EXT4-fs (loop6): orphan cleanup on readonly fs
EXT4-fs error (device loop6): ext4_mb_mark_diskspace_used:4215: comm syz.6.2134: Allocating blocks 41-42 which overlap fs metadata
EXT4-fs error (device loop6): ext4_mb_mark_diskspace_used:4215: comm syz.6.2134: Allocating blocks 41-42 which overlap fs metadata
==================================================================
BUG: KCSAN: data-race in data_push_tail / vsnprintf

write to 0xffffffff89112b70 of 1 bytes by task 12653 on cpu 0:
 vsnprintf+0x2ce/0x860 lib/vsprintf.c:2898
 vscnprintf+0x41/0x90 lib/vsprintf.c:3012
 printk_sprint+0x30/0x2c0 kernel/printk/printk.c:2192
 vprintk_store+0x57b/0x910 kernel/printk/printk.c:2312
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2402
 dev_vprintk_emit+0x242/0x2a0 drivers/base/core.c:4914
 dev_printk_emit+0x84/0xb0 drivers/base/core.c:4925
 __dev_printk+0xf3/0x110 drivers/base/core.c:4937
 _dev_info+0xa6/0xd0 drivers/base/core.c:4983
 attach_store+0x495/0x680 drivers/usb/usbip/vhci_sysfs.c:416
 dev_attr_store+0x4a/0x70 drivers/base/core.c:2437
 sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:142
 kernfs_fop_write_iter+0x1eb/0x300 fs/kernfs/file.c:352
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x5a6/0x9f0 fs/read_write.c:686
 ksys_write+0xdc/0x1a0 fs/read_write.c:738
 __do_sys_write fs/read_write.c:749 [inline]
 __se_sys_write fs/read_write.c:746 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:746
 x64_sys_call+0x2847/0x3000 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff89112b70 of 8 bytes by task 12651 on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x100/0x470 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x11b/0x390 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8d7/0xae0 kernel/printk/printk_ringbuffer.c:1724
 vprintk_store+0x54a/0x910 kernel/printk/printk.c:2302
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2402
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2451
 __ext4_error+0x271/0x350 fs/ext4/super.c:822
 ext4_mb_mark_diskspace_used+0x26d/0x3b0 fs/ext4/mballoc.c:4214
 ext4_mb_new_blocks+0xa6d/0x2080 fs/ext4/mballoc.c:6335
 ext4_ext_map_blocks+0x106d/0x38a0 fs/ext4/extents.c:4383
 ext4_map_create_blocks fs/ext4/inode.c:613 [inline]
 ext4_map_blocks+0x65e/0xd70 fs/ext4/inode.c:816
 ext4_getblk+0x128/0x530 fs/ext4/inode.c:984
 ext4_bread+0x28/0x110 fs/ext4/inode.c:1047
 ext4_quota_write+0x166/0x360 fs/ext4/super.c:7350
 write_blk fs/quota/quota_tree.c:70 [inline]
 put_free_dqblk+0xe1/0x1b0 fs/quota/quota_tree.c:157
 do_insert_tree+0x808/0x9b0 fs/quota/quota_tree.c:409
 do_insert_tree+0x753/0x9b0 fs/quota/quota_tree.c:402
 do_insert_tree+0x753/0x9b0 fs/quota/quota_tree.c:402
 do_insert_tree+0x731/0x9b0 fs/quota/quota_tree.c:402
 dq_insert_tree fs/quota/quota_tree.c:432 [inline]
 qtree_write_dquot+0x2cb/0x300 fs/quota/quota_tree.c:451
 v2_write_dquot+0xd9/0x130 fs/quota/quota_v2.c:372
 dquot_acquire+0x1c2/0x2b0 fs/quota/dquot.c:473
 ext4_acquire_dquot+0x15f/0x200 fs/ext4/super.c:6982
 dqget+0x527/0x8c0 fs/quota/dquot.c:980
 __dquot_initialize+0x20c/0x7c0 fs/quota/dquot.c:1508
 dquot_initialize+0x1a/0x30 fs/quota/dquot.c:1570
 ext4_process_orphan+0x32/0x1c0 fs/ext4/orphan.c:327
 ext4_orphan_cleanup+0x6a8/0xa00 fs/ext4/orphan.c:472
 __ext4_fill_super fs/ext4/super.c:5658 [inline]
 ext4_fill_super+0x3476/0x3800 fs/ext4/super.c:5777
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1691
 get_tree_bdev+0x1f/0x30 fs/super.c:1714
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5809
 vfs_get_tree+0x57/0x1d0 fs/super.c:1751
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x288/0x700 fs/namespace.c:3712
 path_mount+0x4c0/0xb90 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffe99d -> 0x63685f6963687620

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12651 Comm: syz.6.2134 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================
EXT4-fs error (device loop6): ext4_acquire_dquot:6986: comm syz.6.2134: Failed to acquire dquot type 1
EXT4-fs error (device loop6): mb_free_blocks:2037: group 0, 
inode 12: 
block 14:
freeing already freed block (bit 14); block bitmap corrupt.
EXT4-fs error (device loop6): ext4_do_update_inode:5617: inode #12: comm syz.6.2134: corrupted inode contents
EXT4-fs error (device loop6): ext4_dirty_inode:6502: inode #12: comm syz.6.2134: mark_inode_dirty error
EXT4-fs error (device loop6): ext4_do_update_inode:5617: inode #12: comm syz.6.2134: corrupted inode contents
EXT4-fs error (device loop6): __ext4_ext_dirty:206: inode #12: comm syz.6.2134: mark_inode_dirty error
EXT4-fs error (device loop6): ext4_do_update_inode:5617: inode #12: comm syz.6.2134: corrupted inode contents
EXT4-fs error (device loop6) in ext4_orphan_del:303: Corrupt filesystem
EXT4-fs error (device loop6): ext4_do_update_inode:5617: inode #12: comm syz.6.2134: corrupted inode contents
EXT4-fs error (device loop6): ext4_truncate:4635: inode #12: comm syz.6.2134: mark_inode_dirty error
EXT4-fs error (device loop6) in ext4_process_orphan:345: Corrupt filesystem
EXT4-fs (loop6): 1 truncate cleaned up
EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000.