syzbot
KCSAN: data-race in data_push_tail / symbol_string (14)
Status:
moderation: reported on 2026/09/23 23:17
Subsystems:
kernel
Labels:
race:benign
[Documentation on labels]
Reported-by: syzbot+9ca828a9e84d70d1d949@syzkaller.appspotmail.com
First crash: 16h12m, last: 16h12m
Sample crash report:
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
==================================================================
BUG: KCSAN: data-race in data_push_tail / symbol_string
write to 0xffffffff895b7f18 of 1 bytes by task 6715 on cpu 1:
string_nocheck lib/vsprintf.c:652 [inline]
symbol_string+0x1c9/0x260 lib/vsprintf.c:1009
pointer+0x681/0xc90 lib/vsprintf.c:2543
vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2953
vscnprintf+0x41/0x90 lib/vsprintf.c:3018
printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
vprintk_store+0x57f/0x910 kernel/printk/printk.c:2364
vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x79/0xa0 kernel/printk/printk.c:2504
printk_stack_address arch/x86/kernel/dumpstack.c:70 [inline]
__show_trace_log_lvl+0x460/0x560 arch/x86/kernel/dumpstack.c:282
__dump_stack+0x1d/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x95/0xd0 lib/dump_stack.c:120
dump_stack+0x15/0x1b lib/dump_stack.c:129
fail_dump lib/fault-inject.c:73 [inline]
should_fail_ex+0x262/0x280 lib/fault-inject.c:174
should_fail+0xb/0x20 lib/fault-inject.c:184
should_fail_futex kernel/futex/core.c:101 [inline]
get_futex_key+0x12d/0xb10 kernel/futex/core.c:534
futex_wait_setup+0x49/0x3e0 kernel/futex/waitwake.c:648
__futex_wait+0xa9/0x260 kernel/futex/waitwake.c:717
futex_wait+0x98/0x1c0 kernel/futex/waitwake.c:750
do_futex+0x391/0x460 kernel/futex/syscalls.c:133
__do_sys_futex kernel/futex/syscalls.c:210 [inline]
__se_sys_futex+0x2f6/0x370 kernel/futex/syscalls.c:191
__x64_sys_futex+0x78/0x90 kernel/futex/syscalls.c:191
x64_sys_call+0x22e2/0x2550 arch/x86/include/generated/asm/syscalls_64.h:203
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
read to 0xffffffff895b7f18 of 8 bytes by task 3313 on cpu 0:
data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
vprintk_store+0x54e/0x910 kernel/printk/printk.c:2354
vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x79/0xa0 kernel/printk/printk.c:2504
__ext4_error_file+0x330/0x3f0 fs/ext4/super.c:896
__ext4_check_dir_entry+0x4e6/0x540 fs/ext4/dir.c:115
ext4_readdir+0xcb1/0x2040 fs/ext4/dir.c:278
iterate_dir+0x109/0x2f0 fs/readdir.c:110
__do_sys_getdents64 fs/readdir.c:399 [inline]
__se_sys_getdents64+0xd2/0x230 fs/readdir.c:384
__x64_sys_getdents64+0x43/0x50 fs/readdir.c:384
x64_sys_call+0x2387/0x2550 arch/x86/include/generated/asm/syscalls_64.h:218
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
value changed: 0x3fffffffffffe115 -> 0x2b6c766c5f6b6361
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3313 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs error (device loop3): ext4_readdir:280: inode #11: block 4: comm syz-executor: path /134/file1/lost+found: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs error (device loop3): ext4_empty_dir:3093: inode #11: block 4: comm syz-executor: bad entry in directory: inode out of bounds - offset=0, inode=7947, rec_len=12, size=4096 fake=1
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
EXT4-fs warning (device loop3): ext4_empty_dir:3096: inode #11: comm syz-executor: directory missing '.'
* Struck through repros no longer work on HEAD.