syzbot


KCSAN: data-race in memchr / number (4)

Status: moderation: reported on 2025/06/17 12:36
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+f8211c5c8f80af6b7c0e@syzkaller.appspotmail.com
First crash: 15d, last: 15d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in memchr / number (2) block 1 434d 434d 0/29 auto-obsoleted due to no activity on 2024/05/30 03:24
upstream KCSAN: data-race in memchr / number (3) ext4 1 397d 397d 0/29 auto-obsoleted due to no activity on 2024/07/06 04:52
upstream KCSAN: data-race in memchr / number kernel 1 724d 724d 0/29 auto-obsoleted due to no activity on 2023/08/13 11:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in memchr / number

write to 0xffffffff88e6366c of 1 bytes by task 10069 on cpu 0:
 number+0x6af/0xab0 lib/vsprintf.c:545
 vsnprintf+0x691/0x890 lib/vsprintf.c:2838
 vscnprintf+0x41/0x90 lib/vsprintf.c:2939
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2216
 vprintk_store+0x599/0x860 kernel/printk/printk.c:2336
 vprintk_emit+0x178/0x650 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 __show_regs+0xd6/0x440 arch/x86/kernel/process_64.c:90
 show_regs_if_on_stack arch/x86/kernel/dumpstack.c:165 [inline]
 show_trace_log_lvl+0x423/0x560 arch/x86/kernel/dumpstack.c:298
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0xe8/0x140 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x265/0x280 lib/fault-inject.c:174
 should_fail+0xb/0x20 lib/fault-inject.c:184
 should_fail_usercopy+0x1a/0x20 lib/fault-inject-usercopy.c:37
 strncpy_from_user+0x25/0x230 lib/strncpy_from_user.c:118
 import_xattr_name fs/xattr.c:591 [inline]
 setxattr_copy fs/xattr.c:611 [inline]
 path_setxattrat+0xeb/0x310 fs/xattr.c:701
 __do_sys_fsetxattr fs/xattr.c:761 [inline]
 __se_sys_fsetxattr fs/xattr.c:758 [inline]
 __x64_sys_fsetxattr+0x6b/0x80 fs/xattr.c:758
 x64_sys_call+0x2f7c/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:191
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88e6366c of 1 bytes by task 10065 on cpu 1:
 memchr+0x28/0x50 lib/string.c:809
 _Z6memchrPKvU25pass_dynamic_object_size0im include/linux/fortify-string.h:739 [inline]
 count_lines kernel/printk/printk_ringbuffer.c:1797 [inline]
 copy_data kernel/printk/printk_ringbuffer.c:1843 [inline]
 prb_read kernel/printk/printk_ringbuffer.c:1936 [inline]
 _prb_read_valid+0x65d/0x920 kernel/printk/printk_ringbuffer.c:2113
 prb_read_valid_info+0x66/0x90 kernel/printk/printk_ringbuffer.c:2219
 find_first_fitting_seq+0x1b1/0x320 kernel/printk/printk.c:1589
 syslog_print_all+0x111/0x3a0 kernel/printk/printk.c:1721
 do_syslog+0x2fd/0x7e0 kernel/printk/printk.c:1799
 __do_sys_syslog kernel/printk/printk.c:1877 [inline]
 __se_sys_syslog kernel/printk/printk.c:1875 [inline]
 __x64_sys_syslog+0x41/0x50 kernel/printk/printk.c:1875
 x64_sys_call+0x2ea0/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:104
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x36 -> 0x30

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 10065 Comm: syz.2.2447 Not tainted 6.16.0-rc2-syzkaller-00024-g9afe652958c3 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/17 12:35 upstream 9afe652958c3 cfebc887 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / number
* Struck through repros no longer work on HEAD.