syzbot


KCSAN: data-race in __set_task_comm / strlen

Status: moderation: reported on 2025/09/09 23:32
Subsystems: fs mm
[Documentation on labels]
Reported-by: syzbot+cfff6bf0b01901fca878@syzkaller.appspotmail.com
First crash: 2d10h, last: 2d10h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __set_task_comm / strlen

write to 0xffff8881951c17f8 of 8 bytes by task 27425 on cpu 0:
 __set_task_comm+0x4d/0x140 fs/exec.c:1088
 begin_new_exec+0xeb3/0x1160 fs/exec.c:1246
 load_elf_binary+0x62b/0x1a20 fs/binfmt_elf.c:995
 search_binary_handler fs/exec.c:1670 [inline]
 exec_binprm fs/exec.c:1702 [inline]
 bprm_execve+0x477/0x970 fs/exec.c:1754
 kernel_execve+0x617/0x660 fs/exec.c:1920
 call_usermodehelper_exec_async+0x197/0x250 kernel/umh.c:109
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff8881951c17ff of 1 bytes by task 27384 on cpu 1:
 strlen+0x19/0x40 lib/string.c:420
 __fortify_strlen include/linux/fortify-string.h:268 [inline]
 trace_event_get_offsets_sched_stat_runtime include/trace/events/sched.h:553 [inline]
 do_perf_trace_sched_stat_runtime include/trace/events/sched.h:553 [inline]
 perf_trace_sched_stat_runtime+0x3c/0x150 include/trace/events/sched.h:553
 __do_trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 update_se+0x129/0x140 kernel/sched/fair.c:1175
 update_curr+0x2c/0x1b0 kernel/sched/fair.c:1223
 enqueue_entity kernel/sched/fair.c:5253 [inline]
 enqueue_task_fair+0x146/0x980 kernel/sched/fair.c:6876
 enqueue_task kernel/sched/core.c:2090 [inline]
 activate_task+0x59/0xb0 kernel/sched/core.c:2132
 ttwu_do_activate+0x69/0x210 kernel/sched/core.c:3741
 ttwu_queue kernel/sched/core.c:4004 [inline]
 try_to_wake_up+0x37f/0x630 kernel/sched/core.c:4328
 wake_up_process kernel/sched/core.c:4459 [inline]
 wake_up_q+0x48/0x80 kernel/sched/core.c:1084
 futex_wake+0x2f1/0x360 kernel/futex/waitwake.c:198
 do_futex+0x323/0x380 kernel/futex/syscalls.c:107
 __do_sys_futex kernel/futex/syscalls.c:179 [inline]
 __se_sys_futex+0x2ed/0x360 kernel/futex/syscalls.c:160
 __x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:160
 x64_sys_call+0x2e39/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:203
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x2f -> 0x65

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 27384 Comm: syz.1.7846 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/09 23:31 upstream 9dd1835ecda5 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __set_task_comm / strlen
* Struck through repros no longer work on HEAD.