syzbot


KCSAN: data-race in data_push_tail / uuid_string (5)

Status: moderation: reported on 2026/01/01 12:37
Subsystems: ext4
[Documentation on labels]
Reported-by: syzbot+89982c0d93c295e88d08@syzkaller.appspotmail.com
First crash: 29d, last: 9d18h
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / uuid_string (3) ext4 6 1 652d 652d 0/29 auto-obsoleted due to no activity on 2024/05/24 03:21
upstream KCSAN: data-race in data_push_tail / uuid_string (4) ext4 6 1 446d 446d 0/29 auto-obsoleted due to no activity on 2025/01/05 15:54
upstream KCSAN: data-race in data_push_tail / uuid_string ext4 6 4 860d 939d 0/29 auto-obsoleted due to no activity on 2023/10/28 05:07
upstream KCSAN: data-race in data_push_tail / uuid_string (2) ext4 6 1 789d 785d 0/29 auto-obsoleted due to no activity on 2024/01/09 18:19

Sample crash report:
EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.
==================================================================
BUG: KCSAN: data-race in data_push_tail / uuid_string

write to 0xffffffff89119aa0 of 1 bytes by task 10149 on cpu 0:
 string_nocheck lib/vsprintf.c:658 [inline]
 uuid_string+0x3c4/0x440 lib/vsprintf.c:1771
 pointer+0x3b5/0xcb0 lib/vsprintf.c:2566
 vsnprintf+0x491/0x860 lib/vsprintf.c:2951
 va_format lib/vsprintf.c:1722 [inline]
 pointer+0x821/0xcb0 lib/vsprintf.c:2568
 vsnprintf+0x491/0x860 lib/vsprintf.c:2951
 vscnprintf+0x41/0x90 lib/vsprintf.c:3012
 printk_sprint+0x30/0x2c0 kernel/printk/printk.c:2192
 vprintk_store+0x57b/0x910 kernel/printk/printk.c:2312
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2402
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2451
 __ext4_msg+0x1aa/0x1c0 fs/ext4/super.c:990
 ext4_fill_super+0x2ff1/0x3800 fs/ext4/super.c:5792
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1691
 get_tree_bdev+0x1f/0x30 fs/super.c:1714
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5809
 vfs_get_tree+0x57/0x1d0 fs/super.c:1751
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x288/0x700 fs/namespace.c:3712
 path_mount+0x4c0/0xb90 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff89119aa0 of 8 bytes by task 8513 on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x100/0x470 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x11b/0x390 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8d7/0xae0 kernel/printk/printk_ringbuffer.c:1724
 vprintk_store+0x54a/0x910 kernel/printk/printk.c:2302
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2402
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2451
 __ext4_msg+0x1aa/0x1c0 fs/ext4/super.c:990
 ext4_put_super+0x90/0x7d0 fs/ext4/super.c:1295
 generic_shutdown_super+0xe6/0x210 fs/super.c:643
 kill_block_super+0x2a/0x70 fs/super.c:1722
 ext4_kill_sb+0x42/0x80 fs/ext4/super.c:7444
 deactivate_locked_super+0x75/0x1c0 fs/super.c:474
 deactivate_super+0x97/0xa0 fs/super.c:507
 cleanup_mnt+0x2bb/0x330 fs/namespace.c:1318
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1325
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0x1f7/0x6f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x1d3/0x2a0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffec9c -> 0x6436662d32656235

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8513 Comm: syz-executor Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/21 10:12 upstream 6c790212c588 6f1aa2f9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
2026/01/01 12:36 upstream b69053dd3ffb d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
* Struck through repros no longer work on HEAD.