KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

Status: moderation: reported on 2026/08/19 09:04
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+ae0bbb13f9677c2227da@syzkaller.appspotmail.com
First crash: 5d03h, last: 5h25m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
1ab79ce8 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/21 00:00 2026/08/21 00:00 2026/08/21 00:43 1e72964b
038079b3 assessment-kcsan Benign: ✅ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/19 09:04 2026/08/19 09:04 2026/08/19 09:29 1e72964b

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 27018 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:5976 [inline]
 rb_get_reader_page+0xa4c/0xd90 kernel/trace/ring_buffer.c:6035
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6116
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6319
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 26924 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4364 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4550
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_sock_msg_length include/trace/events/sock.h:267 [inline]
 trace_event_raw_event_sock_msg_length+0x110/0x1c0 include/trace/events/sock.h:267
 __do_trace_sock_recv_length include/trace/events/sock.h:304 [inline]
 trace_sock_recv_length include/trace/events/sock.h:304 [inline]
 call_trace_sock_recv_length+0xa2/0xc0 net/socket.c:1145
 sock_recvmsg_nosec+0xdf/0xf0 net/socket.c:1156
 ____sys_recvmsg+0x26f/0x280 net/socket.c:2931
 ___sys_recvmsg+0x11f/0x3a0 net/socket.c:2975
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019a100 -> 0xffff88811b8f30c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 26924 Comm: syz.4.12888 Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/24 07:00 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/08/19 09:04 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.