KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

Status: moderation: reported on 2026/08/15 02:24
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+53ab168fdda7fba508ba@syzkaller.appspotmail.com
First crash: 3d03h, last: 3d03h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
751a51b3 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/17 03:07 2026/08/17 03:07 2026/08/17 03:51 746171ee
d03851cc assessment-kcsan Benign: ✅ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/15 02:23 2026/08/15 02:23 2026/08/15 02:50 746171ee

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

write to 0xffff888100074cb4 of 1 bytes by task 9452 on cpu 1:
 ring_buffer_poll_wait+0x14e/0x200 kernel/trace/ring_buffer.c:1079
 trace_poll kernel/trace/trace.c:5323 [inline]
 tracing_poll_pipe+0xf7/0x120 kernel/trace/trace.c:5332
 vfs_poll include/linux/poll.h:82 [inline]
 aio_poll_complete_work+0xd9/0x340 fs/aio.c:1786
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0x4d4/0x9a0 kernel/workqueue.c:3405
 worker_thread+0x569/0x750 kernel/workqueue.c:3486
 kthread+0x221/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888100074cb4 of 1 bytes by task 3299 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4297 [inline]
 ring_buffer_unlock_commit+0x54/0x440 kernel/trace/ring_buffer.c:4498
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_kmalloc include/trace/events/kmem.h:57 [inline]
 trace_event_raw_event_kmalloc+0xb6/0x110 include/trace/events/kmem.h:57
 __do_trace_kmalloc include/trace/events/kmem.h:57 [inline]
 trace_kmalloc include/trace/events/kmem.h:57 [inline]
 __kmalloc_cache_noprof+0x30e/0x3d0 mm/slub.c:5487
 _kmalloc_noprof include/linux/slab.h:988 [inline]
 _kzalloc_noprof include/linux/slab.h:1309 [inline]
 netlbl_secattr_alloc_noprof include/net/netlabel.h:385 [inline]
 selinux_netlbl_sock_genattr+0x88/0x260 security/selinux/netlabel.c:78
 selinux_netlbl_socket_post_create+0x66/0x100 security/selinux/netlabel.c:404
 selinux_socket_post_create+0x219/0x290 security/selinux/hooks.c:4981
 security_socket_post_create+0x59/0xa0 security/security.c:4216
 __sock_create+0x356/0x580 net/socket.c:1674
 sock_create net/socket.c:1709 [inline]
 __sys_socket_create net/socket.c:1746 [inline]
 __sys_socket+0xaf/0x180 net/socket.c:1793
 __do_sys_socket net/socket.c:1807 [inline]
 __se_sys_socket net/socket.c:1805 [inline]
 __x64_sys_socket+0x3f/0x50 net/socket.c:1805
 x64_sys_call+0x11fc/0x3020 arch/x86/include/generated/asm/syscalls_64.h:42
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3299 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/15 02:23 upstream dac3e89a2c90 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.