KCSAN: data-race in __ps2_command / ps2_interrupt

Status: moderation: reported on 2026/07/24 21:38
Subsystems: input
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+1ecceabfed79f6a96c7d@syzkaller.appspotmail.com
First crash: 97d, last: 5d09h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
a48e11bb assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ ❓ KCSAN: data-race in __ps2_command / ps2_interrupt 2026/07/26 02:33 2026/07/26 02:33 2026/07/26 02:37 492bab15
f7b71f5b assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __ps2_command / ps2_interrupt 2026/07/24 21:38 2026/07/24 21:38 2026/07/24 22:08 1bdb5c57

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __ps2_command / ps2_interrupt

write to 0xffff888103bf5858 of 1 bytes by interrupt on cpu 0:
 ps2_handle_response drivers/input/serio/libps2.c:479 [inline]
 ps2_interrupt+0x1be/0x550 drivers/input/serio/libps2.c:608
 serio_interrupt+0x66/0xf0 drivers/input/serio/serio.c:967
 i8042_handle_data+0x388/0x680 drivers/input/serio/i8042.c:598
 i8042_interrupt+0x15/0x90 drivers/input/serio/i8042.c:605
 __handle_irq_event_percpu+0x8b/0x480 kernel/irq/handle.c:209
 handle_irq_event_percpu kernel/irq/handle.c:246 [inline]
 handle_irq_event+0x64/0xf0 kernel/irq/handle.c:263
 handle_edge_irq+0x155/0x440 kernel/irq/chip.c:859
 generic_handle_irq_desc include/linux/irqdesc.h:188 [inline]
 handle_irq arch/x86/kernel/irq.c:209 [inline]
 call_irq_handler arch/x86/kernel/irq.c:-1 [inline]
 __common_interrupt+0x60/0xb0 arch/x86/kernel/irq.c:280
 common_interrupt+0x7e/0x90 arch/x86/kernel/irq.c:273
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:665
 native_irq_enable arch/x86/include/asm/irqflags.h:-1 [inline]
 arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline]
 do_user_addr_fault+0x139/0xde0 arch/x86/mm/fault.c:1288
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
 rep_movs_alternative+0x4a/0xa0 arch/x86/lib/copy_user_64.S:68
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_from_user arch/x86/include/asm/uaccess_64.h:141 [inline]
 copy_from_user_iter lib/iov_iter.c:67 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 __copy_from_iter lib/iov_iter.c:261 [inline]
 _copy_from_iter+0x114/0xe70 lib/iov_iter.c:272
 copy_from_iter include/linux/uio.h:228 [inline]
 copy_from_iter_full include/linux/uio.h:245 [inline]
 do_copy_data_nocache net/mptcp/protocol.c:1955 [inline]
 mptcp_sendmsg+0x91c/0x1110 net/mptcp/protocol.c:2079
 inet6_sendmsg+0xc5/0xd0 net/ipv6/af_inet6.c:638
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x390/0x590 net/socket.c:2715
 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2769
 __sys_sendmsg net/socket.c:2801 [inline]
 __do_sys_sendmsg net/socket.c:2806 [inline]
 __se_sys_sendmsg net/socket.c:2804 [inline]
 __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2804
 x64_sys_call+0x22ab/0x2550 arch/x86/include/generated/asm/syscalls_64.h:47
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888103bf5858 of 1 bytes by task 4733 on cpu 1:
 __ps2_command+0x589/0xa90 drivers/input/serio/libps2.c:343
 ps2_command+0x52/0x90 drivers/input/serio/libps2.c:403
 cypress_send_ext_cmd+0xba/0x550 drivers/input/mouse/cypress_ps2.c:142
 cypress_detect+0x44/0x130 drivers/input/mouse/cypress_ps2.c:163
 psmouse_do_detect drivers/input/mouse/psmouse-base.c:995 [inline]
 psmouse_try_protocol drivers/input/mouse/psmouse-base.c:1009 [inline]
 psmouse_extensions+0x48c/0x960 drivers/input/mouse/psmouse-base.c:1132
 psmouse_switch_protocol+0x8b/0x300 drivers/input/mouse/psmouse-base.c:1513
 psmouse_attr_set_protocol+0x462/0xad0 drivers/input/mouse/psmouse-base.c:1918
 psmouse_attr_set_helper+0x2a3/0x450 drivers/input/mouse/psmouse-base.c:1815
 dev_attr_store+0x4a/0x70 drivers/base/core.c:2509
 sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57a/0x990 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x02 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4733 Comm: syz.3.273 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
==================================================================
input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input5

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/25 00:15 upstream 5b0764a53235 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/10/10 19:32 upstream 3857c2fe5449 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/10/08 11:01 upstream 7b63ef2d55f2 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/30 20:15 upstream 551c722f4080 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/23 00:21 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/21 10:12 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/20 06:12 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/16 11:10 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/16 00:46 upstream f6e7b42bf05b 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/15 17:01 upstream 587858367581 2daa4bb5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/15 06:36 upstream 587858367581 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/13 14:01 upstream 2f0c1cf72f46 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/10 02:26 upstream 50d05c7c76c9 4e8b1cc6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/09/01 05:48 upstream bf1079577a11 316d9396 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/08/25 09:02 upstream 66498c75b4f8 614e416a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/08/05 07:11 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/27 03:01 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/24 21:38 upstream 48a5a7ab8d6a dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
2026/07/24 21:38 upstream 48a5a7ab8d6a dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __ps2_command / ps2_interrupt
* Struck through repros no longer work on HEAD.