netlink: 8 bytes leftover after parsing attributes in process `syz.2.4883'.
==================================================================
BUG: KCSAN: data-race in data_push_tail / string

write to 0xffffffff88e29f88 of 1 bytes by task 17289 on cpu 0:
 string_nocheck lib/vsprintf.c:657 [inline]
 string+0x187/0x220 lib/vsprintf.c:735
 vsnprintf+0x532/0x890 lib/vsprintf.c:2926
 va_format lib/vsprintf.c:1728 [inline]
 pointer+0x833/0xcf0 lib/vsprintf.c:2548
 vsnprintf+0x491/0x890 lib/vsprintf.c:2930
 vscnprintf+0x41/0x90 lib/vsprintf.c:2991
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2189
 vprintk_store+0x599/0x860 kernel/printk/printk.c:2309
 vprintk_emit+0x10d/0x580 kernel/printk/printk.c:2399
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2438
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2448
 __netdev_printk+0x321/0x3e0 net/core/dev.c:12694
 netdev_info+0x9b/0xd0 net/core/dev.c:12741
 bond_enslave+0x1ea1/0x1f50 drivers/net/bonding/bond_main.c:2328
 do_set_master+0x38d/0x460 net/core/rtnetlink.c:2956
 rtnl_newlink_create+0x426/0x620 net/core/rtnetlink.c:3847
 __rtnl_newlink net/core/rtnetlink.c:3950 [inline]
 rtnl_newlink+0xf29/0x12d0 net/core/rtnetlink.c:4065
 rtnetlink_rcv_msg+0x5fb/0x6d0 net/core/rtnetlink.c:6954
 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2552
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:6981
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x5c0/0x690 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x58b/0x6b0 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x142/0x180 net/socket.c:742
 ____sys_sendmsg+0x31e/0x4e0 net/socket.c:2630
 ___sys_sendmsg+0x17b/0x1d0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2719
 x64_sys_call+0x191e/0x3000 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88e29f88 of 8 bytes by task 17304 on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:591 [inline]
 data_push_tail+0xfd/0x420 kernel/printk/printk_ringbuffer.c:676
 data_alloc+0xfb/0x2e0 kernel/printk/printk_ringbuffer.c:1061
 prb_reserve+0x807/0xaf0 kernel/printk/printk_ringbuffer.c:1685
 vprintk_store+0x56d/0x860 kernel/printk/printk.c:2299
 vprintk_emit+0x10d/0x580 kernel/printk/printk.c:2399
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2438
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2448
 __nla_validate_parse+0x1738/0x1d00 lib/nlattr.c:647
 __nla_parse+0x40/0x60 lib/nlattr.c:732
 __nlmsg_parse include/net/netlink.h:789 [inline]
 nlmsg_parse_deprecated include/net/netlink.h:830 [inline]
 nl80211_prepare_wdev_dump+0x229/0x3b0 net/wireless/nl80211.c:1102
 nl80211_dump_survey+0xa8/0xc10 net/wireless/nl80211.c:11800
 genl_dumpit+0xa9/0x110 net/netlink/genetlink.c:1027
 netlink_dump+0x452/0x8a0 net/netlink/af_netlink.c:2327
 __netlink_dump_start+0x43e/0x520 net/netlink/af_netlink.c:2442
 genl_family_rcv_msg_dumpit+0x115/0x180 net/netlink/genetlink.c:1076
 genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
 genl_rcv_msg+0x3f0/0x460 net/netlink/genetlink.c:1210
 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2552
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x5c0/0x690 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x58b/0x6b0 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x142/0x180 net/socket.c:742
 ____sys_sendmsg+0x31e/0x4e0 net/socket.c:2630
 ___sys_sendmsg+0x17b/0x1d0 net/socket.c:2684
 __sys_sendmsg net/socket.c:2716 [inline]
 __do_sys_sendmsg net/socket.c:2721 [inline]
 __se_sys_sendmsg net/socket.c:2719 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2719
 x64_sys_call+0x191e/0x3000 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000fffffd9e -> 0x203a293165676469

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 17304 Comm: syz.2.4883 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
==================================================================