KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

Status: moderation: reported C repro on 2026/08/15 02:24
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+53ab168fdda7fba508ba@syzkaller.appspotmail.com
First crash: 48d, last: 8d02h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
751a51b3 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/17 03:07 2026/08/17 03:07 2026/08/17 03:51 746171ee
d03851cc assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/15 02:23 2026/08/15 02:23 2026/08/15 02:50 746171ee

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

write to 0xffff888100074cb4 of 1 bytes by task 3641 on cpu 1:
 ring_buffer_poll_wait+0x14e/0x200 kernel/trace/ring_buffer.c:1156
 trace_poll kernel/trace/trace.c:5325 [inline]
 tracing_poll_pipe+0xf7/0x120 kernel/trace/trace.c:5334
 vfs_poll include/linux/poll.h:82 [inline]
 do_pollfd fs/select.c:877 [inline]
 do_poll fs/select.c:920 [inline]
 do_sys_poll+0x6e1/0xc00 fs/select.c:1015
 __do_sys_poll fs/select.c:1072 [inline]
 __se_sys_poll fs/select.c:1060 [inline]
 __x64_sys_poll+0x12c/0x230 fs/select.c:1060
 x64_sys_call+0x2140/0x2550 arch/x86/include/generated/asm/syscalls_64.h:8
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100074cb4 of 1 bytes by task 3642 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4379 [inline]
 ring_buffer_unlock_commit+0x57/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 write_marker_to_buffer+0x38a/0x520 kernel/trace/trace.c:5974
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3642 Comm: syz-executor240 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/24 09:40 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 62f4c998b297 853b104b .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
2026/08/30 09:18 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
2026/08/19 20:45 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
2026/08/15 02:23 upstream dac3e89a2c90 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.