syzbot


KCSAN: data-race in br_set_state / maybe_deliver (2)

Status: auto-obsoleted due to no activity on 2025/06/21 18:29
Subsystems: bridge
[Documentation on labels]
First crash: 166d, last: 166d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in br_set_state / maybe_deliver bridge 6 1 2163d 2163d 0/29 closed as invalid on 2019/11/19 13:54

Sample crash report:
==================================================================
BUG: KCSAN: data-race in br_set_state / maybe_deliver

write to 0xffff888117a2f845 of 1 bytes by task 12 on cpu 0:
 br_set_state+0xdd/0x390 net/bridge/br_stp.c:45
 br_make_forwarding+0xbc/0x150 net/bridge/br_stp.c:455
 br_port_state_selection+0x113/0x330 net/bridge/br_stp.c:-1
 br_stp_enable_port+0xd4/0x110 net/bridge/br_stp_if.c:94
 br_port_carrier_check+0x200/0x230 net/bridge/br_if.c:89
 br_device_event+0x3ce/0x5f0 net/bridge/br.c:96
 notifier_call_chain kernel/notifier.c:85 [inline]
 raw_notifier_call_chain+0x6c/0x1b0 kernel/notifier.c:453
 call_netdevice_notifiers_info+0xae/0x100 net/core/dev.c:2176
 netif_state_change+0x16d/0x1f0 net/core/dev.c:1530
 linkwatch_do_dev+0xb9/0xf0 net/core/link_watch.c:186
 __linkwatch_run_queue+0x582/0x850 net/core/link_watch.c:244
 linkwatch_event+0x40/0x50 net/core/link_watch.c:304
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x486/0x510 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888117a2f845 of 1 bytes by task 3386 on cpu 1:
 should_deliver net/bridge/br_forward.c:28 [inline]
 maybe_deliver+0xaa/0x250 net/bridge/br_forward.c:182
 br_flood+0x21f/0x460 net/bridge/br_forward.c:237
 br_dev_xmit+0x97e/0xc20 net/bridge/br_device.c:-1
 __netdev_start_xmit include/linux/netdevice.h:5203 [inline]
 netdev_start_xmit include/linux/netdevice.h:5212 [inline]
 xmit_one net/core/dev.c:3776 [inline]
 dev_hard_start_xmit+0x12c/0x3d0 net/core/dev.c:3792
 __dev_queue_xmit+0x10b9/0x1fb0 net/core/dev.c:4629
 dev_queue_xmit include/linux/netdevice.h:3350 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip6_finish_output2+0xa3c/0xd30 net/ipv6/ip6_output.c:141
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x3a2/0x530 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0xfd/0x240 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:459 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 mld_sendpack+0x427/0x6e0 net/ipv6/mcast.c:1868
 mld_send_cr net/ipv6/mcast.c:2169 [inline]
 mld_ifc_work+0x55c/0x840 net/ipv6/mcast.c:2702
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x486/0x510 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x04 -> 0x03

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3386 Comm: kworker/1:3 Not tainted 6.15.0-rc3-syzkaller-00283-gf1a3944c860b #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: mld mld_ifc_work
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/26 18:24 upstream f1a3944c860b c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in br_set_state / maybe_deliver
* Struck through repros no longer work on HEAD.