syzbot


KCSAN: data-race in data_push_tail / number (5)

Status: moderation: reported on 2025/07/22 09:11
Subsystems: audit
[Documentation on labels]
Reported-by: syzbot+7b1cbf8ab9b0340d009e@syzkaller.appspotmail.com
First crash: 98d, last: 40d
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / number (2) audit 6 46 1030d 1364d 0/29 auto-obsoleted due to no activity on 2023/02/11 10:05
upstream KCSAN: data-race in data_push_tail / number (4) block 6 103 156d 689d 0/29 auto-obsoleted due to no activity on 2025/07/20 09:23
upstream KCSAN: data-race in data_push_tail / number (3) ext4 6 15 905d 990d 0/29 auto-obsoleted due to no activity on 2023/06/10 22:29
upstream KCSAN: data-race in data_push_tail / number ext4 6 87 1401d 1542d 0/29 auto-closed as invalid on 2022/01/31 12:18

Sample crash report:
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
==================================================================
BUG: KCSAN: data-race in data_push_tail / number

write to 0xffffffff88e24a48 of 1 bytes by task 29 on cpu 1:
 number+0x8d6/0xab0 lib/vsprintf.c:572
 vsnprintf+0x691/0x890 lib/vsprintf.c:2890
 vscnprintf+0x41/0x90 lib/vsprintf.c:2991
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2216
 vprintk_store+0x599/0x860 kernel/printk/printk.c:2336
 vprintk_emit+0x178/0x650 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 kauditd_printk_skb kernel/audit.c:546 [inline]
 kauditd_hold_skb+0x1b1/0x1c0 kernel/audit.c:581
 kauditd_send_queue+0x270/0x2c0 kernel/audit.c:766
 kauditd_thread+0x421/0x630 kernel/audit.c:890
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x11f/0x1b0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffffffff88e24a48 of 8 bytes by task 15282 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:594 [inline]
 data_push_tail+0xfd/0x420 kernel/printk/printk_ringbuffer.c:679
 data_alloc+0xbf/0x2b0 kernel/printk/printk_ringbuffer.c:1054
 prb_reserve+0x808/0xaf0 kernel/printk/printk_ringbuffer.c:1669
 vprintk_store+0x56d/0x860 kernel/printk/printk.c:2326
 vprintk_emit+0x178/0x650 kernel/printk/printk.c:2426
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 br_set_state+0x28c/0x390 net/bridge/br_stp.c:57
 br_stp_disable_port+0x5d/0x150 net/bridge/br_stp_if.c:106
 del_nbp+0xdc/0x790 net/bridge/br_if.c:343
 br_dev_delete+0x4e/0xe0 net/bridge/br_if.c:386
 br_net_exit_rtnl+0xae/0x120 net/bridge/br.c:387
 ops_exit_rtnl_list net/core/net_namespace.c:180 [inline]
 ops_undo_list+0x1b4/0x410 net/core/net_namespace.c:247
 cleanup_net+0x2de/0x4d0 net/core/net_namespace.c:682
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x11f/0x1b0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000fffffab1 -> 0x3128746964756120

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 15282 Comm: kworker/u8:63 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: netns cleanup_net
==================================================================
veth0_to_bridge: left allmulticast mode
veth0_to_bridge: left promiscuous mode
Ÿë: port 1(veth0_to_bridge) entered disabled state
bridge_slave_1: left allmulticast mode
bridge_slave_1: left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
bridge_slave_0: left allmulticast mode
bridge_slave_0: left promiscuous mode
bridge0: port 1(bridge_slave_0) entered disabled state
veth0_to_bridge: left allmulticast mode
veth0_to_bridge: left promiscuous mode
Ÿë: port 1(veth0_to_bridge) entered disabled state
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
bond1 (unregistering): Released all slaves
bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
bond0 (unregistering): Released all slaves
tipc: Left network mode
hsr_slave_0: left promiscuous mode
hsr_slave_1: left promiscuous mode
batman_adv: batadv0: Interface deactivated: batadv_slave_0
batman_adv: batadv0: Removing interface: batadv_slave_0
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
hsr_slave_0: left promiscuous mode
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
veth1_macvtap: left promiscuous mode
veth0_macvtap: left promiscuous mode
veth1_vlan: left promiscuous mode
veth0_vlan: left promiscuous mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed
veth0_to_bond (unregistering): left allmulticast mode
team0 (unregistering): Port device team_slave_1 removed
team0 (unregistering): Port device team_slave_0 removed

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/18 16:15 upstream 8b789f2b7602 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / number
2025/08/07 18:37 upstream 6e64f4580381 04cffc22 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / number
2025/07/22 09:10 upstream 89be9a83ccf1 1555463b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / number
* Struck through repros no longer work on HEAD.