syzbot


KCSAN: data-race in __set_task_comm / strlen

Status: moderation: reported on 2025/09/09 23:32
Subsystems: mm fs
[Documentation on labels]
Reported-by: syzbot+cfff6bf0b01901fca878@syzkaller.appspotmail.com
First crash: 54d, last: 8d04h

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __set_task_comm / strlen

write to 0xffff888167a8ea78 of 11 bytes by task 2940 on cpu 1:
 __set_task_comm+0x4d/0x140 fs/exec.c:1088
 __do_sys_prctl kernel/sys.c:2592 [inline]
 __se_sys_prctl+0xb2f/0x12e0 kernel/sys.c:2518
 __x64_sys_prctl+0x67/0x80 kernel/sys.c:2518
 x64_sys_call+0x20cf/0x3000 arch/x86/include/generated/asm/syscalls_64.h:158
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888167a8ea80 of 1 bytes by task 2897 on cpu 0:
 strlen+0x19/0x40 lib/string.c:420
 __fortify_strlen include/linux/fortify-string.h:268 [inline]
 trace_event_get_offsets_sched_stat_runtime include/trace/events/sched.h:553 [inline]
 do_perf_trace_sched_stat_runtime include/trace/events/sched.h:553 [inline]
 perf_trace_sched_stat_runtime+0x3c/0x150 include/trace/events/sched.h:553
 __do_trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 update_se+0x129/0x140 kernel/sched/fair.c:1175
 update_curr+0x2c/0x1b0 kernel/sched/fair.c:1223
 enqueue_entity kernel/sched/fair.c:5250 [inline]
 enqueue_task_fair+0x146/0x980 kernel/sched/fair.c:6976
 enqueue_task kernel/sched/core.c:2092 [inline]
 activate_task+0x59/0xb0 kernel/sched/core.c:2134
 ttwu_do_activate+0x69/0x210 kernel/sched/core.c:3706
 ttwu_queue kernel/sched/core.c:3969 [inline]
 try_to_wake_up+0x37f/0x630 kernel/sched/core.c:4293
 kick_pool+0x267/0x2d0 kernel/workqueue.c:1285
 __queue_work+0x8cb/0xb50 kernel/workqueue.c:2342
 queue_work_on+0xd1/0x160 kernel/workqueue.c:2392
 queue_work include/linux/workqueue.h:669 [inline]
 io_ring_ctx_wait_and_kill+0x151/0x180 io_uring/io_uring.c:3109
 io_uring_create+0x61f/0x630 io_uring/io_uring.c:3910
 io_uring_setup io_uring/io_uring.c:3936 [inline]
 __do_sys_io_uring_setup io_uring/io_uring.c:3970 [inline]
 __se_sys_io_uring_setup+0x1f7/0x210 io_uring/io_uring.c:3961
 __x64_sys_io_uring_setup+0x31/0x40 io_uring/io_uring.c:3961
 x64_sys_call+0x2b25/0x3000 arch/x86/include/generated/asm/syscalls_64.h:426
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x75 -> 0x31

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 2897 Comm: syz.2.11097 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/26 18:40 upstream dbfc6422a34d c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __set_task_comm / strlen
2025/10/25 20:36 upstream 566771afc7a8 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __set_task_comm / strlen
2025/10/24 14:57 upstream 6fab32bb6508 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __set_task_comm / strlen
2025/09/09 23:31 upstream 9dd1835ecda5 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __set_task_comm / strlen
* Struck through repros no longer work on HEAD.