[PATCH v2] printk: annotate the intentional data race on the data block id

[PATCH v2] printk: annotate the intentional data race on the data block id

[Nguyen Ngoc Thang]

data_alloc() stores the descriptor ID into a newly reserved data block
while data_make_reusable(), running from data_push_tail() on another CPU,
may still be loading the ID from the same area. The ringbuffer allows
this race: a stale or garbage ID simply fails the descriptor lookup or
the blk_lpos check. KCSAN nevertheless reports it.

Annotate the accesses with data_race() instead of READ_ONCE()/WRITE_ONCE(),
which would needlessly restrict compiler optimizations for a race that is
allowed by design. No functional change.

Reported-by: syzbot+8324b8fd984b86905a66@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=8324b8fd984b86905a66
Fixes: 896fbe20b4e2 ("printk: use the lockless ringbuffer")
Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>
---
v2: use data_race() instead of READ_ONCE()/WRITE_ONCE(), as suggested by
    John Ogness. v1: https://lore.kernel.org/all/20261011091755.303723-1-ngocthang2710.1999@gmail.com/

 kernel/printk/printk_ringbuffer.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/printk/printk_ringbuffer.c b/kernel/printk/printk_ringbuffer.c
index 85c0c854b3ce..ff25c55971e8 100644
--- a/kernel/printk/printk_ringbuffer.c
+++ b/kernel/printk/printk_ringbuffer.c
@@ -605,7 +605,7 @@ static bool data_make_reusable(struct printk_ringbuffer *rb,
 		 * sure it points back to this data block. If the check fails,
 		 * the data area has been recycled by another writer.
 		 */
-		id = blk->id; /* LMM(data_make_reusable:A) */
+		id = data_race(blk->id); /* LMM(data_make_reusable:A) */
 
 		d_state = desc_read(desc_ring, id, &desc,
 				    NULL, NULL); /* LMM(data_make_reusable:B) */
@@ -1113,7 +1113,7 @@ static char *data_alloc(struct printk_ringbuffer *rb, unsigned int size,
 					  next_lpos)); /* LMM(data_alloc:A) */
 
 	blk = to_block(data_ring, begin_lpos);
-	blk->id = id; /* LMM(data_alloc:B) */
+	data_race(blk->id = id); /* LMM(data_alloc:B) */
 
 	if (is_blk_wrapped(data_ring, begin_lpos, next_lpos)) {
 		/* Wrapping data blocks store their data at the beginning. */
@@ -1123,7 +1123,7 @@ static char *data_alloc(struct printk_ringbuffer *rb, unsigned int size,
 		 * Store the ID on the wrapped block for consistency.
 		 * The printk_ringbuffer does not actually use it.
 		 */
-		blk->id = id;
+		data_race(blk->id = id); /* see data_make_reusable:A */
 	}
 
 	blk_lpos->begin = begin_lpos;
@@ -1212,7 +1212,7 @@ static char *data_realloc(struct printk_ringbuffer *rb, unsigned int size,
 		 * Store the ID on the wrapped block for consistency.
 		 * The printk_ringbuffer does not actually use it.
 		 */
-		blk->id = id;
+		data_race(blk->id = id); /* see data_make_reusable:A */
 
 		if (!wrapped) {
 			/*
-- 
2.43.0

Re: [PATCH v2] printk: annotate the intentional data race on the data block id

[John Ogness]

On 2026-10-12, Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com> wrote:
> data_alloc() stores the descriptor ID into a newly reserved data block
> while data_make_reusable(), running from data_push_tail() on another CPU,
> may still be loading the ID from the same area. The ringbuffer allows
> this race: a stale or garbage ID simply fails the descriptor lookup or
> the blk_lpos check. KCSAN nevertheless reports it.
>
> Annotate the accesses with data_race() instead of READ_ONCE()/WRITE_ONCE(),
> which would needlessly restrict compiler optimizations for a race that is
> allowed by design. No functional change.
>
> Reported-by: syzbot+8324b8fd984b86905a66@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=8324b8fd984b86905a66
> Fixes: 896fbe20b4e2 ("printk: use the lockless ringbuffer")
> Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999@gmail.com>

Reviewed-by: John Ogness <john.ogness@linutronix.de>