]
 br_nf_pre_routing_ipv6+0x23a/0x340 net/bridge/br_netfilter_ipv6.c:236
 br_nf_pre_routing+0xaf8/0xd75 net/bridge/br_netfilter_hooks.c:505
 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:224 [inline]
 br_handle_frame+0x432/0x890 net/bridge/br_input.c:349
 __netif_receive_skb_core+0xc6d/0x1ed0 net/core/dev.c:5051
 __netif_receive_skb_one_core+0x67/0xe0 net/core/dev.c:5148
 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5264
 process_backlog+0x207/0x4b0 net/core/dev.c:6095
 napi_poll net/core/dev.c:6532 [inline]
 net_rx_action+0x3ae/0xa90 net/core/dev.c:6600
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 run_ksoftirqd+0x46/0x60 kernel/softirq.c:603
 smpboot_thread_fn+0x37d/0x4a0 kernel/smpboot.c:165
 kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/04 05:00 https://github.com/google/ktsan.git kcsan 245a43005292 93e5e335 .config console log report ci2-upstream-kcsan-gce
2019/11/30 08:39 https://github.com/google/ktsan.git kcsan ef798c30ba4e 3a75be00 .config console log report ci2-upstream-kcsan-gce
2019/11/16 10:03 https://github.com/google/ktsan.git kcsan 5863cc791e4c cdac920b .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.