KCSAN: data-race in kick_pool_pick / wq_worker_running

Status: moderation: reported on 2026/08/20 22:04
Subsystems: kernel
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+8922e6b8343f70be92e8@syzkaller.appspotmail.com
First crash: 12d, last: 15h25m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
80dde489 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in kick_pool_pick / wq_worker_running 2026/08/22 00:00 2026/08/22 00:00 2026/08/22 00:14 1e72964b
c85495d2 assessment-kcsan Benign: ✅ KCSAN: data-race in kick_pool_pick / wq_worker_running 2026/08/20 22:03 2026/08/20 22:04 2026/08/20 22:27 1e72964b

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kick_pool_pick / wq_worker_running

read-write to 0xffff888237c2b0a4 of 4 bytes by task 11 on cpu 0:
 wq_worker_running+0x9c/0x120 kernel/workqueue.c:1465
 schedule_timeout+0xca/0x180 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common+0xef/0x1d0 kernel/sched/completion.c:132
 usb_start_wait_urb+0x12c/0x220 drivers/usb/core/message.c:72
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x182/0x240 drivers/usb/core/message.c:167
 get_port_status drivers/usb/core/hub.c:607 [inline]
 hub_ext_port_status+0xb4/0x410 drivers/usb/core/hub.c:624
 usb_hub_port_status drivers/usb/core/hub.c:674 [inline]
 port_event drivers/usb/core/hub.c:5774 [inline]
 hub_event+0x47e/0x2aa0 drivers/usb/core/hub.c:5966
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888237c2b0a4 of 4 bytes by task 3381 on cpu 1:
 need_more_worker kernel/workqueue.c:954 [inline]
 kick_pool_pick+0x5f/0x310 kernel/workqueue.c:1284
 __queue_work+0x90a/0xbc0 kernel/workqueue.c:2449
 queue_work_on+0xa9/0x140 kernel/workqueue.c:2501
 srcu_queue_delayed_work_on kernel/rcu/srcutree.c:854 [inline]
 srcu_schedule_cbs_sdp kernel/rcu/srcutree.c:867 [inline]
 srcu_gp_end kernel/rcu/srcutree.c:932 [inline]
 srcu_advance_state kernel/rcu/srcutree.c:1850 [inline]
 process_srcu+0xa39/0xd90 kernel/rcu/srcutree.c:1954
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3381 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: rcu_gp process_srcu
==================================================================

Crashes (15):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/01 14:51 upstream 786262be6048 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/29 23:50 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/28 08:30 upstream 1b78070aaef6 e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/27 19:45 upstream 73e3f0710014 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/27 00:33 upstream 502d45774af0 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/27 00:18 upstream 502d45774af0 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/26 16:33 upstream 73ae59e97596 a2b77b9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/26 04:33 upstream 73ae59e97596 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/25 14:46 upstream 66498c75b4f8 a9a1fc32 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/25 04:32 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/24 14:20 upstream 0a0d1d55dad5 b55bd4c3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/23 21:48 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/23 04:34 upstream 66fb95a52111 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/22 04:38 upstream 26260251022f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/20 22:03 upstream cf62c7084acf 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
* Struck through repros no longer work on HEAD.