KCSAN: data-race in __stop_tty / con_write_room

Status: moderation: reported C repro on 2026/10/03 12:54
Labels: prio:low race:benign
[Documentation on labels]
Reported-by: syzbot+26b0311d51fd8b0d5b8e@syzkaller.appspotmail.com
First crash: 5h01m, last: 5h01m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
51bcbfbb assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in __stop_tty / con_write_room 2026/10/03 12:54 2026/10/03 12:54 2026/10/03 13:20 57bbd979
4eb67033 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __stop_tty / con_write_room 2026/10/03 12:54 2026/10/03 12:54 2026/10/03 13:51 57bbd979

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __stop_tty / con_write_room

write to 0xffff888103d90194 of 1 bytes by task 3640 on cpu 0:
 __stop_tty+0x36/0x90 drivers/tty/tty_io.c:744
 n_tty_ioctl_helper+0x2d1/0x370 drivers/tty/tty_ioctl.c:951
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2774
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103d90194 of 1 bytes by task 3641 on cpu 1:
 con_write_room+0x19/0x30 drivers/tty/vt/vt.c:3674
 tty_write_room+0x3f/0x60 drivers/tty/tty_ioctl.c:69
 process_output_block drivers/tty/n_tty.c:515 [inline]
 n_tty_write+0x455/0xb00 drivers/tty/n_tty.c:2366
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x392/0x6a0 drivers/tty/tty_io.c:1054
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1075
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3641 Comm: syz-executor334 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in __start_tty / do_con_write

write to 0xffff888103d90194 of 1 bytes by task 3640 on cpu 0:
 __start_tty+0x5a/0x150 drivers/tty/tty_io.c:774
 n_tty_ioctl_helper+0x10a/0x370 drivers/tty/tty_ioctl.c:959
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2774
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103d90194 of 1 bytes by task 3641 on cpu 1:
 do_con_write+0x164/0x2a90 drivers/tty/vt/vt.c:3305
 con_put_char+0x38/0x60 drivers/tty/vt/vt.c:3669
 tty_put_char+0x68/0xc0 drivers/tty/tty_io.c:3126
 do_output_char+0x4e6/0x510 drivers/tty/n_tty.c:459
 process_output drivers/tty/n_tty.c:482 [inline]
 n_tty_write+0x86c/0xb00 drivers/tty/n_tty.c:2377
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x392/0x6a0 drivers/tty/tty_io.c:1054
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1075
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3641 Comm: syz-executor334 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in __start_tty / con_write_room

write to 0xffff888103d90194 of 1 bytes by task 3640 on cpu 0:
 __start_tty+0x5a/0x150 drivers/tty/tty_io.c:774
 n_tty_ioctl_helper+0x10a/0x370 drivers/tty/tty_ioctl.c:959
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2774
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103d90194 of 1 bytes by task 3641 on cpu 1:
 con_write_room+0x19/0x30 drivers/tty/vt/vt.c:3674
 tty_write_room+0x3f/0x60 drivers/tty/tty_ioctl.c:69
 process_output drivers/tty/n_tty.c:482 [inline]
 n_tty_write+0x860/0xb00 drivers/tty/n_tty.c:2377
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x392/0x6a0 drivers/tty/tty_io.c:1054
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1075
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3641 Comm: syz-executor334 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in __start_tty / do_con_write

write to 0xffff888103d90194 of 1 bytes by task 3640 on cpu 0:
 __start_tty+0x5a/0x150 drivers/tty/tty_io.c:774
 n_tty_ioctl_helper+0x10a/0x370 drivers/tty/tty_ioctl.c:959
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2774
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103d90194 of 1 bytes by task 3641 on cpu 1:
 do_con_write+0x1bd5/0x2a90 drivers/tty/vt/vt.c:3305
 con_write+0x27/0x1d0 drivers/tty/vt/vt.c:3661
 process_output_block drivers/tty/n_tty.c:557 [inline]
 n_tty_write+0x7f4/0xb00 drivers/tty/n_tty.c:2366
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x392/0x6a0 drivers/tty/tty_io.c:1054
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1075
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3641 Comm: syz-executor334 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in __stop_tty / do_con_write

write to 0xffff888103d90194 of 1 bytes by task 3640 on cpu 0:
 __stop_tty+0x36/0x90 drivers/tty/tty_io.c:744
 n_tty_ioctl_helper+0x2d1/0x370 drivers/tty/tty_ioctl.c:951
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2774
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103d90194 of 1 bytes by task 3641 on cpu 1:
 do_con_write+0x1bd5/0x2a90 drivers/tty/vt/vt.c:3305
 con_write+0x27/0x1d0 drivers/tty/vt/vt.c:3661
 process_output_block drivers/tty/n_tty.c:557 [inline]
 n_tty_write+0x7f4/0xb00 drivers/tty/n_tty.c:2366
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x392/0x6a0 drivers/tty/tty_io.c:1054
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1075
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3641 Comm: syz-executor334 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/03 12:54 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git e767a4ea70a3 7808aef4 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in __stop_tty / con_write_room
* Struck through repros no longer work on HEAD.