[moderation] [ext4?] KCSAN: data-race in data_push_tail / uuid_string (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: b69053dd3ffb wifi: mt76: Remove blank line after mt792x fi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1102a28a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=b319ff1b6a2797ca
dashboard link: https://syzkaller.appspot.com/bug?extid=89982c0d93c295e88d08
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
CC: [adilger...@dilger.ca linux...@vger.kernel.org linux-...@vger.kernel.org ty...@mit.edu]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3a0f5632025b/disk-b69053dd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c67de396f055/vmlinux-b69053dd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0824b8a30f27/bzImage-b69053dd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+89982c...@syzkaller.appspotmail.com

EXT4-fs (loop1): feature flags set on rev 0 fs, running e2fsck is recommended
EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4215: comm syz.1.3688: Allocating blocks 41-42 which overlap fs metadata
==================================================================
BUG: KCSAN: data-race in data_push_tail / uuid_string

write to 0xffffffff88eab5c0 of 1 bytes by task 12363 on cpu 1:
string_nocheck lib/vsprintf.c:658 [inline]
uuid_string+0x41f/0x4a0 lib/vsprintf.c:1771
pointer+0x3b5/0xcb0 lib/vsprintf.c:2566
vsnprintf+0x491/0x860 lib/vsprintf.c:2951
va_format lib/vsprintf.c:1722 [inline]
pointer+0x821/0xcb0 lib/vsprintf.c:2568
vsnprintf+0x491/0x860 lib/vsprintf.c:2951
vscnprintf+0x41/0x90 lib/vsprintf.c:3012
printk_sprint+0x30/0x2d0 kernel/printk/printk.c:2192
vprintk_store+0x568/0x830 kernel/printk/printk.c:2312
vprintk_emit+0x15a/0x5c0 kernel/printk/printk.c:2402
vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x79/0xa0 kernel/printk/printk.c:2451
__ext4_msg+0x18f/0x1a0 fs/ext4/super.c:990
ext4_put_super+0x90/0x7d0 fs/ext4/super.c:1295
generic_shutdown_super+0xe6/0x210 fs/super.c:643
kill_block_super+0x2a/0x70 fs/super.c:1722
ext4_kill_sb+0x42/0x80 fs/ext4/super.c:7444
deactivate_locked_super+0x75/0x1c0 fs/super.c:474
deactivate_super+0x97/0xa0 fs/super.c:507
cleanup_mnt+0x2a9/0x320 fs/namespace.c:1318
__cleanup_mnt+0x19/0x20 fs/namespace.c:1325
task_work_run+0x131/0x1a0 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88eab5c0 of 8 bytes by task 14431 on cpu 0:
data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
data_push_tail+0x100/0x470 kernel/printk/printk_ringbuffer.c:693
data_alloc+0x11b/0x390 kernel/printk/printk_ringbuffer.c:1089
prb_reserve+0x8d7/0xad0 kernel/printk/printk_ringbuffer.c:1724
vprintk_store+0x53c/0x830 kernel/printk/printk.c:2302
vprintk_emit+0x15a/0x5c0 kernel/printk/printk.c:2402
vprintk_default+0x26/0x30 kernel/printk/printk.c:2441
vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
_printk+0x79/0xa0 kernel/printk/printk.c:2451
__ext4_error+0x248/0x320 fs/ext4/super.c:822
ext4_mb_mark_diskspace_used+0x273/0x3c0 fs/ext4/mballoc.c:4214
ext4_mb_new_blocks+0xa62/0x2080 fs/ext4/mballoc.c:6335
ext4_ext_map_blocks+0xff5/0x38a0 fs/ext4/extents.c:4383
ext4_map_create_blocks fs/ext4/inode.c:613 [inline]
ext4_map_blocks+0x626/0xd20 fs/ext4/inode.c:816
ext4_getblk+0x114/0x510 fs/ext4/inode.c:984
ext4_bread+0x28/0x110 fs/ext4/inode.c:1047
ext4_quota_write+0x167/0x360 fs/ext4/super.c:7350
write_blk fs/quota/quota_tree.c:70 [inline]
find_free_dqentry+0x53e/0x690 fs/quota/quota_tree.c:318
do_insert_tree+0x537/0x9b0 fs/quota/quota_tree.c:400
do_insert_tree+0x753/0x9b0 fs/quota/quota_tree.c:402
do_insert_tree+0x753/0x9b0 fs/quota/quota_tree.c:402
do_insert_tree+0x731/0x9b0 fs/quota/quota_tree.c:402
dq_insert_tree fs/quota/quota_tree.c:432 [inline]
qtree_write_dquot+0x2cb/0x300 fs/quota/quota_tree.c:451
v2_write_dquot+0xda/0x140 fs/quota/quota_v2.c:372
dquot_acquire+0x1c3/0x2b0 fs/quota/dquot.c:473
ext4_acquire_dquot+0x15f/0x200 fs/ext4/super.c:6982
dqget+0x527/0x8c0 fs/quota/dquot.c:980
__dquot_initialize+0x20c/0x7c0 fs/quota/dquot.c:1508
dquot_initialize+0x1a/0x30 fs/quota/dquot.c:1570
ext4_process_orphan+0x32/0x1c0 fs/ext4/orphan.c:327
ext4_orphan_cleanup+0x6a8/0xa00 fs/ext4/orphan.c:472
__ext4_fill_super fs/ext4/super.c:5658 [inline]
ext4_fill_super+0x3411/0x37a0 fs/ext4/super.c:5777
get_tree_bdev_flags+0x291/0x300 fs/super.c:1691
get_tree_bdev+0x1f/0x30 fs/super.c:1714
ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5809
vfs_get_tree+0x57/0x1d0 fs/super.c:1751
fc_mount fs/namespace.c:1199 [inline]
do_new_mount_fc fs/namespace.c:3636 [inline]
do_new_mount+0x24d/0x6a0 fs/namespace.c:3712
path_mount+0x4ab/0xb80 fs/namespace.c:4022
do_mount fs/namespace.c:4035 [inline]
__do_sys_mount fs/namespace.c:4224 [inline]
__se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
__x64_sys_mount+0x67/0x80 fs/namespace.c:4201
x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xca/0x2b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000100000ce6 -> 0x302d303030302d30

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14431 Comm: syz.1.3688 Not tainted syzkaller #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================
EXT4-fs error (device loop1): ext4_mb_mark_diskspace_used:4215: comm syz.1.3688: Allocating blocks 41-42 which overlap fs metadata
EXT4-fs error (device loop1): ext4_acquire_dquot:6986: comm syz.1.3688: Failed to acquire dquot type 1
EXT4-fs error (device loop1): mb_free_blocks:2037: group 0,
inode 12: block 14:
freeing already freed block (bit 14); block bitmap corrupt.
EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #12: comm syz.1.3688: corrupted inode contents
EXT4-fs error (device loop1): ext4_dirty_inode:6502: inode #12: comm syz.1.3688: mark_inode_dirty error
EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #12: comm syz.1.3688: corrupted inode contents
EXT4-fs error (device loop1): __ext4_ext_dirty:206: inode #12: comm syz.1.3688: mark_inode_dirty error
EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #12: comm syz.1.3688: corrupted inode contents
EXT4-fs error (device loop1) in ext4_orphan_del:303: Corrupt filesystem
EXT4-fs error (device loop1): ext4_do_update_inode:5617: inode #12: comm syz.1.3688: corrupted inode contents
EXT4-fs error (device loop1): ext4_truncate:4635: inode #12: comm syz.1.3688: mark_inode_dirty error
EXT4-fs error (device loop1) in ext4_process_orphan:345: Corrupt filesystem
EXT4-fs (loop1): 1 truncate cleaned up
EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
EXT4-fs (loop1): re-mounted 00000000-0000-0000-0000-000000000000 ro.
netlink: 28 bytes leftover after parsing attributes in process `syz.1.3688'.
syz.1.3688 (14431) used greatest stack depth: 7688 bytes left


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup