[moderation] [mm?] KCSAN: data-race in desc_read_finalized_seq / prb_reserve

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 68763b29e0a6 Merge tag 'spi-fix-v6.14-rc2' of git://git.ke..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17450f18580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c8889d5a0d6060f3
dashboard link: https://syzkaller.appspot.com/bug?extid=383a92f48ff01d88d395
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [ak...@linux-foundation.org linux-...@vger.kernel.org linu...@kvack.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c16c0ea5c802/disk-68763b29.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/01c9fd28dc40/vmlinux-68763b29.xz
kernel image: https://storage.googleapis.com/syzbot-assets/85508704f500/bzImage-68763b29.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+383a92...@syzkaller.appspotmail.com

BUG: KCSAN: data-race in desc_read_finalized_seq / prb_reserve

write to 0xffffffff86710360 of 8 bytes by task 24513 on cpu 1:
prb_reserve+0x740/0xb60
vprintk_store+0x558/0x870 kernel/printk/printk.c:2326
vprintk_emit+0x168/0x690 kernel/printk/printk.c:2408
vprintk_default+0x26/0x30 kernel/printk/printk.c:2447
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x7a/0xa0 kernel/printk/printk.c:2457
dump_stack_print_info+0xdf/0x1a0 lib/dump_stack.c:57
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0xe6/0x150 lib/dump_stack.c:120
dump_stack+0x15/0x1a lib/dump_stack.c:129
fail_dump lib/fault-inject.c:73 [inline]
should_fail_ex+0x24a/0x260 lib/fault-inject.c:174
should_failslab+0x8f/0xb0 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4068 [inline]
slab_alloc_node mm/slub.c:4144 [inline]
__kmalloc_cache_noprof+0x4e/0x320 mm/slub.c:4320
kmalloc_noprof include/linux/slab.h:901 [inline]
alloc_name mm/memfd.c:399 [inline]
__do_sys_memfd_create mm/memfd.c:470 [inline]
__se_sys_memfd_create+0x1ea/0x5a0 mm/memfd.c:458
__x64_sys_memfd_create+0x31/0x40 mm/memfd.c:458
x64_sys_call+0x2d4c/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:320
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff86710360 of 8 bytes by task 24360 on cpu 0:
desc_read kernel/printk/printk_ringbuffer.c:486 [inline]
desc_read_finalized_seq+0x157/0x280 kernel/printk/printk_ringbuffer.c:1874
prb_read kernel/printk/printk_ringbuffer.c:1922 [inline]
_prb_read_valid+0x140/0x6c0 kernel/printk/printk_ringbuffer.c:2113
desc_update_last_finalized kernel/printk/printk_ringbuffer.c:1515 [inline]
prb_final_commit+0x144/0x1f0 kernel/printk/printk_ringbuffer.c:1782
vprintk_store+0x7cb/0x870 kernel/printk/printk.c:2310
vprintk_emit+0x168/0x690 kernel/printk/printk.c:2408
vprintk_default+0x26/0x30 kernel/printk/printk.c:2447
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x7a/0xa0 kernel/printk/printk.c:2457
disk_unlock_native_capacity block/partitions/core.c:520 [inline]
blk_add_partition block/partitions/core.c:553 [inline]
blk_add_partitions block/partitions/core.c:633 [inline]
bdev_disk_changed+0x8d2/0xcb0 block/partitions/core.c:693
loop_reread_partitions drivers/block/loop.c:537 [inline]
loop_set_status+0x3f5/0x480 drivers/block/loop.c:1305
lo_ioctl+0x839/0x14f0
blkdev_ioctl+0x359/0x450 block/ioctl.c:693
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xc9/0x140 fs/ioctl.c:892
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:892
x64_sys_call+0x1690/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000003656 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 24360 Comm: syz.3.7642 Not tainted 6.14.0-rc2-syzkaller-00162-g68763b29e0a6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================
loop3: p88 size 108986237 extends beyond EOD, truncated
loop3: p89 size 108986237 extends beyond EOD, truncated
loop3: p90 size 108986237 extends beyond EOD, truncated
loop3: p91 size 108986237 extends beyond EOD, truncated
loop3: p92 size 108986237 extends beyond EOD, truncated
loop3: p93 size 108986237 extends beyond EOD, truncated
loop3: p94 size 108986237 extends beyond EOD, truncated
loop3: p95 size 108986237 extends beyond EOD, truncated
loop3: p96 size 108986237 extends beyond EOD, truncated
loop3: p97 size 108986237 extends beyond EOD, truncated
loop3: p98 size 108986237 extends beyond EOD, truncated
loop3: p99 size 108986237 extends beyond EOD, truncated
loop3: p100 size 108986237 extends beyond EOD, truncated
loop3: p101 size 108986237 extends beyond EOD, truncated
loop3: p102 size 108986237 extends beyond EOD, truncated
loop3: p103 size 108986237 extends beyond EOD, truncated
loop3: p104 size 108986237 extends beyond EOD, truncated
loop3: p105 size 108986237 extends beyond EOD, truncated
loop3: p106 size 108986237 extends beyond EOD, truncated
loop3: p107 size 108986237 extends beyond EOD, truncated
loop3: p108 size 108986237 extends beyond EOD, truncated
loop3: p109 size 108986237 extends beyond EOD, truncated
loop3: p110 size 108986237 extends beyond EOD, truncated
loop3: p111 size 108986237 extends beyond EOD, truncated
loop3: p112 size 108986237 extends beyond EOD, truncated
loop3: p113 size 108986237 extends beyond EOD, truncated
loop3: p114 size 108986237 extends beyond EOD, truncated
loop3: p115 size 108986237 extends beyond EOD, truncated
loop3: p116 size 108986237 extends beyond EOD, truncated
loop3: p117 size 108986237 extends beyond EOD, truncated
loop3: p118 size 108986237 extends beyond EOD, truncated
loop3: p119 size 108986237 extends beyond EOD, truncated
loop3: p120 size 108986237 extends beyond EOD, truncated
loop3: p121 size 108986237 extends beyond EOD, truncated
loop3: p122 size 108986237 extends beyond EOD, truncated
loop3: p123 size 108986237 extends beyond EOD, truncated
loop3: p124 size 108986237 extends beyond EOD, truncated
loop3: p125 size 108986237 extends beyond EOD, truncated
loop3: p126 size 108986237 extends beyond EOD, truncated
loop3: p127 size 108986237 extends beyond EOD, truncated
loop3: p128 size 108986237 extends beyond EOD, truncated
loop3: p129 size 108986237 extends beyond EOD, truncated
loop3: p130 size 108986237 extends beyond EOD, truncated
loop3: p131 size 108986237 extends beyond EOD, truncated
loop3: p132 size 108986237 extends beyond EOD, truncated
loop3: p133 size 108986237 extends beyond EOD, truncated
loop3: p134 size 108986237 extends beyond EOD, truncated
loop3: p135 size 108986237 extends beyond EOD, truncated
loop3: p136 size 108986237 extends beyond EOD, truncated
loop3: p137 size 108986237 extends beyond EOD, truncated
loop3: p138 size 108986237 extends beyond EOD, truncated
loop3: p139 size 108986237 extends beyond EOD, truncated
loop3: p140 size 108986237 extends beyond EOD, truncated
loop3: p141 size 108986237 extends beyond EOD, truncated
loop3: p142 size 108986237 extends beyond EOD, truncated
loop3: p143 size 108986237 extends beyond EOD, truncated
loop3: p144 size 108986237 extends beyond EOD, truncated
loop3: p145 size 108986237 extends beyond EOD, truncated
loop3: p146 size 108986237 extends beyond EOD, truncated
loop3: p147 size 108986237 extends beyond EOD, truncated
loop3: p148 size 108986237 extends beyond EOD, truncated
loop3: p149 size 108986237 extends beyond EOD, truncated
loop3: p150 size 108986237 extends beyond EOD, truncated
loop3: p151 size 108986237 extends beyond EOD, truncated
loop3: p152 size 108986237 extends beyond EOD, truncated
loop3: p153 size 108986237 extends beyond EOD, truncated
loop3: p154 size 108986237 extends beyond EOD, truncated
loop3: p155 size 108986237 extends beyond EOD, truncated
loop3: p156 size 108986237 extends beyond EOD, truncated
loop3: p157 size 108986237 extends beyond EOD, truncated
loop3: p158 size 108986237 extends beyond EOD, truncated
loop3: p159 size 108986237 extends beyond EOD, truncated
loop3: p160 size 108986237 extends beyond EOD, truncated
loop3: p161 size 108986237 extends beyond EOD, truncated
loop3: p162 size 108986237 extends beyond EOD, truncated
loop3: p163 size 108986237 extends beyond EOD, truncated
loop3: p164 size 108986237 extends beyond EOD, truncated
loop3: p165 size 108986237 extends beyond EOD, truncated
loop3: p166 size 108986237 extends beyond EOD, truncated
loop3: p167 size 108986237 extends beyond EOD, truncated
loop3: p168 size 108986237 extends beyond EOD, truncated
loop3: p169 size 108986237 extends beyond EOD, truncated
loop3: p170 size 108986237 extends beyond EOD, truncated
loop3: p171 size 108986237 extends beyond EOD, truncated
loop3: p172 size 108986237 extends beyond EOD, truncated
loop3: p173 size 108986237 extends beyond EOD, truncated
loop3: p174 size 108986237 extends beyond EOD, truncated
loop3: p175 size 108986237 extends beyond EOD, truncated
loop3: p176 size 108986237 extends beyond EOD, truncated
loop3: p177 size 108986237 extends beyond EOD, truncated
loop3: p178 size 108986237 extends beyond EOD, truncated
loop3: p179 size 108986237 extends beyond EOD, truncated
loop3: p180 size 108986237 extends beyond EOD, truncated
loop3: p181 size 108986237 extends beyond EOD, truncated
loop3: p182 size 108986237 extends beyond EOD, truncated
loop3: p183 size 108986237 extends beyond EOD, truncated
loop3: p184 size 108986237 extends beyond EOD, truncated
loop3: p185 size 108986237 extends beyond EOD, truncated
loop3: p186 size 108986237 extends beyond EOD, truncated
loop3: p187 size 108986237 extends beyond EOD, truncated
loop3: p188 size 108986237 extends beyond EOD, truncated
loop3: p189 size 108986237 extends beyond EOD, truncated
loop3: p190 size 108986237 extends beyond EOD, truncated
loop3: p191 size 108986237 extends beyond EOD, truncated
loop3: p192 size 108986237 extends beyond EOD, truncated
loop3: p193 size 108986237 extends beyond EOD, truncated
loop3: p194 size 108986237 extends beyond EOD, truncated
loop3: p195 size 108986237 extends beyond EOD, truncated
loop3: p196 size 108986237 extends beyond EOD, truncated
loop3: p197 size 108986237 extends beyond EOD, truncated
loop3: p198 size 108986237 extends beyond EOD, truncated
loop3: p199 size 108986237 extends beyond EOD, truncated
loop3: p200 size 108986237 extends beyond EOD, truncated
loop3: p201 size 108986237 extends beyond EOD, truncated
loop3: p202 size 108986237 extends beyond EOD, truncated
loop3: p203 size 108986237 extends beyond EOD, truncated
loop3: p204 size 108986237 extends beyond EOD, truncated
loop3: p205 size 108986237 extends beyond EOD, truncated
loop3: p206 size 108986237 extends beyond EOD, truncated
loop3: p207 size 108986237 extends beyond EOD, truncated
loop3: p208 size 108986237 extends beyond EOD, truncated
loop3: p209 size 108986237 extends beyond EOD, truncated
loop3: p210 size 108986237 extends beyond EOD, truncated
loop3: p211 size 108986237 extends beyond EOD, truncated
loop3: p212 size 108986237 extends beyond EOD, truncated
loop3: p213 size 108986237 extends beyond EOD, truncated
loop3: p214 size 108986237 extends beyond EOD, truncated
loop3: p215 size 108986237 extends beyond EOD, truncated
loop3: p216 size 108986237 extends beyond EOD, truncated
loop3: p217 size 108986237 extends beyond EOD, truncated
loop3: p218 size 108986237 extends beyond EOD, truncated
loop3: p219 size 108986237 extends beyond EOD, truncated
loop3: p220 size 108986237 extends beyond EOD, truncated
loop3: p221 size 108986237 extends beyond EOD, truncated
loop3: p222 size 108986237 extends beyond EOD, truncated
loop3: p223 size 108986237 extends beyond EOD, truncated
loop3: p224 size 108986237 extends beyond EOD, truncated
loop3: p225 size 108986237 extends beyond EOD, truncated
loop3: p226 size 108986237 extends beyond EOD, truncated
loop3: p227 size 108986237 extends beyond EOD, truncated
loop3: p228 size 108986237 extends beyond EOD, truncated
loop3: p229 size 108986237 extends beyond EOD, truncated
loop3: p230 size 108986237 extends beyond EOD, truncated
loop3: p231 size 108986237 extends beyond EOD, truncated
loop3: p232 size 108986237 extends beyond EOD, truncated
loop3: p233 size 108986237 extends beyond EOD, truncated
loop3: p234 size 108986237 extends beyond EOD, truncated
loop3: p235 size 108986237 extends beyond EOD, truncated
loop3: p236 size 108986237 extends beyond EOD, truncated
loop3: p237 size 108986237 extends beyond EOD, truncated
loop3: p238 size 108986237 extends beyond EOD, truncated
loop3: p239 size 108986237 extends beyond EOD, truncated
loop3: p240 size 108986237 extends beyond EOD, truncated
loop3: p241 size 108986237 extends beyond EOD, truncated
loop3: p242 size 108986237 extends beyond EOD, truncated
loop3: p243 size 108986237 extends beyond EOD, truncated
loop3: p244 size 108986237 extends beyond EOD, truncated
loop3: p245 size 108986237 extends beyond EOD, truncated
loop3: p246 size 108986237 extends beyond EOD, truncated
loop3: p247 size 108986237 extends beyond EOD, truncated
loop3: p248 size 108986237 extends beyond EOD, truncated
loop3: p249 size 108986237 extends beyond EOD, truncated
loop3: p250 size 108986237 extends beyond EOD, truncated
loop3: p251 size 108986237 extends beyond EOD, truncated
loop3: p252 size 108986237 extends beyond EOD, truncated
loop3: p253 size 108986237 extends beyond EOD, truncated
loop3: p254 size 108986237 extends beyond EOD, truncated
loop3: p255 size 108986237 extends beyond EOD, truncated


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.