[moderation] [sctp?] KCSAN: data-race in sctp_association_free / sctp_wait_for_connect (9)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c1ca10ceffbb Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17bd34f8180000
kernel config: https://syzkaller.appspot.com/x/.config?x=b4c8befe72e5ccb8
dashboard link: https://syzkaller.appspot.com/bug?extid=2751b0e8175308aacdf9
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [da...@davemloft.net edum...@google.com ku...@kernel.org linux-...@vger.kernel.org linux...@vger.kernel.org lucie...@gmail.com marcelo...@gmail.com net...@vger.kernel.org pab...@redhat.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a59d894c1c62/disk-c1ca10ce.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/91b15b8ced26/vmlinux-c1ca10ce.xz
kernel image: https://storage.googleapis.com/syzbot-assets/db4279bd95f5/bzImage-c1ca10ce.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2751b0...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in sctp_association_free / sctp_wait_for_connect

write to 0xffff8881390d0008 of 1 bytes by task 22360 on cpu 0:
sctp_association_free+0x14c/0x580 net/sctp/associola.c:336
sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:944 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1330 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]
sctp_do_sm+0x2b39/0x31c0 net/sctp/sm_sideeffect.c:1169
sctp_primitive_ABORT+0x75/0x90 net/sctp/primitive.c:104
sctp_sendmsg_check_sflags+0x199/0x1d0 net/sctp/socket.c:1780
sctp_sendmsg+0x129c/0x1900 net/sctp/socket.c:2021
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:850
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2584
___sys_sendmsg net/socket.c:2638 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2724
__do_sys_sendmmsg net/socket.c:2753 [inline]
__se_sys_sendmmsg net/socket.c:2750 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2750
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffff8881390d0008 of 1 bytes by task 22351 on cpu 1:
sctp_wait_for_connect+0x178/0x350 net/sctp/socket.c:9332
__sctp_connect+0x705/0x780 net/sctp/socket.c:1246
__sctp_setsockopt_connectx net/sctp/socket.c:1335 [inline]
sctp_setsockopt_connectx+0xc5/0x120 net/sctp/socket.c:1362
sctp_setsockopt+0x716/0xe90 net/sctp/socket.c:4621
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3716
do_sock_setsockopt net/socket.c:2311 [inline]
__sys_setsockopt+0x1d4/0x240 net/socket.c:2334
__do_sys_setsockopt net/socket.c:2343 [inline]
__se_sys_setsockopt net/socket.c:2340 [inline]
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2340
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 22351 Comm: syz-executor.1 Not tainted 6.8.0-rc4-syzkaller-00331-gc1ca10ceffbb #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup