[moderation] [ext4?] KCSAN: data-race in data_push_tail / uuid_string (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1b8af6552cb7 Merge tag 'powerpc-6.7-3' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13c6a04ae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=efc18f367a3f97fa
dashboard link: https://syzkaller.appspot.com/bug?extid=36f772d61eb67698ca62
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [adilger...@dilger.ca linux...@vger.kernel.org linux-...@vger.kernel.org linux-...@vger.kernel.org ty...@mit.edu]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2dbebc9ea594/disk-1b8af655.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/41592181ba2a/vmlinux-1b8af655.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b72b3a6a43ae/bzImage-1b8af655.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+36f772...@syzkaller.appspotmail.com

EXT4-fs (loop0): orphan cleanup on readonly fs
EXT4-fs error (device loop0): ext4_xattr_ibody_find:2263: inode #15: comm syz-executor.0: corrupted in-inode xattr: bad e_name length
==================================================================
BUG: KCSAN: data-race in data_push_tail / uuid_string

write to 0xffffffff86eb2536 of 1 bytes by task 26075 on cpu 1:
string_nocheck lib/vsprintf.c:650 [inline]
uuid_string+0x435/0x4b0 lib/vsprintf.c:1731
pointer+0x3ee/0xd10 lib/vsprintf.c:2448
vsnprintf+0x861/0xe20 lib/vsprintf.c:2823
va_format lib/vsprintf.c:1683 [inline]
pointer+0x8a1/0xd10 lib/vsprintf.c:2450
vsnprintf+0x861/0xe20 lib/vsprintf.c:2823
vscnprintf+0x42/0x80 lib/vsprintf.c:2925
printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2124
vprintk_store+0x56f/0x800 kernel/printk/printk.c:2238
vprintk_emit+0xd0/0x5d0 kernel/printk/printk.c:2284
vprintk_default+0x26/0x30 kernel/printk/printk.c:2318
vprintk+0x71/0x80 kernel/printk/printk_safe.c:45
_printk+0x7a/0xa0 kernel/printk/printk.c:2328
__ext4_msg+0x18a/0x1a0 fs/ext4/super.c:1006
ext4_fill_super+0x1a1f/0x39a0 fs/ext4/super.c:5727
get_tree_bdev+0x272/0x300 fs/super.c:1598
ext4_get_tree+0x1c/0x20 fs/ext4/super.c:5744
vfs_get_tree+0x51/0x1b0 fs/super.c:1771
do_new_mount+0x203/0x660 fs/namespace.c:3337
path_mount+0x496/0xb30 fs/namespace.c:3664
do_mount fs/namespace.c:3677 [inline]
__do_sys_mount fs/namespace.c:3886 [inline]
__se_sys_mount+0x27f/0x2d0 fs/namespace.c:3863
__x64_sys_mount+0x67/0x80 fs/namespace.c:3863
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

read to 0xffffffff86eb2530 of 8 bytes by task 26072 on cpu 0:
data_make_reusable kernel/printk/printk_ringbuffer.c:590 [inline]
data_push_tail+0x102/0x430 kernel/printk/printk_ringbuffer.c:675
data_alloc+0xbe/0x2c0 kernel/printk/printk_ringbuffer.c:1046
prb_reserve+0x893/0xbc0 kernel/printk/printk_ringbuffer.c:1555
vprintk_store+0x53e/0x800 kernel/printk/printk.c:2228
vprintk_emit+0xd0/0x5d0 kernel/printk/printk.c:2284
vprintk_default+0x26/0x30 kernel/printk/printk.c:2318
vprintk+0x71/0x80 kernel/printk/printk_safe.c:45
_printk+0x7a/0xa0 kernel/printk/printk.c:2328
__ext4_error_inode+0x2d5/0x400 fs/ext4/super.c:869
check_xattrs+0x6ba/0x770 fs/ext4/xattr.c:294
__xattr_check_inode fs/ext4/xattr.c:315 [inline]
ext4_xattr_ibody_find+0x1a6/0x390 fs/ext4/xattr.c:2263
ext4_find_inline_data_nolock+0xb9/0x1f0 fs/ext4/inline.c:157
ext4_iget_extra_inode+0xdf/0x1a0 fs/ext4/inode.c:4630
__ext4_iget+0x12de/0x1e90 fs/ext4/inode.c:4897
ext4_orphan_get+0x140/0x3e0 fs/ext4/ialloc.c:1394
ext4_orphan_cleanup+0x5bc/0x9b0 fs/ext4/orphan.c:467
__ext4_fill_super fs/ext4/super.c:5591 [inline]
ext4_fill_super+0x3660/0x39a0 fs/ext4/super.c:5712
get_tree_bdev+0x272/0x300 fs/super.c:1598
ext4_get_tree+0x1c/0x20 fs/ext4/super.c:5744
vfs_get_tree+0x51/0x1b0 fs/super.c:1771
do_new_mount+0x203/0x660 fs/namespace.c:3337
path_mount+0x496/0xb30 fs/namespace.c:3664
do_mount fs/namespace.c:3677 [inline]
__do_sys_mount fs/namespace.c:3886 [inline]
__se_sys_mount+0x27f/0x2d0 fs/namespace.c:3863
__x64_sys_mount+0x67/0x80 fs/namespace.c:3863
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x00000000fffffe83 -> 0x30303030206d6574

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 26072 Comm: syz-executor.0 Not tainted 6.7.0-rc3-syzkaller-00298-g1b8af6552cb7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
==================================================================
EXT4-fs error (device loop0): ext4_orphan_get:1399: comm syz-executor.0: couldn't read orphan inode 15 (err -117)
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback.
EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000.


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.