KCSAN: data-race in data_push_tail / symbol_string (14)

Status: moderation: reported on 2026/09/23 23:17
Subsystems: kernel
Labels: race:benign
[Documentation on labels]
Reported-by: syzbot+9ca828a9e84d70d1d949@syzkaller.appspotmail.com
First crash: 16h12m, last: 16h12m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
1f023d2b assessment-kcsan Benign: ✅ KCSAN: data-race in data_push_tail / symbol_string (14) 2026/09/23 23:17 2026/09/23 23:17 2026/09/24 00:04 0a1606bc
Similar bugs (13)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / symbol_string (3) kernel 6 1 1667d 1667d 0/29 auto-closed as invalid on 2022/04/05 16:28
upstream KCSAN: data-race in data_push_tail / symbol_string (10) kernel 6 1 500d 500d 0/29 auto-obsoleted due to no activity on 2025/07/07 00:26
upstream KCSAN: data-race in data_push_tail / symbol_string (7) kernel 6 2 938d 940d 0/29 auto-obsoleted due to no activity on 2024/04/04 01:53
upstream KCSAN: data-race in data_push_tail / symbol_string kernel 6 1 1926d 1926d 0/29 auto-closed as invalid on 2021/07/21 00:16
upstream KCSAN: data-race in data_push_tail / symbol_string (13) race:benign prio:high kernel 6 1 121d 121d 0/29 auto-obsoleted due to no activity on 2026/07/21 13:43
upstream KCSAN: data-race in data_push_tail / symbol_string (9) kernel 6 1 601d 601d 0/29 auto-obsoleted due to no activity on 2025/03/27 22:14
upstream KCSAN: data-race in data_push_tail / symbol_string (6) kernel 6 1 1034d 1024d 0/29 auto-obsoleted due to no activity on 2023/12/29 16:49
upstream KCSAN: data-race in data_push_tail / symbol_string (5) kernel 6 4 1077d 1152d 0/29 auto-obsoleted due to no activity on 2023/11/17 08:46
upstream KCSAN: data-race in data_push_tail / symbol_string (4) kernel 6 2 1246d 1272d 0/29 auto-obsoleted due to no activity on 2023/06/01 14:03
upstream KCSAN: data-race in data_push_tail / symbol_string (12) kernel 6 2 266d 297d 0/29 auto-obsoleted due to no activity on 2026/02/26 12:42
upstream KCSAN: data-race in data_push_tail / symbol_string (11) kernel 6 1 397d 397d 0/29 auto-obsoleted due to no activity on 2025/10/18 10:19
upstream KCSAN: data-race in data_push_tail / symbol_string (8) kernel 6 1 661d 661d 0/29 auto-obsoleted due to no activity on 2025/01/26 20:37
upstream KCSAN: data-race in data_push_tail / symbol_string (2) kernel 6 1 1747d 1747d 0/29 auto-closed as invalid on 2022/01/16 12:11

Sample crash report:
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
==================================================================
BUG: KCSAN: data-race in data_push_tail / symbol_string

write to 0xffffffff895b7f18 of 1 bytes by task 6715 on cpu 1:
 string_nocheck lib/vsprintf.c:652 [inline]
 symbol_string+0x1c9/0x260 lib/vsprintf.c:1009
 pointer+0x681/0xc90 lib/vsprintf.c:2543
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2953
 vscnprintf+0x41/0x90 lib/vsprintf.c:3018
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x57f/0x910 kernel/printk/printk.c:2364
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 printk_stack_address arch/x86/kernel/dumpstack.c:70 [inline]
 __show_trace_log_lvl+0x460/0x560 arch/x86/kernel/dumpstack.c:282
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x95/0xd0 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x262/0x280 lib/fault-inject.c:174
 should_fail+0xb/0x20 lib/fault-inject.c:184
 should_fail_futex kernel/futex/core.c:101 [inline]
 get_futex_key+0x12d/0xb10 kernel/futex/core.c:534
 futex_wait_setup+0x49/0x3e0 kernel/futex/waitwake.c:648
 __futex_wait+0xa9/0x260 kernel/futex/waitwake.c:717
 futex_wait+0x98/0x1c0 kernel/futex/waitwake.c:750
 do_futex+0x391/0x460 kernel/futex/syscalls.c:133
 __do_sys_futex kernel/futex/syscalls.c:210 [inline]
 __se_sys_futex+0x2f6/0x370 kernel/futex/syscalls.c:191
 __x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:191
 x64_sys_call+0x22e2/0x2550 arch/x86/include/generated/asm/syscalls_64.h:203
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895b7f18 of 8 bytes by task 3313 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54e/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 __ext4_error_file+0x330/0x3f0 fs/ext4/super.c:896
 __ext4_check_dir_entry+0x4e6/0x540 fs/ext4/dir.c:115
 ext4_readdir+0xcb1/0x2040 fs/ext4/dir.c:278
 iterate_dir+0x109/0x2f0 fs/readdir.c:110
 __do_sys_getdents64 fs/readdir.c:399 [inline]
 __se_sys_getdents64+0xd2/0x230 fs/readdir.c:384
 __x64_sys_getdents64+0x43/0x50 fs/readdir.c:384
 x64_sys_call+0x2387/0x2550 arch/x86/include/generated/asm/syscalls_64.h:218
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x3fffffffffffe115 -> 0x2b6c766c5f6b6361

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3313 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/23 23:17 upstream fe2ec83746e5 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / symbol_string
* Struck through repros no longer work on HEAD.