KCSAN: data-race in prandom_seed / prandom_u32

23 views
Skip to first unread message

syzbot

unread,
Mar 30, 2021, 11:56:21 PM3/30/21
to syzkaller-upst...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 2bb25b3a Merge tag 'mips-fixes_5.12_3' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1476e611d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=8d3029d8441055c8
dashboard link: https://syzkaller.appspot.com/bug?extid=2d36aedecb5ce6dc3c93
compiler: Debian clang version 11.0.1-2
CC: [Ja...@zx2c4.com da...@davemloft.net ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org wire...@lists.zx2c4.com]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2d36ae...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in prandom_seed / prandom_u32

write to 0xffff88813bc28510 of 8 bytes by task 5 on cpu 0:
siprand_u32 lib/random32.c:372 [inline]
prandom_u32+0x104/0x1f0 lib/random32.c:387
prandom_u32_max include/linux/prandom.h:96 [inline]
wg_timers_data_sent+0x46/0x100 drivers/net/wireguard/timers.c:150
wg_packet_create_data_done drivers/net/wireguard/send.c:257 [inline]
wg_packet_tx_worker+0x1b4/0x360 drivers/net/wireguard/send.c:276
process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
worker_thread+0x616/0xa70 kernel/workqueue.c:2421
kthread+0x20b/0x230 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

read to 0xffff88813bc28510 of 8 bytes by task 19 on cpu 1:
prandom_seed+0xf5/0x270 lib/random32.c:441
addrconf_dad_begin net/ipv6/addrconf.c:3939 [inline]
addrconf_dad_work+0x258/0x1160 net/ipv6/addrconf.c:4064
process_one_work+0x3e1/0x950 kernel/workqueue.c:2275
worker_thread+0x616/0xa70 kernel/workqueue.c:2421
kthread+0x20b/0x230 kernel/kthread.c:292
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19 Comm: kworker/1:0 Not tainted 5.12.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
==================================================================
Bluetooth: hci1: command 0x041b tx timeout
Bluetooth: hci0: command 0x040f tx timeout


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
May 18, 2022, 3:48:23 PM5/18/22
to syzkaller-upst...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: ef1302160bfb Merge tag 'sound-5.18' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1637de7ef00000
kernel config: https://syzkaller.appspot.com/x/.config?x=83a97198b5da3a53
dashboard link: https://syzkaller.appspot.com/bug?extid=2d36aedecb5ce6dc3c93
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17f5a1c9f00000
CC: [da...@davemloft.net dsa...@kernel.org edum...@google.com ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org pab...@redhat.com yosh...@linux-ipv6.org]

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2d36ae...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in prandom_seed / prandom_u32

write to 0xffff888237c28850 of 8 bytes by task 34 on cpu 0:
siprand_u32 lib/random32.c:372 [inline]
prandom_u32+0x11f/0x190 lib/random32.c:387
mld_ifc_start_work net/ipv6/mcast.c:1071 [inline]
mld_ifc_work+0x6dd/0x800 net/ipv6/mcast.c:2656
process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
worker_thread+0x618/0xa70 kernel/workqueue.c:2436
kthread+0x1a9/0x1e0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30

read to 0xffff888237c28850 of 8 bytes by task 1914 on cpu 1:
prandom_seed+0xd3/0x270 lib/random32.c:439
addrconf_dad_begin net/ipv6/addrconf.c:3975 [inline]
addrconf_dad_work+0x265/0xbb0 net/ipv6/addrconf.c:4100
process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
worker_thread+0x618/0xa70 kernel/workqueue.c:2436
kthread+0x1a9/0x1e0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30

value changed: 0x03399c5a4ec7427f -> 0xf8cccffa14535866

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 1914 Comm: kworker/1:7 Not tainted 5.18.0-rc7-syzkaller-00015-gef1302160bfb-dirty #0
Reply all
Reply to author
Forward
0 new messages