KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

Status: moderation: reported on 2026/08/15 02:24
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+53ab168fdda7fba508ba@syzkaller.appspotmail.com
First crash: 8d00h, last: 3d06h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
751a51b3 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/17 03:07 2026/08/17 03:07 2026/08/17 03:51 746171ee
d03851cc assessment-kcsan Benign: ✅ KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit 2026/08/15 02:23 2026/08/15 02:23 2026/08/15 02:50 746171ee

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit

write to 0xffff888100074cb4 of 1 bytes by task 14277 on cpu 1:
 ring_buffer_poll_wait+0x14e/0x200 kernel/trace/ring_buffer.c:1079
 trace_poll kernel/trace/trace.c:5323 [inline]
 tracing_poll_pipe+0xf7/0x120 kernel/trace/trace.c:5332
 vfs_poll include/linux/poll.h:82 [inline]
 select_poll_one fs/select.c:480 [inline]
 do_select+0x94a/0xfa0 fs/select.c:536
 core_sys_select+0x453/0x730 fs/select.c:677
 do_pselect fs/select.c:770 [inline]
 __do_sys_pselect6 fs/select.c:809 [inline]
 __se_sys_pselect6+0x23f/0x2a0 fs/select.c:800
 __x64_sys_pselect6+0x78/0x90 fs/select.c:800
 x64_sys_call+0x1dfc/0x2550 arch/x86/include/generated/asm/syscalls_64.h:271
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100074cb4 of 1 bytes by task 16153 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4297 [inline]
 ring_buffer_unlock_commit+0x57/0x450 kernel/trace/ring_buffer.c:4498
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_fill_mg_cmtime include/trace/events/timestamp.h:88 [inline]
 trace_event_raw_event_fill_mg_cmtime+0x16d/0x210 include/trace/events/timestamp.h:88
 __do_trace_fill_mg_cmtime include/trace/events/timestamp.h:88 [inline]
 trace_fill_mg_cmtime include/trace/events/timestamp.h:88 [inline]
 fill_mg_cmtime+0x1e0/0x240 fs/stat.c:61
 generic_fillattr+0x24d/0x340 fs/stat.c:99
 shmem_getattr+0x181/0x200 mm/shmem.c:1312
 vfs_getattr_nosec+0x146/0x1e0 fs/stat.c:213
 vfs_getattr fs/stat.c:262 [inline]
 vfs_fstat fs/stat.c:281 [inline]
 __do_sys_newfstat fs/stat.c:551 [inline]
 __se_sys_newfstat+0x96/0x460 fs/stat.c:546
 __x64_sys_newfstat+0x31/0x40 fs/stat.c:546
 x64_sys_call+0x1b5f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:6
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 16153 Comm: udevd Tainted: G        W           syzkaller #0 PREEMPT(lazy) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/19 20:45 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
2026/08/15 02:23 upstream dac3e89a2c90 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_poll_wait / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.