KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

Status: upstream: reported on 2026/08/04 02:50
Subsystems: trace
Labels: race:harmful prio:low
[Documentation on labels]
Reported-by: syzbot+0168fe25f9e5d46bd5fe@syzkaller.appspotmail.com
First crash: 10d, last: 1d05h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
a5347919 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/09 06:17 2026/08/09 06:17 2026/08/09 06:49 5d63f80b
ceb74444 assessment-kcsan Benign: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/04 02:19 2026/08/04 02:19 2026/08/04 02:49 cb1adeae
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [trace?] KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 1 (2) 2026/08/06 01:43

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

read to 0xffff888100074cb4 of 1 bytes by task 3514 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4297 [inline]
 ring_buffer_unlock_commit+0x54/0x440 kernel/trace/ring_buffer.c:4498
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_tlb_flush include/trace/events/tlb.h:39 [inline]
 trace_event_raw_event_tlb_flush+0xba/0x160 include/trace/events/tlb.h:39
 __do_trace_tlb_flush include/trace/events/tlb.h:39 [inline]
 trace_tlb_flush include/trace/events/tlb.h:39 [inline]
 switch_mm_irqs_off+0x221/0x350 arch/x86/mm/tlb.c:953
 context_switch kernel/sched/core.c:5489 [inline]
 __schedule+0x65c/0xd10 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x5a/0xa0 kernel/sched/core.c:7326
 schedule_hrtimeout_range_clock+0xd5/0x1a0 kernel/time/sleep_timeout.c:216
 schedule_hrtimeout_range+0x28/0x40 kernel/time/sleep_timeout.c:263
 poll_schedule_timeout fs/select.c:241 [inline]
 do_select+0xed3/0xfa0 fs/select.c:603
 core_sys_select+0x453/0x730 fs/select.c:677
 do_pselect fs/select.c:770 [inline]
 __do_sys_pselect6 fs/select.c:809 [inline]
 __se_sys_pselect6+0x23f/0x2a0 fs/select.c:800
 __x64_sys_pselect6+0x78/0x90 fs/select.c:800
 x64_sys_call+0x8d5/0x3020 arch/x86/include/generated/asm/syscalls_64.h:271
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888100074cb4 of 1 bytes by task 3506 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4298 [inline]
 ring_buffer_unlock_commit+0x6a/0x440 kernel/trace/ring_buffer.c:4498
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_tlb_flush include/trace/events/tlb.h:39 [inline]
 trace_event_raw_event_tlb_flush+0xba/0x160 include/trace/events/tlb.h:39
 __do_trace_tlb_flush include/trace/events/tlb.h:39 [inline]
 trace_tlb_flush include/trace/events/tlb.h:39 [inline]
 switch_mm_irqs_off+0x221/0x350 arch/x86/mm/tlb.c:953
 unuse_temporary_mm+0x32/0x60 arch/x86/mm/tlb.c:1035
 __text_poke+0x3ac/0x4c0 arch/x86/kernel/alternative.c:2629
 text_poke arch/x86/kernel/alternative.c:2672 [inline]
 smp_text_poke_batch_finish+0x298/0x560 arch/x86/kernel/alternative.c:3005
 __static_call_transform+0x276/0x2a0 arch/x86/kernel/static_call.c:119
 arch_static_call_transform+0x8f/0xb0 arch/x86/kernel/static_call.c:-1
 __static_call_update+0x275/0x380 kernel/static_call_inline.c:209
 tracepoint_update_call kernel/tracepoint.c:280 [inline]
 tracepoint_add_func+0x5c2/0x770 kernel/tracepoint.c:323
 tracepoint_probe_register_prio kernel/tracepoint.c:475 [inline]
 tracepoint_probe_register+0x5b/0x90 kernel/tracepoint.c:495
 trace_event_reg+0x11e/0x190 kernel/trace/trace_events.c:708
 __ftrace_event_enable_disable+0x276/0x4b0 kernel/trace/trace_events.c:877
 ftrace_event_enable_disable kernel/trace/trace_events.c:907 [inline]
 __ftrace_set_clr_event_nolock+0x3a4/0x820 kernel/trace/trace_events.c:1377
 __ftrace_set_clr_event kernel/trace/trace_events.c:1410 [inline]
 ftrace_set_clr_event+0x2a8/0x320 kernel/trace/trace_events.c:1460
 ftrace_event_write+0x170/0x1d0 kernel/trace/trace_events.c:1548
 vfs_write+0x252/0x990 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x27e1/0x3020 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3506 Comm: syz.1.2 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
syz.1.2 (3506) used greatest stack depth: 11128 bytes left

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/13 12:40 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/08 18:06 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/07 22:07 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/04 02:19 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.