syzbot


KCSAN: data-race in data_push_tail / hex_string (4)

Status: moderation: reported on 2025/07/18 06:47
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+bc481c0f87c5cf781cf4@syzkaller.appspotmail.com
First crash: 37d, last: 21d
Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / hex_string kernel 6 1 1492d 1492d 0/29 auto-closed as invalid on 2021/08/27 18:21
upstream KCSAN: data-race in data_push_tail / hex_string (3) kernel 6 1 136d 136d 0/29 auto-obsoleted due to no activity on 2025/06/04 16:05
upstream KCSAN: data-race in data_push_tail / hex_string (2) kernel 6 1 617d 617d 0/29 auto-obsoleted due to no activity on 2024/01/19 21:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in data_push_tail / hex_string

write to 0xffffffff88e3a668 of 1 bytes by task 17267 on cpu 1:
 hex_string+0x2d9/0x330 lib/vsprintf.c:1214
 pointer+0x2d7/0xcf0 lib/vsprintf.c:2468
 vsnprintf+0x491/0x890 lib/vsprintf.c:2878
 vscnprintf+0x41/0x90 lib/vsprintf.c:2939
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2216
 vprintk_store+0x599/0x860 kernel/printk/printk.c:2336
 vprintk_emit+0x178/0x650 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 show_opcodes+0xfe/0x120 arch/x86/kernel/dumpstack.c:121
 show_iret_regs+0x12/0x40 arch/x86/kernel/dumpstack.c:147
 __show_regs+0x2a/0x440 arch/x86/kernel/process_64.c:77
 show_regs_if_on_stack arch/x86/kernel/dumpstack.c:165 [inline]
 show_trace_log_lvl+0x423/0x560 arch/x86/kernel/dumpstack.c:298
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0xe8/0x140 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x265/0x280 lib/fault-inject.c:174
 should_failslab+0x8c/0xb0 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4133 [inline]
 slab_alloc_node mm/slub.c:4209 [inline]
 __do_kmalloc_node mm/slub.c:4364 [inline]
 __kmalloc_noprof+0xa5/0x3e0 mm/slub.c:4377
 kmalloc_noprof include/linux/slab.h:909 [inline]
 kmalloc_array_noprof include/linux/slab.h:948 [inline]
 genl_family_rcv_msg_attrs_parse+0x75/0x190 net/netlink/genetlink.c:940
 genl_family_rcv_msg_doit+0x48/0x1b0 net/netlink/genetlink.c:1093
 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
 genl_rcv_msg+0x422/0x460 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x120/0x220 net/netlink/af_netlink.c:2552
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x5c0/0x690 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x58b/0x6b0 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:714 [inline]
 __sock_sendmsg+0x142/0x180 net/socket.c:729
 ____sys_sendmsg+0x31e/0x4e0 net/socket.c:2614
 ___sys_sendmsg+0x17b/0x1d0 net/socket.c:2668
 __sys_sendmsg net/socket.c:2700 [inline]
 __do_sys_sendmsg net/socket.c:2705 [inline]
 __se_sys_sendmsg net/socket.c:2703 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2703
 x64_sys_call+0x191e/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88e3a668 of 8 bytes by task 17257 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:594 [inline]
 data_push_tail+0xfd/0x420 kernel/printk/printk_ringbuffer.c:679
 data_alloc+0xbf/0x2b0 kernel/printk/printk_ringbuffer.c:1054
 prb_reserve+0x808/0xaf0 kernel/printk/printk_ringbuffer.c:1669
 vprintk_store+0x56d/0x860 kernel/printk/printk.c:2326
 vprintk_emit+0x178/0x650 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 __ext4_error+0x248/0x320 fs/ext4/super.c:813
 ext4_acquire_dquot+0x1bb/0x200 fs/ext4/super.c:6931
 dqget+0x535/0x8d0 fs/quota/dquot.c:977
 __dquot_initialize+0x27f/0x7c0 fs/quota/dquot.c:1505
 dquot_initialize+0x1a/0x30 fs/quota/dquot.c:1567
 ext4_process_orphan+0x32/0x1c0 fs/ext4/orphan.c:329
 ext4_orphan_cleanup+0x6a8/0xa00 fs/ext4/orphan.c:474
 __ext4_fill_super fs/ext4/super.c:5605 [inline]
 ext4_fill_super+0x3171/0x34e0 fs/ext4/super.c:5724
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1692
 get_tree_bdev+0x1f/0x30 fs/super.c:1715
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5756
 vfs_get_tree+0x54/0x1d0 fs/super.c:1815
 do_new_mount+0x207/0x5e0 fs/namespace.c:3805
 path_mount+0x4a4/0xb20 fs/namespace.c:4120
 do_mount fs/namespace.c:4133 [inline]
 __do_sys_mount fs/namespace.c:4344 [inline]
 __se_sys_mount+0x28f/0x2e0 fs/namespace.c:4321
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4321
 x64_sys_call+0x2b4d/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000fffffff0 -> 0x3620336320666620

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 17257 Comm: syz.8.4210 Tainted: G        W           6.16.0-syzkaller-11105-ga6923c06a3b2 #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================
EXT4-fs error (device loop8): ext4_free_blocks:6696: comm syz.8.4210: Freeing blocks not in datazone - block = 0, count = 4096
EXT4-fs error (device loop8): ext4_read_inode_bitmap:139: comm syz.8.4210: Invalid inode bitmap blk 0 in block_group 0
EXT4-fs error (device loop8) in ext4_free_inode:361: Corrupt filesystem
EXT4-fs (loop8): 1 orphan inode deleted
EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
9pnet: Could not find request transport: fő
EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000.

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/08/03 00:18 upstream a6923c06a3b2 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / hex_string
2025/07/18 06:46 upstream 6832a9317eee 88248e14 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / hex_string
* Struck through repros no longer work on HEAD.