syzbot


KCSAN: data-race in data_push_tail / vsnprintf (5)

Status: closed as invalid on 2023/06/28 10:46
Subsystems: block net
[Documentation on labels]
First crash: 338d, last: 309d
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / vsnprintf (6) ext4 23 67d 147d 0/26 auto-obsoleted due to no activity on 2024/03/31 12:46
upstream KCSAN: data-race in data_push_tail / vsnprintf (4) ext4 4 399d 487d 0/26 auto-obsoleted due to no activity on 2023/05/03 19:58
upstream KCSAN: data-race in data_push_tail / vsnprintf (3) kernel 8 610d 709d 0/26 auto-closed as invalid on 2022/10/04 16:48
upstream KCSAN: data-race in data_push_tail / vsnprintf (2) ext4 1 767d 767d 0/26 auto-closed as invalid on 2022/05/01 03:50
upstream KCSAN: data-race in data_push_tail / vsnprintf usb 36 831d 1145d 0/26 auto-closed as invalid on 2022/02/26 00:52

Sample crash report:
loop2: detected capacity change from 0 to 2048
==================================================================
BUG: KCSAN: data-race in data_push_tail / vsnprintf

write to 0xffffffff86f38871 of 1 bytes by task 22270 on cpu 1:
 vsnprintf+0xdd0/0xe20
 vscnprintf+0x42/0x80 lib/vsprintf.c:2923
 printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2128
 vprintk_store+0x56f/0x800 kernel/printk/printk.c:2242
 vprintk_emit+0xd0/0x430 kernel/printk/printk.c:2288
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2318
 vprintk+0x83/0x90 kernel/printk/printk_safe.c:50
 _printk+0x7a/0xa0 kernel/printk/printk.c:2328
 set_capacity_and_notify+0x11d/0x170 block/genhd.c:86
 loop_set_size+0x2e/0x70 drivers/block/loop.c:237
 loop_configure+0xafe/0xca0 drivers/block/loop.c:1100
 lo_ioctl+0x682/0x12e0
 blkdev_ioctl+0x375/0x460 block/ioctl.c:621
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xcf/0x140 fs/ioctl.c:856
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

read to 0xffffffff86f38870 of 8 bytes by task 22275 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:590 [inline]
 data_push_tail+0x102/0x430 kernel/printk/printk_ringbuffer.c:675
 data_alloc+0xbe/0x2c0 kernel/printk/printk_ringbuffer.c:1046
 prb_reserve+0x893/0xbc0 kernel/printk/printk_ringbuffer.c:1555
 vprintk_store+0x53e/0x800 kernel/printk/printk.c:2232
 vprintk_emit+0xd0/0x430 kernel/printk/printk.c:2288
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2318
 vprintk+0x83/0x90 kernel/printk/printk_safe.c:50
 _printk+0x7a/0xa0 kernel/printk/printk.c:2328
 set_capacity_and_notify+0x11d/0x170 block/genhd.c:86
 loop_set_size+0x2e/0x70 drivers/block/loop.c:237
 loop_configure+0xafe/0xca0 drivers/block/loop.c:1100
 lo_ioctl+0x682/0x12e0
 blkdev_ioctl+0x375/0x460 block/ioctl.c:621
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xcf/0x140 fs/ioctl.c:856
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x000000010000c676 -> 0x000000010000000a

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 22275 Comm: syz-executor.2 Not tainted 6.4.0-syzkaller-01224-g1ef6663a587b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
==================================================================
EXT4-fs (loop2): blocks per group (145984) and clusters per group (16384) inconsistent

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/06/27 18:00 upstream 1ef6663a587b 4cd5bb25 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / vsnprintf
2023/05/30 09:16 upstream 8b817fded42d cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / vsnprintf
* Struck through repros no longer work on HEAD.