syzbot

EXT4-fs (loop3): error count since last fsck: 1
EXT4-fs (loop3): initial error at time 4389: ext4_clear_blocks:876: inode 13
EXT4-fs (loop3): last error at time 4389: ext4_clear_blocks:876
==================================================================
BUG: KCSAN: data-race in data_push_tail / vsnprintf

write to 0xffffffff893ca38e of 45 bytes by task 17978 on cpu 0:
 vsnprintf+0x2c0/0x8c0 lib/vsprintf.c:2896
 va_format lib/vsprintf.c:1725 [inline]
 pointer+0x844/0xc90 lib/vsprintf.c:2573
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2949
 vscnprintf+0x41/0x90 lib/vsprintf.c:3014
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x4b0/0x910 kernel/printk/printk.c:2329
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 __ext4_grp_locked_error+0x5d8/0x7a0 fs/ext4/super.c:1074
 ext4_mb_generate_buddy+0x3ae/0x470 fs/ext4/mballoc.c:1314
 ext4_mb_init_cache+0x88e/0xbc0 fs/ext4/mballoc.c:1499
 ext4_mb_init_group+0x3d6/0x580 fs/ext4/mballoc.c:1638
 ext4_mb_load_buddy_gfp+0x863/0x8c0 fs/ext4/mballoc.c:1705
 ext4_mb_clear_bb fs/ext4/mballoc.c:6580 [inline]
 ext4_free_blocks+0x751/0x13f0 fs/ext4/mballoc.c:6782
 ext4_free_branches+0x2e2/0x3f0 fs/ext4/indirect.c:1083
 ext4_free_branches+0x1df/0x3f0 fs/ext4/indirect.c:1042
 ext4_free_branches+0x1df/0x3f0 fs/ext4/indirect.c:1042
 ext4_ind_truncate+0x7ee/0x840 fs/ext4/indirect.c:1208
 ext4_truncate+0x66a/0xa10 fs/ext4/inode.c:4670
 ext4_process_orphan+0x10b/0x1c0 fs/ext4/orphan.c:337
 ext4_orphan_cleanup+0x6a6/0xa10 fs/ext4/orphan.c:472
 __ext4_fill_super fs/ext4/super.c:5705 [inline]
 ext4_fill_super+0x33ab/0x3760 fs/ext4/super.c:5828
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1634
 get_tree_bdev+0x1f/0x30 fs/super.c:1657
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5860
 vfs_get_tree+0x57/0x1d0 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x288/0x8d0 fs/namespace.c:3841
 path_mount+0x4ad/0xb90 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4367
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4367
 x64_sys_call+0x2d61/0x3020 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893ca3b0 of 8 bytes by interrupt on cpu 1:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54a/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x600 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 print_daily_error_info+0x210/0x300 fs/ext4/super.c:3715
 call_timer_fn+0x3b/0x240 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x40c/0x5f0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2405
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 its_return_thunk+0x0/0x10
 constant_test_bit arch/x86/include/asm/bitops.h:202 [inline]
 arch_test_bit arch/x86/include/asm/bitops.h:232 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
 folio_test_swapbacked include/linux/page-flags.h:572 [inline]
 mm_counter_file include/linux/mm.h:3380 [inline]
 mm_counter include/linux/mm.h:3389 [inline]
 zap_present_folio_ptes mm/memory.c:1658 [inline]
 zap_present_ptes mm/memory.c:1730 [inline]
 do_zap_pte_range mm/memory.c:1832 [inline]
 zap_pte_range mm/memory.c:1934 [inline]
 zap_pmd_range mm/memory.c:2020 [inline]
 zap_pud_range mm/memory.c:2048 [inline]
 zap_p4d_range mm/memory.c:2069 [inline]
 __zap_vma_range+0x13c2/0x2c60 mm/memory.c:2109
 unmap_vmas+0x200/0x310 mm/memory.c:2178
 exit_mmap+0x1a2/0x5e0 mm/mmap.c:1300
 __mmput+0x28/0x1c0 kernel/fork.c:1187
 mmput+0x40/0x50 kernel/fork.c:1210
 exit_mm+0x113/0x1a0 kernel/exit.c:610
 do_exit+0x438/0x1500 kernel/exit.c:992
 do_group_exit+0xfe/0x140 kernel/exit.c:1147
 get_signal+0xe07/0xf10 kernel/signal.c:3038
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x15d/0x8c0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x23c/0x3c0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000003f7e -> 0x6e65747369736e6f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 17981 Comm: syz.5.11357 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================