KCSAN: data-race in do_readlinkat / ring_buffer_unlock_commit

Status: moderation: reported on 2026/07/31 13:17
Subsystems: trace
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+b8ae432e1ee56705cb71@syzkaller.appspotmail.com
First crash: 3d07h, last: 3d07h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
2e35d411 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in do_readlinkat / ring_buffer_unlock_commit 2026/08/02 00:00 2026/08/02 00:00 2026/08/02 00:33 e611ffe1

			
		
1a8701c7 assessment-kcsan Benign: ✅ KCSAN: data-race in do_readlinkat / ring_buffer_unlock_commit 2026/07/31 14:12 2026/07/31 14:12 2026/07/31 14:32 7664cf44

			
		

Sample crash report:
==================================================================
BUG: KCSAN: data-race in do_readlinkat / ring_buffer_unlock_commit

read to 0xffff888100074cb4 of 1 bytes by task 14450 on cpu 1:

write to 0xffff888100074cb4 of 1 bytes by task 14466 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4294 [inline]
 ring_buffer_unlock_commit+0x6a/0x440 kernel/trace/ring_buffer.c:4494
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_x86_fpu arch/x86/include/asm/trace/fpu.h:10 [inline]
 trace_event_raw_event_x86_fpu+0x165/0x200 arch/x86/include/asm/trace/fpu.h:10
 __do_trace_x86_fpu_regs_activated arch/x86/include/asm/trace/fpu.h:47 [inline]
 trace_x86_fpu_regs_activated arch/x86/include/asm/trace/fpu.h:47 [inline]
 fpregs_activate arch/x86/kernel/fpu/context.h:50 [inline]
 fpregs_mark_activate+0xff/0x120 arch/x86/kernel/fpu/core.c:924
 restore_fpregs_from_user arch/x86/kernel/fpu/signal.c:322 [inline]
 __fpu_restore_sig arch/x86/kernel/fpu/signal.c:351 [inline]
 fpu__restore_sig+0x5a0/0xad0 arch/x86/kernel/fpu/signal.c:485
 restore_sigcontext arch/x86/kernel/signal_64.c:95 [inline]
 __ia32_sys_rt_sigreturn+0x29b/0x350 arch/x86/kernel/signal_64.c:268
 x64_sys_call+0x2823/0x3020 arch/x86/include/generated/asm/syscalls_64.h:16
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 14466 Comm: syz.5.4072 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/31 13:16 upstream 8ba098e6b6ff 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in do_readlinkat / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.