syzbot


KCSAN: data-race in data_push_tail / dentry_name (3)

Status: moderation: reported on 2024/11/06 13:21
Subsystems: mm
[Documentation on labels]
Reported-by: syzbot+e19c104d1cdfc5f2dad4@syzkaller.appspotmail.com
First crash: 14d, last: 14d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / dentry_name fs 2 1142d 1154d 0/28 auto-closed as invalid on 2021/11/10 04:07
upstream KCSAN: data-race in data_push_tail / dentry_name (2) mm 1 318d 316d 0/28 auto-obsoleted due to no activity on 2024/02/11 06:34

Sample crash report:
==================================================================
BUG: KCSAN: data-race in data_push_tail / dentry_name

write to 0xffffffff88b90e23 of 1 bytes by task 18003 on cpu 1:
 dentry_name+0x2ea/0x390 lib/vsprintf.c:942
 pointer+0x26c/0xd20 lib/vsprintf.c:2444
 vsnprintf+0x861/0xe30 lib/vsprintf.c:2807
 vscnprintf+0x42/0x90 lib/vsprintf.c:2909
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2197
 vprintk_store+0x570/0x810 kernel/printk/printk.c:2311
 vprintk_emit+0x15e/0x680 kernel/printk/printk.c:2383
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2422
 vprintk+0x75/0x80 kernel/printk/printk_safe.c:68
 _printk+0x7a/0xa0 kernel/printk/printk.c:2432
 fail_dump lib/fault-inject.c:46 [inline]
 should_fail_ex+0x20b/0x230 lib/fault-inject.c:154
 should_failslab+0x8f/0xb0 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4038 [inline]
 slab_alloc_node mm/slub.c:4114 [inline]
 kmem_cache_alloc_node_noprof+0x51/0x2b0 mm/slub.c:4186
 __alloc_skb+0x10b/0x310 net/core/skbuff.c:668
 alloc_skb include/linux/skbuff.h:1322 [inline]
 nlmsg_new include/net/netlink.h:1015 [inline]
 audit_buffer_alloc kernel/audit.c:1794 [inline]
 audit_log_start+0x368/0x6b0 kernel/audit.c:1912
 audit_seccomp+0x4b/0x130 kernel/auditsc.c:3007
 seccomp_log kernel/seccomp.c:1016 [inline]
 __seccomp_filter+0x6fa/0x1180 kernel/seccomp.c:1305
 __secure_computing+0x9f/0x1c0 kernel/seccomp.c:1367
 syscall_trace_enter+0xd1/0x1f0 kernel/entry/common.c:52
 syscall_enter_from_user_mode_work include/linux/entry-common.h:168 [inline]
 syscall_enter_from_user_mode include/linux/entry-common.h:198 [inline]
 do_syscall_64+0xaa/0x1c0 arch/x86/entry/common.c:79
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88b90e20 of 8 bytes by task 3392 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:594 [inline]
 data_push_tail+0x102/0x430 kernel/printk/printk_ringbuffer.c:679
 data_alloc+0xbe/0x2c0 kernel/printk/printk_ringbuffer.c:1054
 prb_reserve+0x85e/0xb60 kernel/printk/printk_ringbuffer.c:1669
 vprintk_store+0x53f/0x810 kernel/printk/printk.c:2301
 vprintk_emit+0x15e/0x680 kernel/printk/printk.c:2383
 dev_vprintk_emit+0x1df/0x210 drivers/base/core.c:4942
 dev_printk_emit+0x82/0xb0 drivers/base/core.c:4953
 __dev_printk+0xf6/0x110 drivers/base/core.c:4965
 _dev_info+0x99/0xc0 drivers/base/core.c:5011
 hid_connect+0xdff/0xe30 drivers/hid/hid-core.c:2308
 hid_hw_start+0x7c/0xd0 drivers/hid/hid-core.c:2349
 hid_generic_probe+0x5b/0x70 drivers/hid/hid-generic.c:67
 __hid_device_probe drivers/hid/hid-core.c:2699 [inline]
 hid_device_probe+0x220/0x370 drivers/hid/hid-core.c:2736
 really_probe+0x1cf/0x5d0 drivers/base/dd.c:658
 __driver_probe_device+0x12d/0x200 drivers/base/dd.c:800
 driver_probe_device+0x38/0x2f0 drivers/base/dd.c:830
 __device_attach_driver+0x216/0x320 drivers/base/dd.c:958
 bus_for_each_drv+0x1cd/0x240 drivers/base/bus.c:459
 __device_attach+0x1c7/0x290 drivers/base/dd.c:1030
 device_initial_probe+0x1a/0x20 drivers/base/dd.c:1079
 bus_probe_device+0x141/0x1d0 drivers/base/bus.c:534
 device_add+0x5e2/0x790 drivers/base/core.c:3672
 hid_add_device+0x26e/0x2f0 drivers/hid/hid-core.c:2882
 uhid_device_add_worker+0x2b/0xa0 drivers/hid/uhid.c:73
 process_one_work kernel/workqueue.c:3229 [inline]
 process_scheduled_works+0x483/0x9a0 kernel/workqueue.c:3310
 worker_thread+0x51d/0x6f0 kernel/workqueue.c:3391
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

value changed: 0x00000000fffffc3f -> 0x616c736c69616620

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3392 Comm: kworker/0:3 Not tainted 6.12.0-rc6-syzkaller-00077-g2e1b3cc9d7f7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events uhid_device_add_worker
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/06 13:20 upstream 2e1b3cc9d7f7 3a465482 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / dentry_name
* Struck through repros no longer work on HEAD.