[moderation] [acpica?] KCSAN: data-race in string / vsnprintf

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13478bb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84b3039e8461eef5
dashboard link: https://syzkaller.appspot.com/bug?extid=8f56859639b847933b36
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
CC: [acpica...@lists.linux.dev le...@kernel.org linux...@vger.kernel.org linux-...@vger.kernel.org raf...@kernel.org robert...@intel.com saket....@intel.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d1a0ae21bd78/disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9be505d18eb6/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8ab6a3838bc0/bzImage-848acc8f.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8f5685...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in string / vsnprintf

write to 0xffffffff89405bc0 of 30 bytes by task 17607 on cpu 0:
vsnprintf+0x2c0/0x8c0 lib/vsprintf.c:2896
vsprintf+0x2a/0x40 lib/vsprintf.c:3090
acpi_os_vprintf drivers/acpi/osl.c:162 [inline]
acpi_os_printf+0x87/0x200 drivers/acpi/osl.c:153
acpi_debug_print+0x113/0x200 drivers/acpi/acpica/utdebug.c:158
acpi_ps_complete_op+0x754/0x780 drivers/acpi/acpica/psobject.c:612
acpi_ps_parse_loop+0x1104/0x1520 drivers/acpi/acpica/psloop.c:580
acpi_ps_parse_aml+0x2b0/0xa10 drivers/acpi/acpica/psparse.c:489
acpi_ps_execute_method+0x4af/0x660 drivers/acpi/acpica/psxface.c:190
acpi_ns_evaluate+0x8ae/0xac0 drivers/acpi/acpica/nseval.c:205
acpi_ut_evaluate_object+0xa7/0x420 drivers/acpi/acpica/uteval.c:60
acpi_rs_get_method_data+0x6d/0x100 drivers/acpi/acpica/rsutils.c:650
acpi_walk_resources+0x125/0x1c0 drivers/acpi/acpica/rsxface.c:616
acpi_pci_link_get_current+0x11c/0x200 drivers/acpi/pci_link.c:254
acpi_pci_link_set+0x390/0x430 drivers/acpi/pci_link.c:360
acpi_pci_link_allocate drivers/acpi/pci_link.c:582 [inline]
acpi_pci_link_allocate_irq+0xb52/0xd60 drivers/acpi/pci_link.c:637
acpi_pci_irq_enable+0x193/0x3d0 drivers/acpi/pci_irq.c:429
pcibios_enable_device+0x88/0xa0 arch/x86/pci/common.c:699
do_pci_enable_device+0x152/0x2d0 drivers/pci/pci.c:1998
pci_enable_device_flags+0x348/0x3a0 drivers/pci/pci.c:2089
pci_enable_device+0x1a/0xa0 drivers/pci/pci.c:2122
i801_probe+0x288/0xbf0 drivers/i2c/busses/i2c-i801.c:1573
local_pci_probe drivers/pci/pci-driver.c:332 [inline]
local_pci_probe_callback+0x8a/0x110 drivers/pci/pci-driver.c:361
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
worker_thread+0x569/0x750 kernel/workqueue.c:3486
kthread+0x221/0x270 kernel/kthread.c:436
ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffffffff89405bc4 of 1 bytes by task 18085 on cpu 1:
string_nocheck lib/vsprintf.c:648 [inline]
string+0x13b/0x220 lib/vsprintf.c:730
vsnprintf+0x543/0x8c0 lib/vsprintf.c:2945
vscnprintf+0x41/0x90 lib/vsprintf.c:3014
printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
vprintk_store+0x57b/0x910 kernel/printk/printk.c:2364
vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x79/0xa0 kernel/printk/printk.c:2504
acpi_os_vprintf include/linux/printk.h:-1 [inline]
acpi_os_printf+0x11c/0x200 drivers/acpi/osl.c:153
acpi_debug_print+0x150/0x200 drivers/acpi/acpica/utdebug.c:171
acpi_ut_status_exit+0xc1/0x120 drivers/acpi/acpica/utdebug.c:-1
acpi_ut_copy_eobject_to_iobject+0x58a/0x600 drivers/acpi/acpica/utcopy.c:-1
acpi_evaluate_object+0x2b7/0x800 drivers/acpi/acpica/nsxfeval.c:259
acpi_execute_simple_method+0x97/0xc0 drivers/acpi/utils.c:684
acpi_sleep_tts_switch drivers/acpi/sleep.c:40 [inline]
acpi_pm_start drivers/acpi/sleep.c:532 [inline]
acpi_suspend_begin+0xfe/0x170 drivers/acpi/sleep.c:586
platform_suspend_begin kernel/power/suspend.c:312 [inline]
suspend_devices_and_enter+0x182/0x10d0 kernel/power/suspend.c:517
enter_state kernel/power/suspend.c:618 [inline]
pm_suspend+0x541/0x980 kernel/power/suspend.c:644
state_store+0x1ba/0x220 kernel/power/main.c:819
kobj_attr_store+0x4a/0x70 lib/kobject.c:840
sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x57d/0x990 fs/read_write.c:687
ksys_write+0xdc/0x1a0 fs/read_write.c:739
__do_sys_write fs/read_write.c:750 [inline]
__se_sys_write fs/read_write.c:747 [inline]
__x64_sys_write+0x40/0x50 fs/read_write.c:747
x64_sys_call+0x27e1/0x3020 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x74 -> 0x6f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 18085 Comm: syz.6.3570 Tainted: G W syzkaller #0 PREEMPT(lazy)
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup