syzbot


KCSAN: data-race in data_push_tail / uuid_string (6)

Status: moderation: reported on 2026/05/31 09:05
Subsystems: ext4
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+8a796968f6ec05e16d7a@syzkaller.appspotmail.com
First crash: 49d, last: 23d
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
7ef57387-0289-4931-9f41-b54fe6ef3fd1 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ✅ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ✅ KCSAN: data-race in data_push_tail / uuid_string (6) 2026/06/02 22:22 2026/06/02 22:22 2026/06/02 23:00 62fe15281f5011cd203d8845b8767b10e7443aa5

			
		
f86db4f2-826d-4562-8546-f810f685a8e6 assessment-kcsan Benign: ✅ KCSAN: data-race in data_push_tail / uuid_string (6) 2026/05/31 09:05 2026/05/31 09:05 2026/05/31 09:32 6b4a844333e83556da95d61d7f207e7ef5cd4bc6

			
		
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / uuid_string (3) ext4 6 1 821d 821d 0/29 auto-obsoleted due to no activity on 2024/05/24 03:21
upstream KCSAN: data-race in data_push_tail / uuid_string (4) ext4 6 1 616d 616d 0/29 auto-obsoleted due to no activity on 2025/01/05 15:54
upstream KCSAN: data-race in data_push_tail / uuid_string ext4 6 4 1030d 1108d 0/29 auto-obsoleted due to no activity on 2023/10/28 05:07
upstream KCSAN: data-race in data_push_tail / uuid_string (5) ext4 6 2 179d 199d 0/29 auto-obsoleted due to no activity on 2026/03/18 10:12
upstream KCSAN: data-race in data_push_tail / uuid_string (2) ext4 6 1 959d 955d 0/29 auto-obsoleted due to no activity on 2024/01/09 18:19

Sample crash report:
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
==================================================================
BUG: KCSAN: data-race in data_push_tail / uuid_string

write to 0xffffffff893b00a8 of 1 bytes by task 9966 on cpu 1:
 string_nocheck lib/vsprintf.c:652 [inline]
 uuid_string+0x3ca/0x450 lib/vsprintf.c:1774
 pointer+0x3e2/0xc90 lib/vsprintf.c:2571
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2949
 va_format lib/vsprintf.c:1725 [inline]
 pointer+0x844/0xc90 lib/vsprintf.c:2573
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2949
 vscnprintf+0x41/0x90 lib/vsprintf.c:3014
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x57b/0x910 kernel/printk/printk.c:2364
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 __ext4_msg+0x1aa/0x1c0 fs/ext4/super.c:1001
 ext4_fill_super+0x2f20/0x3760 fs/ext4/super.c:5843
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1634
 get_tree_bdev+0x1f/0x30 fs/super.c:1657
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5860
 vfs_get_tree+0x57/0x1d0 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x288/0x8d0 fs/namespace.c:3841
 path_mount+0x4ad/0xb90 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4367
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4367
 x64_sys_call+0x2d61/0x3020 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893b00a8 of 8 bytes by task 9973 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54a/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 fail_dump lib/fault-inject.c:66 [inline]
 should_fail_ex+0x246/0x270 lib/fault-inject.c:174
 should_failslab+0x8c/0xb0 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4567 [inline]
 slab_alloc_node mm/slub.c:4925 [inline]
 kmem_cache_alloc_noprof+0x7f/0x3c0 mm/slub.c:4959
 lsm_file_alloc security/security.c:171 [inline]
 security_file_alloc+0x32/0xf0 security/security.c:2406
 init_file+0x5b/0x1b0 fs/file_table.c:184
 alloc_empty_file+0x85/0x1e0 fs/file_table.c:266
 alloc_file fs/file_table.c:396 [inline]
 alloc_file_pseudo+0x92/0x120 fs/file_table.c:427
 __shmem_file_setup+0x226/0x260 mm/shmem.c:5804
 shmem_file_setup+0x3b/0x50 mm/shmem.c:5836
 memfd_alloc_file+0x4e/0x300 mm/memfd.c:471
 __do_sys_memfd_create mm/memfd.c:522 [inline]
 __se_sys_memfd_create+0x2e1/0x3b0 mm/memfd.c:505
 __x64_sys_memfd_create+0x31/0x40 mm/memfd.c:505
 x64_sys_call+0x1f22/0x3020 arch/x86/include/generated/asm/syscalls_64.h:320
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x3ffffffffffff371 -> 0x30302d303030302d

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9973 Comm: syz.9.1643 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================
CPU: 0 UID: 0 PID: 9973 Comm: syz.9.1643 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x95/0xd0 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x25e/0x270 lib/fault-inject.c:174
 should_failslab+0x8c/0xb0 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4567 [inline]
 slab_alloc_node mm/slub.c:4925 [inline]
 kmem_cache_alloc_noprof+0x7f/0x3c0 mm/slub.c:4959
 lsm_file_alloc security/security.c:171 [inline]
 security_file_alloc+0x32/0xf0 security/security.c:2406
 init_file+0x5b/0x1b0 fs/file_table.c:184
 alloc_empty_file+0x85/0x1e0 fs/file_table.c:266
 alloc_file fs/file_table.c:396 [inline]
 alloc_file_pseudo+0x92/0x120 fs/file_table.c:427
 __shmem_file_setup+0x226/0x260 mm/shmem.c:5804
 shmem_file_setup+0x3b/0x50 mm/shmem.c:5836
 memfd_alloc_file+0x4e/0x300 mm/memfd.c:471
 __do_sys_memfd_create mm/memfd.c:522 [inline]
 __se_sys_memfd_create+0x2e1/0x3b0 mm/memfd.c:505
 __x64_sys_memfd_create+0x31/0x40 mm/memfd.c:505
 x64_sys_call+0x1f22/0x3020 arch/x86/include/generated/asm/syscalls_64.h:320
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdbdb0dce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdbd9b2ee08 EFLAGS: 00000202 ORIG_RAX: 000000000000013f
RAX: ffffffffffffffda RBX: 0000000000000516 RCX: 00007fdbdb0dce59
RDX: 00007fdbd9b2eee0 RSI: 0000000000000000 RDI: 00007fdbdb17304f
RBP: 0000200000001340 R08: 00000000ffffffff R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000202 R12: 0000200000000000
R13: 00007fdbd9b2eee0 R14: 00007fdbd9b2eea0 R15: 0000200000001200
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/26 12:54 upstream 4edcdefd4083 7ff32d8b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
2026/05/31 09:05 upstream 9d87d0fc8c8e 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / uuid_string
* Struck through repros no longer work on HEAD.