KCSAN: data-race in __ps2_command / ps2_interrupt

Status: moderation: reported on 2026/07/24 21:38
Subsystems: input
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+1ecceabfed79f6a96c7d@syzkaller.appspotmail.com
First crash: 60d, last: 19h45m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
a48e11bb assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ KCSAN: data-race in __ps2_command / ps2_interrupt 2026/07/26 02:33 2026/07/26 02:33 2026/07/26 02:37 492bab15
f7b71f5b assessment-kcsan Benign: ✅ KCSAN: data-race in __ps2_command / ps2_interrupt 2026/07/24 21:38 2026/07/24 21:38 2026/07/24 22:08 1bdb5c57

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __ps2_command / ps2_interrupt

write to 0xffff888126088848 of 8 bytes by interrupt on cpu 0:
 ps2_handle_response drivers/input/serio/libps2.c:482 [inline]
 ps2_interrupt+0x273/0x550 drivers/input/serio/libps2.c:608
 serio_interrupt+0x66/0xf0 drivers/input/serio/serio.c:967
 i8042_handle_data+0x388/0x680 drivers/input/serio/i8042.c:598
 i8042_interrupt+0x15/0x90 drivers/input/serio/i8042.c:605
 __handle_irq_event_percpu+0x8b/0x480 kernel/irq/handle.c:209
 handle_irq_event_percpu kernel/irq/handle.c:246 [inline]
 handle_irq_event+0x64/0xf0 kernel/irq/handle.c:263
 handle_edge_irq+0x155/0x440 kernel/irq/chip.c:859
 generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
 handle_irq arch/x86/kernel/irq.c:209 [inline]
 call_irq_handler arch/x86/kernel/irq.c:-1 [inline]
 __common_interrupt+0x60/0xb0 arch/x86/kernel/irq.c:280
 common_interrupt+0x7e/0x90 arch/x86/kernel/irq.c:273
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:665
 kcsan_setup_watchpoint+0x42b/0x4a0 kernel/kcsan/core.c:713
 __copy_msghdr net/socket.c:2600 [inline]
 copy_msghdr_from_user net/socket.c:2646 [inline]
 recvmsg_copy_msghdr net/socket.c:2899 [inline]
 ___sys_recvmsg+0x1d2/0x3a0 net/socket.c:2971
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888126088848 of 8 bytes by task 12253 on cpu 1:
 __ps2_command+0x4b3/0xaa0 drivers/input/serio/libps2.c:341
 ps2_command+0x52/0x90 drivers/input/serio/libps2.c:403
 genius_detect+0x8b/0x250 drivers/input/mouse/psmouse-base.c:549
 psmouse_do_detect drivers/input/mouse/psmouse-base.c:995 [inline]
 psmouse_try_protocol drivers/input/mouse/psmouse-base.c:1009 [inline]
 psmouse_extensions+0x746/0x960 drivers/input/mouse/psmouse-base.c:1158
 psmouse_switch_protocol+0x8b/0x300 drivers/input/mouse/psmouse-base.c:1513
 psmouse_connect+0x5a3/0xb60 drivers/input/mouse/psmouse-base.c:1602
 serio_connect_driver drivers/input/serio/serio.c:44 [inline]
 serio_driver_probe+0x54/0x70 drivers/input/serio/serio.c:748
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x1ba/0x600 drivers/base/dd.c:706
 __driver_probe_device+0x14f/0x1c0 drivers/base/dd.c:868
 driver_probe_device+0x37/0x2f0 drivers/base/dd.c:898
 __device_attach_driver+0x227/0x330 drivers/base/dd.c:1026
 bus_for_each_drv+0x1c0/0x230 drivers/base/bus.c:500
 __device_attach+0x1d1/0x2a0 drivers/base/dd.c:1098
 device_attach+0x17/0x20 drivers/base/dd.c:1141
 serio_find_driver drivers/input/serio/serio.c:112 [inline]
 drvctl_store+0x7ba/0xc20 drivers/input/serio/serio.c:367
 dev_attr_store+0x4a/0x70 drivers/base/core.c:2509
 sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000006 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12253 Comm: syz.0.2131 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input75

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/23 00:21 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/21 10:12 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/20 06:12 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/16 11:10 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/16 00:46 upstream f6e7b42bf05b 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/15 17:01 upstream 587858367581 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/15 06:36 upstream 587858367581 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/13 14:01 upstream 2f0c1cf72f46 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/10 02:26 upstream 50d05c7c76c9 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/01 05:48 upstream bf1079577a11 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/08/25 09:02 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/08/05 07:11 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/27 03:01 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/24 21:38 upstream 48a5a7ab8d6a dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/24 21:38 upstream 48a5a7ab8d6a dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
* Struck through repros no longer work on HEAD.