KCSAN: data-race in data_push_tail / uuid_string (7)

Status: moderation: reported on 2026/09/23 00:30
Subsystems: ext4
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+144e00d3b0af474fddfa@syzkaller.appspotmail.com
First crash: 45d, last: 24d
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
94c82d25 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ✅ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ✅ ❓ KCSAN: data-race in data_push_tail / uuid_string (7) 2026/09/24 10:03 2026/09/24 10:03 2026/09/24 10:31 3c3cdf19
66818979 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in data_push_tail / uuid_string (7) 2026/09/23 00:33 2026/09/23 00:33 2026/09/23 01:19 5207b90e
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / uuid_string (3) ext4 6 1 932d 932d 0/29 auto-obsoleted due to no activity on 2024/05/24 03:21
upstream KCSAN: data-race in data_push_tail / uuid_string (6) race:benign prio:high ext4 6 2 133d 159d 0/29 auto-obsoleted due to no activity on 2026/08/21 12:55
upstream KCSAN: data-race in data_push_tail / uuid_string (4) ext4 6 1 726d 726d 0/29 auto-obsoleted due to no activity on 2025/01/05 15:54
upstream KCSAN: data-race in data_push_tail / uuid_string ext4 6 4 1141d 1219d 0/29 auto-obsoleted due to no activity on 2023/10/28 05:07
upstream KCSAN: data-race in data_push_tail / uuid_string (5) ext4 6 2 289d 309d 0/29 auto-obsoleted due to no activity on 2026/03/18 10:12
upstream KCSAN: data-race in data_push_tail / uuid_string (2) ext4 6 1 1069d 1065d 0/29 auto-obsoleted due to no activity on 2024/01/09 18:19

Sample crash report:
EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
==================================================================
BUG: KCSAN: data-race in data_push_tail / uuid_string

write to 0xffffffff895ee628 of 1 bytes by task 9638 on cpu 0:
 string_nocheck lib/vsprintf.c:652 [inline]
 uuid_string+0x3ca/0x450 lib/vsprintf.c:1774
 pointer+0x3e2/0xc90 lib/vsprintf.c:2575
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2953
 va_format lib/vsprintf.c:1725 [inline]
 pointer+0x844/0xc90 lib/vsprintf.c:2577
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2953
 vscnprintf+0x41/0x90 lib/vsprintf.c:3018
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x57f/0x910 kernel/printk/printk.c:2364
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 __ext4_msg+0x1aa/0x1c0 fs/ext4/super.c:1001
 ext4_fill_super+0x2f5f/0x37b0 fs/ext4/super.c:5871
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1872
 get_tree_bdev+0x1f/0x30 fs/super.c:1895
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5888
 vfs_get_tree+0x57/0x1d0 fs/super.c:1932
 fc_mount fs/namespace.c:1278 [inline]
 do_new_mount_fc fs/namespace.c:3885 [inline]
 do_new_mount+0x288/0x730 fs/namespace.c:3961
 path_mount+0x4ad/0xb90 fs/namespace.c:4312
 do_mount fs/namespace.c:4325 [inline]
 __do_sys_mount fs/namespace.c:4543 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4520
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4520
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895ee628 of 8 bytes by task 9635 on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54e/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 __ext4_msg+0x1aa/0x1c0 fs/ext4/super.c:1001
 ext4_fill_super+0x2f5f/0x37b0 fs/ext4/super.c:5871
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1872
 get_tree_bdev+0x1f/0x30 fs/super.c:1895
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5888
 vfs_get_tree+0x57/0x1d0 fs/super.c:1932
 fc_mount fs/namespace.c:1278 [inline]
 do_new_mount_fc fs/namespace.c:3885 [inline]
 do_new_mount+0x288/0x730 fs/namespace.c:3961
 path_mount+0x4ad/0xb90 fs/namespace.c:4312
 do_mount fs/namespace.c:4325 [inline]
 __do_sys_mount fs/namespace.c:4543 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4520
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4520
 x64_sys_call+0xc3b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x3fffffffffffec0f -> 0x3030302d30303030

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9635 Comm: syz.1.1892 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
ext4 filesystem being mounted at /396/file0 supports timestamps until 2038-01-19 (0x7fffffff)
ip_tables: iptables: counters copy to user failed while replacing table
xt_CT: No such helper "syz1"

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/13 10:24 upstream 24a19b953e2a 5a1eeac4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
2026/09/23 00:29 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
* Struck through repros no longer work on HEAD.