syzbot

GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog
==================================================================
BUG: KCSAN: data-race in data_push_tail / number

write to 0xffffffff893cdba8 of 1 bytes by task 11357 on cpu 0:
 number+0x85e/0xb80 lib/vsprintf.c:566
 vsnprintf+0x68f/0x8c0 lib/vsprintf.c:2909
 vscnprintf+0x41/0x90 lib/vsprintf.c:3014
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x57b/0x910 kernel/printk/printk.c:2364
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 br_set_state+0x2b9/0x390 net/bridge/br_stp.c:57
 new_nbp+0x35c/0x430 net/bridge/br_if.c:450
 br_add_if+0x1e7/0xa60 net/bridge/br_if.c:592
 br_add_slave+0x2c/0x40 net/bridge/br_device.c:375
 do_set_master+0x37b/0x450 net/core/rtnetlink.c:3020
 do_setlink+0x976/0x2860 net/core/rtnetlink.c:3222
 rtnl_changelink net/core/rtnetlink.c:3849 [inline]
 __rtnl_newlink net/core/rtnetlink.c:4022 [inline]
 rtnl_newlink+0x1086/0x1400 net/core/rtnetlink.c:4159
 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x11e/0x220 net/netlink/af_netlink.c:2556
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7103
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x5a7/0x680 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x5be/0x6f0 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x411/0x470 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2255
 x64_sys_call+0x2d35/0x3020 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893cdba8 of 8 bytes by task 9263 on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54a/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 gred_dequeue+0x325/0x350 net/sched/sch_gred.c:273
 dequeue_skb net/sched/sch_generic.c:322 [inline]
 qdisc_restart net/sched/sch_generic.c:427 [inline]
 __qdisc_run+0x18b/0xc60 net/sched/sch_generic.c:445
 qdisc_run include/net/pkt_sched.h:120 [inline]
 __dev_xmit_skb net/core/dev.c:4294 [inline]
 __dev_queue_xmit+0x11dd/0x1e60 net/core/dev.c:4833
 dev_queue_xmit include/linux/netdevice.h:3446 [inline]
 neigh_hh_output include/net/neighbour.h:544 [inline]
 neigh_output include/net/neighbour.h:558 [inline]
 ip_finish_output2+0x752/0x8a0 net/ipv4/ip_output.c:236
 __ip_finish_output net/ipv4/ip_output.c:-1 [inline]
 ip_finish_output+0x112/0x290 net/ipv4/ip_output.c:324
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip_output+0xbd/0x1c0 net/ipv4/ip_output.c:437
 dst_output include/net/dst.h:471 [inline]
 ip_local_out+0xaa/0xd0 net/ipv4/ip_output.c:131
 iptunnel_xmit+0x3ba/0x6b0 net/ipv4/ip_tunnel_core.c:97
 udp_tunnel_xmit_skb+0x1bf/0x220 net/ipv4/udp_tunnel_core.c:187
 send4+0x4f4/0x5e0 drivers/net/wireguard/socket.c:85
 wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:174
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x12d/0x340 drivers/net/wireguard/send.c:276
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
 worker_thread+0x569/0x750 kernel/workqueue.c:3486
 kthread+0x221/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x3ffffffffffff7d9 -> 0x735f656764697262

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9263 Comm: kworker/1:19 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: wg-crypt-wg2 wg_packet_tx_worker
==================================================================