syzbot


KCSAN: data-race in memchr / string (3)

Status: moderation: reported on 2024/05/11 23:03
Subsystems: audit
[Documentation on labels]
Reported-by: syzbot+d0a30aa354a1e3687368@syzkaller.appspotmail.com
First crash: 64d, last: 21d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in memchr / string v9fs 1 1076d 1076d 0/27 auto-closed as invalid on 2021/08/08 15:57
upstream KCSAN: data-race in memchr / string (2) mm 1 829d 829d 0/27 auto-closed as invalid on 2022/04/12 14:29

Sample crash report:
==================================================================
BUG: KCSAN: data-race in memchr / string

write to 0xffffffff883f080c of 1 bytes by task 50 on cpu 0:
 string_nocheck lib/vsprintf.c:650 [inline]
 string+0x16c/0x210 lib/vsprintf.c:728
 vsnprintf+0xa09/0xe30 lib/vsprintf.c:2824
 vscnprintf+0x42/0x90 lib/vsprintf.c:2930
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2165
 vprintk_store+0x570/0x810 kernel/printk/printk.c:2279
 vprintk_emit+0x10c/0x5e0 kernel/printk/printk.c:2329
 dev_vprintk_emit+0x1df/0x210 drivers/base/core.c:4950
 dev_printk_emit+0x82/0xb0 drivers/base/core.c:4961
 __netdev_printk+0x352/0x3e0 net/core/dev.c:11624
 netdev_info+0x99/0xc0 net/core/dev.c:11679
 nsim_udp_tunnel_unset_port+0x1bc/0x1e0 drivers/net/netdevsim/udp_tunnels.c:64
 udp_tunnel_nic_device_sync_by_port net/ipv4/udp_tunnel_nic.c:246 [inline]
 __udp_tunnel_nic_device_sync+0x57b/0x9e0 net/ipv4/udp_tunnel_nic.c:289
 udp_tunnel_nic_flush+0x22c/0x320 net/ipv4/udp_tunnel_nic.c:670
 udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:864 [inline]
 udp_tunnel_nic_netdevice_event+0x7b9/0xc80 net/ipv4/udp_tunnel_nic.c:904
 notifier_call_chain kernel/notifier.c:93 [inline]
 raw_notifier_call_chain+0x6f/0x1d0 kernel/notifier.c:461
 call_netdevice_notifiers_info+0xae/0x100 net/core/dev.c:1992
 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline]
 call_netdevice_notifiers net/core/dev.c:2044 [inline]
 unregister_netdevice_many_notify+0x83c/0xf20 net/core/dev.c:11218
 unregister_netdevice_many net/core/dev.c:11276 [inline]
 unregister_netdevice_queue+0x1f4/0x220 net/core/dev.c:11155
 unregister_netdevice include/linux/netdevice.h:3119 [inline]
 nsim_destroy+0xa0/0x2f0 drivers/net/netdevsim/netdev.c:777
 __nsim_dev_port_del+0xcd/0x100 drivers/net/netdevsim/dev.c:1425
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1437 [inline]
 nsim_dev_reload_destroy+0x1a6/0x2d0 drivers/net/netdevsim/dev.c:1658
 nsim_dev_reload_down+0x77/0xa0 drivers/net/netdevsim/dev.c:965
 devlink_reload+0xab/0x5a0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0xd7/0x220 net/devlink/core.c:509
 ops_pre_exit_list net/core/net_namespace.c:163 [inline]
 cleanup_net+0x332/0x830 net/core/net_namespace.c:620
 process_one_work kernel/workqueue.c:3231 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3312
 worker_thread+0x526/0x730 kernel/workqueue.c:3393
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffffffff883f080c of 1 bytes by task 8603 on cpu 1:
 memchr+0x2a/0x50 lib/string.c:791
 count_lines kernel/printk/printk_ringbuffer.c:1797 [inline]
 copy_data kernel/printk/printk_ringbuffer.c:1843 [inline]
 prb_read kernel/printk/printk_ringbuffer.c:1936 [inline]
 _prb_read_valid+0xa26/0xba0 kernel/printk/printk_ringbuffer.c:2113
 prb_read_valid_info+0x67/0x90 kernel/printk/printk_ringbuffer.c:2216
 find_first_fitting_seq+0x8a/0x310 kernel/printk/printk.c:1519
 syslog_print_all+0x11d/0x5a0 kernel/printk/printk.c:1670
 do_syslog+0x41c/0x7d0 kernel/printk/printk.c:1748
 __do_sys_syslog kernel/printk/printk.c:1826 [inline]
 __se_sys_syslog kernel/printk/printk.c:1824 [inline]
 __x64_sys_syslog+0x43/0x50 kernel/printk/printk.c:1824
 x64_sys_call+0x2695/0x2d30 arch/x86/include/generated/asm/syscalls_64.h:104
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x69 -> 0x65

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8603 Comm: syz-executor.4 Not tainted 6.9.0-syzkaller-10713-g2a8120d7b482 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/05/24 09:14 upstream 2a8120d7b482 8f98448e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/05/10 09:07 upstream 448b3fe5a0ea de979bc2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/05/07 06:43 upstream dccb07f2914c fa7a5cf0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/05/06 08:04 upstream dd5a440a31fa 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/04/29 22:26 upstream b947cc5bf6d7 f10afd69 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/04/24 04:33 upstream 9d1ddab261f3 21339d7b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
2024/04/11 22:57 upstream e8c39d0f57f3 95ed9ece .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in memchr / string
* Struck through repros no longer work on HEAD.