KCSAN: data-race in n_tty_poll / n_tty_set_termios (5)

Status: moderation: reported on 2026/10/05 08:35
Subsystems: serial
Labels: race:benign
[Documentation on labels]
Reported-by: syzbot+3a7eb6d437d568d1c34d@syzkaller.appspotmail.com
First crash: 4h05m, last: 4h05m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
2d4f3971 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in n_tty_poll / n_tty_set_termios (5) 2026/10/05 08:43 2026/10/05 08:43 2026/10/05 09:28 57bbd979
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in n_tty_poll / n_tty_set_termios (4) serial 6 1 732d 732d 0/29 auto-obsoleted due to no activity on 2024/11/06 23:03
upstream KCSAN: data-race in n_tty_poll / n_tty_set_termios (2) serial 6 1 1300d 1300d 0/29 auto-obsoleted due to no activity on 2023/04/26 05:55
upstream KCSAN: data-race in n_tty_poll / n_tty_set_termios serial 6 1 2224d 2224d 0/29 auto-closed as invalid on 2020/10/07 08:58
upstream KCSAN: data-race in n_tty_poll / n_tty_set_termios (3) serial 6 1 850d 850d 0/29 auto-obsoleted due to no activity on 2024/07/12 11:40

Sample crash report:
==================================================================
BUG: KCSAN: data-race in n_tty_poll / n_tty_set_termios

write to 0xffffc90011f5305d of 1 bytes by task 4448 on cpu 0:
 n_tty_set_termios+0x189/0x7a0 drivers/tty/n_tty.c:1791
 tty_set_termios+0x8a2/0x900 drivers/tty/tty_ioctl.c:348
 set_termios+0x373/0x4f0 drivers/tty/tty_ioctl.c:516
 tty_mode_ioctl+0x37f/0x5b0 drivers/tty/tty_ioctl.c:-1
 n_tty_ioctl_helper+0x87/0x370 drivers/tty/tty_ioctl.c:982
 n_tty_ioctl+0x101/0x200 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2791
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffc90011f5305d of 1 bytes by task 4447 on cpu 1:
 input_available_p drivers/tty/n_tty.c:1912 [inline]
 n_tty_poll+0x105/0x450 drivers/tty/n_tty.c:2440
 tty_poll+0x79/0xf0 drivers/tty/tty_io.c:2174
 vfs_poll include/linux/poll.h:82 [inline]
 __io_arm_poll_handler+0x1fa/0xc10 io_uring/poll.c:591
 io_arm_apoll+0x30a/0x420 io_uring/poll.c:699
 io_arm_poll_handler+0x121/0x150 io_uring/poll.c:728
 io_queue_async+0x276/0x330 io_uring/io_uring.c:1623
 io_queue_sqe io_uring/io_uring.c:1649 [inline]
 io_submit_sqe io_uring/io_uring.c:1927 [inline]
 io_submit_sqes+0xaf0/0x1180 io_uring/io_uring.c:2050
 __do_sys_io_uring_enter io_uring/io_uring.c:2639 [inline]
 __se_sys_io_uring_enter+0x25c/0xf90 io_uring/io_uring.c:2588
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:2588
 x64_sys_call+0x1780/0x2550 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x10 -> 0x0c

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4447 Comm: syz.2.210 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/05 08:35 upstream a90ee4305c4a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in n_tty_poll / n_tty_set_termios
* Struck through repros no longer work on HEAD.