syzbot


KCSAN: data-race in audit_log_start / audit_receive (3)

Status: moderation: reported on 2025/07/13 12:27
Subsystems: audit
[Documentation on labels]
Reported-by: syzbot+6d907adde6b34c3139e0@syzkaller.appspotmail.com
First crash: 13d, last: 8d17h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in audit_log_start / audit_receive (2) audit 6 8 71d 271d 0/29 auto-obsoleted due to no activity on 2025/07/12 01:35
upstream KCSAN: data-race in audit_log_start / audit_receive kernel 6 1 1328d 1328d 0/29 auto-closed as invalid on 2022/01/10 10:36

Sample crash report:
==================================================================
BUG: KCSAN: data-race in audit_log_start / audit_receive

write to 0xffffffff88e73450 of 8 bytes by task 17160 on cpu 0:
 audit_ctl_lock kernel/audit.c:235 [inline]
 audit_receive+0x78/0x2180 kernel/audit.c:1569
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x58b/0x6b0 net/netlink/af_netlink.c:1896
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x145/0x180 net/socket.c:727
 sock_sendmsg+0xc1/0x130 net/socket.c:750
 splice_to_socket+0x5fe/0x9a0 fs/splice.c:883
 do_splice_from fs/splice.c:935 [inline]
 direct_splice_actor+0x153/0x2a0 fs/splice.c:1158
 splice_direct_to_actor+0x30f/0x680 fs/splice.c:1102
 do_splice_direct_actor fs/splice.c:1201 [inline]
 do_splice_direct+0xda/0x150 fs/splice.c:1227
 do_sendfile+0x380/0x650 fs/read_write.c:1370
 __do_sys_sendfile64 fs/read_write.c:1431 [inline]
 __se_sys_sendfile64 fs/read_write.c:1417 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1417
 x64_sys_call+0xb39/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88e73450 of 8 bytes by task 3034 on cpu 1:
 audit_ctl_owner_current kernel/audit.c:256 [inline]
 audit_log_start+0x129/0x6c0 kernel/audit.c:1881
 common_lsm_audit+0x66/0x230 security/lsm_audit.c:442
 slow_avc_audit+0x104/0x140 security/selinux/avc.c:779
 avc_audit security/selinux/include/avc.h:127 [inline]
 avc_has_perm+0x128/0x150 security/selinux/avc.c:1198
 sock_has_perm security/selinux/hooks.c:4765 [inline]
 selinux_socket_recvmsg+0x175/0x1b0 security/selinux/hooks.c:5112
 security_socket_recvmsg+0x50/0x90 security/security.c:4691
 sock_recvmsg+0x38/0x170 net/socket.c:1037
 ____sys_recvmsg+0xf5/0x280 net/socket.c:2786
 ___sys_recvmsg+0x11f/0x370 net/socket.c:2828
 __sys_recvmsg net/socket.c:2861 [inline]
 __do_sys_recvmsg net/socket.c:2867 [inline]
 __se_sys_recvmsg net/socket.c:2864 [inline]
 __x64_sys_recvmsg+0xd1/0x160 net/socket.c:2864
 x64_sys_call+0xf19/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:48
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000000 -> 0xffff888119f94100

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3034 Comm: dhcpcd Not tainted 6.16.0-rc6-syzkaller-00121-g6832a9317eee #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================
audit: audit_backlog=65 > audit_backlog_limit=64
audit: audit_lost=103 audit_rate_limit=0 audit_backlog_limit=64
audit: backlog limit exceeded
audit: audit_backlog=65 > audit_backlog_limit=64
audit: audit_lost=104 audit_rate_limit=0 audit_backlog_limit=64
audit: audit_backlog=65 > audit_backlog_limit=64
audit: audit_lost=237 audit_rate_limit=0 audit_backlog_limit=64
audit: backlog limit exceeded
audit: audit_backlog=65 > audit_backlog_limit=64
audit: audit_lost=238 audit_rate_limit=0 audit_backlog_limit=64
audit: backlog limit exceeded
audit: audit_backlog=65 > audit_backlog_limit=64

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/18 13:31 upstream 6832a9317eee 88248e14 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in audit_log_start / audit_receive
2025/07/15 14:59 upstream 155a3c003e55 03fcfc4b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in audit_log_start / audit_receive
2025/07/13 12:26 upstream 3f31a806a62e 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in audit_log_start / audit_receive
* Struck through repros no longer work on HEAD.