KCSAN: data-race in detach_pid / perf_event_switch_output (6)

Status: moderation: reported on 2026/09/16 08:13
Subsystems: perf
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+c382ee653fd70f5cf1bb@syzkaller.appspotmail.com
Fix commit: 12e19bba68ba pid: use READ_ONCE() in pid_alive()
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-gce-arm64 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 46d, last: 24d
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
c5b8cde6 repro-c 💥 KCSAN: data-race in detach_pid / perf_event_switch_output (6) 2026/10/01 06:15 2026/10/01 06:15 2026/10/01 08:20 38f7f0d1
230cbae5 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in detach_pid / perf_event_switch_output (6) 2026/09/18 00:01 2026/09/18 00:01 2026/09/18 00:32 8d7d05f1
e01b721e assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in detach_pid / perf_event_switch_output (6) 2026/09/16 08:13 2026/09/16 08:13 2026/09/16 08:49 12a0a44a
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[PATCH] pid: use READ_ONCE() in pid_alive() 12 (12) 2026/10/12 09:13
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in detach_pid / perf_event_switch_output perf 6 16 1863d 2014d 0/29 auto-closed as invalid on 2021/10/29 19:05
upstream KCSAN: data-race in detach_pid / perf_event_switch_output (4) perf 6 1 988d 988d 0/29 auto-obsoleted due to no activity on 2024/03/23 04:37
upstream KCSAN: data-race in detach_pid / perf_event_switch_output (2) perf 6 1 1778d 1778d 0/29 auto-closed as invalid on 2022/01/22 22:51
upstream KCSAN: data-race in detach_pid / perf_event_switch_output (3) perf 6 1 1142d 1142d 0/29 auto-obsoleted due to no activity on 2023/10/20 14:02
upstream KCSAN: data-race in detach_pid / perf_event_switch_output (5) prio:low perf 6 1 214d 214d 0/29 auto-obsoleted due to no activity on 2026/05/27 09:04

Sample crash report:
==================================================================
BUG: KCSAN: data-race in detach_pid / perf_event_switch_output

write to 0xffff8881018b0660 of 8 bytes by task 16855 on cpu 1:
 __change_pid kernel/pid.c:414 [inline]
 detach_pid+0xf0/0x1a0 kernel/pid.c:426
 __unhash_process kernel/exit.c:140 [inline]
 __exit_signal kernel/exit.c:211 [inline]
 release_task+0x67c/0xb90 kernel/exit.c:272
 wait_task_zombie kernel/exit.c:1291 [inline]
 wait_consider_task+0x10ef/0x15f0 kernel/exit.c:1518
 do_wait_thread kernel/exit.c:1581 [inline]
 __do_wait+0xf1/0x500 kernel/exit.c:1699
 do_wait+0xb6/0x230 kernel/exit.c:1733
 kernel_wait4+0x19f/0x210 kernel/exit.c:1892
 __do_sys_wait4 kernel/exit.c:1920 [inline]
 __se_sys_wait4 kernel/exit.c:1916 [inline]
 __x64_sys_wait4+0x91/0x120 kernel/exit.c:1916
 x64_sys_call+0x108f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:62
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881018b0660 of 8 bytes by task 0 on cpu 0:
 pid_alive include/linux/pid.h:267 [inline]
 perf_event_pid_type kernel/events/core.c:1534 [inline]
 perf_event_tid kernel/events/core.c:1546 [inline]
 perf_event_switch_output+0x1ce/0x3a0 kernel/events/core.c:10113
 perf_iterate_sb_cpu kernel/events/core.c:9039 [inline]
 perf_iterate_sb+0x369/0x650 kernel/events/core.c:9068
 perf_event_switch kernel/events/core.c:10151 [inline]
 __perf_event_task_sched_in+0xa9d/0xb40 kernel/events/core.c:4335
 perf_event_task_sched_in include/linux/perf_event.h:1623 [inline]
 finish_task_switch+0x2bd/0x340 kernel/sched/core.c:5379
 context_switch kernel/sched/core.c:5536 [inline]
 __schedule+0x79e/0xd20 kernel/sched/core.c:7284
 schedule_idle+0x1d/0x40 kernel/sched/core.c:7402
 do_idle+0x27e/0x2d0 kernel/sched/idle.c:384
 cpu_startup_entry+0x24/0x30 kernel/sched/idle.c:454
 rest_init+0x101/0x110 init/main.c:732
 start_kernel+0x49f/0x4d0 init/main.c:1190
 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
 x86_64_start_kernel+0xfc/0x100 arch/x86/kernel/head64.c:291
 common_startup_64+0x13e/0x157

value changed: 0xffff888140619540 -> 0x0000000000000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (13):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/07 11:09 upstream 602042bf29f6 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/10/02 19:28 upstream 5e0f8396d480 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/28 07:31 upstream 72d3fcf802c4 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/27 18:39 upstream efb44d93a620 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/26 05:53 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/20 02:35 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/19 13:00 upstream 40288c9206c1 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/18 23:54 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/18 10:34 upstream 5dd1818b15d9 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/18 10:32 upstream 5dd1818b15d9 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/17 20:36 upstream 4982d3552a3b 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/17 20:23 upstream 4982d3552a3b 8d7d05f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
2026/09/16 08:13 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in detach_pid / perf_event_switch_output
* Struck through repros no longer work on HEAD.