[moderation] [fs?] KCSAN: data-race in pollwake / pollwake (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 626737a5791b Merge tag 'pinctrl-v6.10-2' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14408fb1980000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e87b541dc1fc960
dashboard link: https://syzkaller.appspot.com/bug?extid=4c7af974f816af4ede2a
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [bra...@kernel.org ja...@suse.cz linux-...@vger.kernel.org linux-...@vger.kernel.org vi...@zeniv.linux.org.uk]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ee4c67adef4f/disk-626737a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/124b0d3318d3/vmlinux-626737a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8acf9961638a/bzImage-626737a5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4c7af9...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in pollwake / pollwake

write to 0xffffc9000122ba00 of 4 bytes by interrupt on cpu 1:
__pollwake fs/select.c:198 [inline]
pollwake+0xbe/0x110 fs/select.c:218
__wake_up_common kernel/sched/wait.c:89 [inline]
__wake_up_common_lock kernel/sched/wait.c:106 [inline]
__wake_up+0x65/0xb0 kernel/sched/wait.c:127
bpf_ringbuf_notify+0x22/0x30 kernel/bpf/ringbuf.c:152
irq_work_single kernel/irq_work.c:221 [inline]
irq_work_run_list kernel/irq_work.c:252 [inline]
irq_work_run+0xdf/0x2c0 kernel/irq_work.c:261
__sysvec_irq_work+0x23/0x1a0 arch/x86/kernel/irq_work.c:22
instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline]
sysvec_irq_work+0x66/0x80 arch/x86/kernel/irq_work.c:17
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:738
native_apic_mem_write arch/x86/include/asm/apic.h:96 [inline]
__default_send_IPI_shortcut arch/x86/kernel/apic/ipi.c:166 [inline]
default_send_IPI_self+0x38/0x80 arch/x86/kernel/apic/ipi.c:247
__apic_send_IPI_self arch/x86/include/asm/apic.h:460 [inline]
arch_irq_work_raise+0x48/0x50 arch/x86/kernel/irq_work.c:31
irq_work_raise kernel/irq_work.c:84 [inline]
__irq_work_queue_local+0x82/0x1d0 kernel/irq_work.c:112
irq_work_queue+0x85/0x120 kernel/irq_work.c:124
____bpf_ringbuf_discard kernel/bpf/ringbuf.c:513 [inline]
bpf_ringbuf_discard+0xcd/0xf0 kernel/bpf/ringbuf.c:511
___bpf_prog_run+0x9ab/0x46c0 kernel/bpf/core.c:2012
__bpf_prog_run32+0x74/0xa0 kernel/bpf/core.c:2253
bpf_dispatcher_nop_func include/linux/bpf.h:1243 [inline]
__bpf_prog_run include/linux/filter.h:691 [inline]
bpf_prog_run include/linux/filter.h:698 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2403 [inline]
bpf_trace_run3+0x10c/0x1d0 kernel/trace/bpf_trace.c:2445
trace_kmem_cache_free include/trace/events/kmem.h:114 [inline]
kmem_cache_free+0x1fe/0x280 mm/slub.c:4511
__kfree_skb+0x102/0x150 net/core/skbuff.c:1188
consume_skb+0x57/0x180 net/core/skbuff.c:1409
macvlan_process_broadcast+0x28c/0x310 drivers/net/macvlan.c:343
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
worker_thread+0x526/0x730 kernel/workqueue.c:3393
kthread+0x1d1/0x210 kernel/kthread.c:389
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

write to 0xffffc9000122ba00 of 4 bytes by task 2287 on cpu 0:
__pollwake fs/select.c:198 [inline]
pollwake+0xbe/0x110 fs/select.c:218
__wake_up_common kernel/sched/wait.c:89 [inline]
__wake_up_common_lock kernel/sched/wait.c:106 [inline]
__wake_up_sync_key+0x51/0x80 kernel/sched/wait.c:173
sock_def_readable+0x70/0x1b0 net/core/sock.c:3353
packet_rcv+0x8d1/0x940 net/packet/af_packet.c:2216
dev_queue_xmit_nit+0x5c2/0x620 net/core/dev.c:2343
xmit_one net/core/dev.c:3574 [inline]
dev_hard_start_xmit+0xcc/0x3f0 net/core/dev.c:3594
__dev_queue_xmit+0xf83/0x1e50 net/core/dev.c:4393
dev_queue_xmit include/linux/netdevice.h:3095 [inline]
neigh_resolve_output+0x3e3/0x450 net/core/neighbour.c:1565
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0xa73/0xd10 net/ipv6/ip6_output.c:137
ip6_finish_output+0x438/0x540 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0xf4/0x220 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:450 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ndisc_send_skb+0x4a0/0x6b0 net/ipv6/ndisc.c:509
ndisc_send_ns+0x79/0xe0 net/ipv6/ndisc.c:667
addrconf_dad_work+0x6f1/0xbd0 net/ipv6/addrconf.c:4281
process_one_work kernel/workqueue.c:3231 [inline]
process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
worker_thread+0x526/0x730 kernel/workqueue.c:3393
kthread+0x1d1/0x210 kernel/kthread.c:389
ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 2287 Comm: kworker/u8:5 Not tainted 6.10.0-rc5-syzkaller-00012-g626737a5791b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: ipv6_addrconf addrconf_dad_work
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup