KCSAN: data-race in data_push_tail / symbol_string (14)

Status: moderation: reported on 2026/09/23 23:17
Subsystems: kernel
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+9ca828a9e84d70d1d949@syzkaller.appspotmail.com
First crash: 7d10h, last: 2d02h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
4fed6a41 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ✅ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in data_push_tail / symbol_string (14) 2026/09/25 00:58 2026/09/25 00:58 2026/09/25 01:21 3c3cdf19
1f023d2b assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in data_push_tail / symbol_string (14) 2026/09/23 23:17 2026/09/23 23:17 2026/09/24 00:04 0a1606bc
▶ ▼ Similar bugs (13)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in data_push_tail / symbol_string (3) kernel 6 1 1674d 1674d 0/29 auto-closed as invalid on 2022/04/05 16:28
upstream KCSAN: data-race in data_push_tail / symbol_string (10) kernel 6 1 507d 507d 0/29 auto-obsoleted due to no activity on 2025/07/07 00:26
upstream KCSAN: data-race in data_push_tail / symbol_string (7) kernel 6 2 945d 947d 0/29 auto-obsoleted due to no activity on 2024/04/04 01:53
upstream KCSAN: data-race in data_push_tail / symbol_string kernel 6 1 1933d 1933d 0/29 auto-closed as invalid on 2021/07/21 00:16
upstream KCSAN: data-race in data_push_tail / symbol_string (13) race:benign prio:high kernel 6 1 127d 127d 0/29 auto-obsoleted due to no activity on 2026/07/21 13:43
upstream KCSAN: data-race in data_push_tail / symbol_string (9) kernel 6 1 608d 608d 0/29 auto-obsoleted due to no activity on 2025/03/27 22:14
upstream KCSAN: data-race in data_push_tail / symbol_string (6) kernel 6 1 1041d 1030d 0/29 auto-obsoleted due to no activity on 2023/12/29 16:49
upstream KCSAN: data-race in data_push_tail / symbol_string (5) kernel 6 4 1084d 1159d 0/29 auto-obsoleted due to no activity on 2023/11/17 08:46
upstream KCSAN: data-race in data_push_tail / symbol_string (4) kernel 6 2 1252d 1279d 0/29 auto-obsoleted due to no activity on 2023/06/01 14:03
upstream KCSAN: data-race in data_push_tail / symbol_string (12) kernel 6 2 272d 303d 0/29 auto-obsoleted due to no activity on 2026/02/26 12:42
upstream KCSAN: data-race in data_push_tail / symbol_string (11) kernel 6 1 403d 403d 0/29 auto-obsoleted due to no activity on 2025/10/18 10:19
upstream KCSAN: data-race in data_push_tail / symbol_string (8) kernel 6 1 668d 668d 0/29 auto-obsoleted due to no activity on 2025/01/26 20:37
upstream KCSAN: data-race in data_push_tail / symbol_string (2) kernel 6 1 1753d 1753d 0/29 auto-closed as invalid on 2022/01/16 12:11

Sample crash report:
vhci_hcd vhci_hcd.0: pdev(0) rhport(2) sockfd(7)
==================================================================
BUG: KCSAN: data-race in data_push_tail / symbol_string

write to 0xffffffff895d5b78 of 1 bytes by task 14957 on cpu 1:
 string_nocheck lib/vsprintf.c:652 [inline]
 symbol_string+0x1c9/0x260 lib/vsprintf.c:1009
 pointer+0x681/0xc90 lib/vsprintf.c:2543
 vsnprintf+0x49e/0x8c0 lib/vsprintf.c:2953
 vscnprintf+0x41/0x90 lib/vsprintf.c:3018
 printk_sprint+0x30/0x2b0 kernel/printk/printk.c:2222
 vprintk_store+0x57f/0x910 kernel/printk/printk.c:2364
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2494
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2504
 printk_stack_address arch/x86/kernel/dumpstack.c:70 [inline]
 __show_trace_log_lvl+0x460/0x560 arch/x86/kernel/dumpstack.c:282
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x95/0xd0 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 fail_dump lib/fault-inject.c:73 [inline]
 should_fail_ex+0x262/0x280 lib/fault-inject.c:174
 should_failslab+0x8c/0xb0 mm/failslab.c:46
 slab_pre_alloc_hook mm/slub.c:4638 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 __kmalloc_cache_noprof+0x7a/0x400 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 pty_common_install drivers/tty/pty.c:368 [inline]
 pty_unix98_install+0x93/0x380 drivers/tty/pty.c:698
 tty_driver_install_tty drivers/tty/tty_io.c:1268 [inline]
 tty_init_dev+0x7c/0x320 drivers/tty/tty_io.c:1380
 ptmx_open+0xda/0x240 drivers/tty/pty.c:801
 chrdev_open+0x2eb/0x3a0 fs/char_dev.c:411
 do_dentry_open+0x49f/0xa60 fs/open.c:996
 vfs_open+0x37/0x1e0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0xc01/0x10d0 fs/namei.c:5000
 do_file_open+0x16c/0x290 fs/namei.c:5029
 do_sys_openat2+0xa0/0x130 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1434
 x64_sys_call+0x1f72/0x2550 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895d5b78 of 8 bytes by task 14955 on cpu 0:
 data_make_reusable kernel/printk/printk_ringbuffer.c:608 [inline]
 data_push_tail+0x104/0x440 kernel/printk/printk_ringbuffer.c:693
 data_alloc+0x111/0x380 kernel/printk/printk_ringbuffer.c:1089
 prb_reserve+0x8e3/0xaf0 kernel/printk/printk_ringbuffer.c:1727
 vprintk_store+0x54e/0x910 kernel/printk/printk.c:2354
 vprintk_emit+0x1a4/0x610 kernel/printk/printk.c:2455
 dev_vprintk_emit+0x242/0x2a0 drivers/base/core.c:5000
 dev_printk_emit+0x84/0xb0 drivers/base/core.c:5011
 __dev_printk+0xf3/0x110 drivers/base/core.c:5023
 _dev_info+0xa6/0xd0 drivers/base/core.c:5069
 attach_store+0x492/0x670 drivers/usb/usbip/vhci_sysfs.c:422
 dev_attr_store+0x4a/0x70 drivers/base/core.c:2509
 sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x3ffffffffffff214 -> 0x78302f633878302b

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14955 Comm: syz.0.3172 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd vhci_hcd.0: Device attached
vhci_hcd vhci_hcd.0: pdev(0) rhport(3) sockfd(9)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd vhci_hcd.0: Device attached
vhci_hcd vhci_hcd.0: pdev(0) rhport(4) sockfd(11)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd vhci_hcd.0: Device attached
vhci_hcd vhci_hcd.0: pdev(0) rhport(5) sockfd(13)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd vhci_hcd.0: Device attached
vhci_hcd vhci_hcd.0: pdev(0) rhport(6) sockfd(15)
vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed)
vhci_hcd vhci_hcd.0: Device attached
vhci_hcd vhci_hcd.0: pdev(0) rhport(7) sockfd(17)
vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus)
vhci_hcd vhci_hcd.0: Device attached

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 07:53 upstream 72d3fcf802c4 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / symbol_string
2026/09/23 23:17 upstream fe2ec83746e5 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in data_push_tail / symbol_string
* Struck through repros no longer work on HEAD.