KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch

Status: moderation: reported on 2026/08/05 23:15
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+e4be8226f3f8fba277bd@syzkaller.appspotmail.com
First crash: 46d, last: 1d12h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
d1624d52 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch 2026/08/09 05:42 2026/08/09 05:42 2026/08/09 05:44 5d63f80b
26058335 assessment-kcsan Benign: ✅ KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch 2026/08/09 05:29 2026/08/09 05:29 2026/08/09 05:42 5d63f80b

Sample crash report:
==================================================================
BUG: KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch

write to 0xffffffff895fb1e0 of 4 bytes by task 14017 on cpu 0:
 tracing_start_sched_switch+0x8d/0x200 kernel/trace/trace_sched_switch.c:101
 tracing_start_cmdline_record+0x13/0x20 kernel/trace/trace_sched_switch.c:135
 __ftrace_event_enable_disable+0x203/0x4b0 kernel/trace/trace_events.c:894
 ftrace_event_enable_disable kernel/trace/trace_events.c:934 [inline]
 __ftrace_set_clr_event_nolock+0x39e/0x820 kernel/trace/trace_events.c:1404
 __ftrace_set_clr_event kernel/trace/trace_events.c:1437 [inline]
 ftrace_set_clr_event+0x2a6/0x340 kernel/trace/trace_events.c:1487
 ftrace_event_write+0x170/0x1d0 kernel/trace/trace_events.c:1577
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895fb1e0 of 4 bytes by task 14074 on cpu 1:
 probe_sched_wakeup+0x41/0xa0 kernel/trace/trace_sched_switch.c:45
 __traceiter_sched_wakeup+0x26/0x40 include/trace/events/sched.h:178
 __do_trace_sched_wakeup include/trace/events/sched.h:178 [inline]
 trace_sched_wakeup include/trace/events/sched.h:178 [inline]
 ttwu_do_wakeup kernel/sched/core.c:3740 [inline]
 ttwu_do_activate+0x201/0x230 kernel/sched/core.c:3843
 ttwu_queue kernel/sched/core.c:4093 [inline]
 try_to_wake_up+0x44f/0x6d0 kernel/sched/core.c:4431
 autoremove_wake_function+0x10/0x50 kernel/sched/wait.c:404
 __wake_up_common kernel/sched/wait.c:109 [inline]
 __wake_up_common_lock kernel/sched/wait.c:126 [inline]
 __wake_up_sync_key+0x52/0x80 kernel/sched/wait.c:193
 __unix_dgram_recvmsg+0x3a4/0x860 net/unix/af_unix.c:2615
 unix_dgram_recvmsg+0x7e/0x90 net/unix/af_unix.c:2689
 sock_recvmsg_nosec+0xc2/0xf0 net/socket.c:1151
 ____sys_recvmsg+0x26f/0x280 net/socket.c:2931
 ___sys_recvmsg+0x11f/0x3a0 net/socket.c:2975
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000853 -> 0x00000854

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 14074 Comm: syz.1.2142 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/20 07:48 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch
2026/08/05 23:14 upstream 0d8395707651 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_wakeup / tracing_start_sched_switch
* Struck through repros no longer work on HEAD.