KCSAN: data-race in kick_pool_pick / wq_worker_running

Status: moderation: reported C repro on 2026/08/20 22:04
Subsystems: usb net
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+8922e6b8343f70be92e8@syzkaller.appspotmail.com
Fix commit: bda345b3fc59 workqueue: mark pool->nr_running as __data_racy
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-native-arm64-kvm ci-qemu2-riscv64 ci-upstream-gce-arm64 ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci2-upstream-usb]
First crash: 64d, last: 1d16h
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
e7c59924 repro-c Reproduced: ✅ ❓ KCSAN: data-race in kick_pool_pick / wq_worker_running 2026/09/28 23:42 2026/09/28 23:42 2026/09/29 04:03 58f15308
80dde489 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in kick_pool_pick / wq_worker_running 2026/08/22 00:00 2026/08/22 00:00 2026/08/22 00:14 1e72964b
c85495d2 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in kick_pool_pick / wq_worker_running 2026/08/20 22:03 2026/08/20 22:04 2026/08/20 22:27 1e72964b
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH v3] workqueue: mark pool->nr_running as __data_racy 3 (3) 2026/10/15 08:05
[PATCH v2] workqueue: annotate the lockless nr_running increment racing with need_more_worker() 3 (3) 2026/10/14 15:44
[PATCH] workqueue: annotate the lockless nr_running read in need_more_worker() 2 (2) 2026/10/12 18:25
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/29 05:37 9m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in kick_pool_pick / wq_worker_running

read-write to 0xffff888237c2b0a4 of 4 bytes by task 3661 on cpu 0:
 wq_worker_running+0x9c/0x120 kernel/workqueue.c:1465
 io_schedule+0x3e/0x60 kernel/sched/core.c:8220
 folio_wait_bit_common+0x3db/0x660 mm/filemap.c:1329
 folio_wait_bit+0x25/0x30 mm/filemap.c:1473
 folio_wait_writeback+0x59/0x120 mm/page-writeback.c:3062
 __filemap_fdatawait_range mm/filemap.c:532 [inline]
 file_write_and_wait_range+0x23b/0x2f0 mm/filemap.c:789
 ext4_sync_file+0x114/0x5c0 fs/ext4/fsync.c:145
 vfs_fsync_range fs/sync.c:186 [inline]
 vfs_fsync+0xbe/0xd0 fs/sync.c:200
 aio_fsync_work+0x76/0x100 fs/aio.c:1698
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888237c2b0a4 of 4 bytes by task 3654 on cpu 1:
 need_more_worker kernel/workqueue.c:954 [inline]
 kick_pool_pick+0x5f/0x310 kernel/workqueue.c:1284
 __queue_work+0x90a/0xbc0 kernel/workqueue.c:2449
 queue_work_on kernel/workqueue.c:2501 [inline]
 schedule_work_on include/linux/workqueue.h:742 [inline]
 schedule_on_each_cpu+0x1af/0x340 kernel/workqueue.c:4774
 vmstat_refresh+0x20/0x2a0 mm/vmstat.c:2015
 proc_sys_call_handler+0x2ec/0x4a0 fs/proc/proc_sysctl.c:600
 proc_sys_read+0x1f/0x30 fs/proc/proc_sysctl.c:621
 new_sync_read fs/read_write.c:493 [inline]
 vfs_read+0x699/0x7c0 fs/read_write.c:574
 ksys_pread64 fs/read_write.c:764 [inline]
 __do_sys_pread64 fs/read_write.c:772 [inline]
 __se_sys_pread64 fs/read_write.c:769 [inline]
 __x64_sys_pread64+0xfd/0x150 fs/read_write.c:769
 x64_sys_call+0xd2e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:18
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3654 Comm: syz-executor391 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (93):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 05:47 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 72d3fcf802c4 7bf4ea23 .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/22 15:02 upstream 7be4bc52fd9e b55fad29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/21 11:06 upstream 4cbdd58dfa7a 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/20 17:54 upstream f47d223627f8 df8746fb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/20 05:18 upstream c03c1a14507d 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/19 01:15 upstream a0ff06b3a7bd 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/18 14:06 upstream 32c52ec87d62 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/17 15:46 upstream 58161ead29e5 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/17 05:19 upstream 70dd4ee72eb2 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/16 02:19 upstream 9aa622dbaab8 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/15 17:36 upstream 9aa622dbaab8 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/15 02:17 upstream 0fcb05b72344 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/14 16:42 upstream 4056b3c9d3c9 1a71827b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/14 00:38 upstream 24a19b953e2a 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/13 11:05 upstream 24a19b953e2a 5a1eeac4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/12 21:16 upstream 24a19b953e2a 745a967f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/12 05:26 upstream 24a19b953e2a 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/11 21:32 upstream b88c841d1164 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/11 07:30 upstream a5ebb76233b7 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/10 12:36 upstream 3857c2fe5449 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/10 07:30 upstream fc1c25014ff8 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/09 06:49 upstream af32da41b032 b2734a59 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/08 08:19 upstream 7b63ef2d55f2 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/06 05:52 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/06 01:43 upstream 67f0943b394d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/05 19:35 upstream 67f0943b394d af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/05 11:50 upstream a90ee4305c4a af63e995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/05 03:06 upstream a90ee4305c4a 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/04 20:16 upstream 6addb4f38557 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/03 21:20 upstream a74306e2e676 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/02 20:17 upstream 5e0f8396d480 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/02 05:40 upstream ce1e0223d8ad 6d32eb1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/10/01 16:55 upstream 551c722f4080 f5cdae2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/30 20:43 upstream 551c722f4080 38f7f0d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/30 03:27 upstream 6f8319e3e9a4 328436b3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/29 16:38 upstream 6f8319e3e9a4 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/29 01:32 upstream 72d3fcf802c4 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/28 15:06 upstream 72d3fcf802c4 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/27 14:05 upstream fddfc3ec3179 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/26 10:39 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/25 07:02 upstream f49a343b305c f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/23 11:59 upstream fe2ec83746e5 abce1216 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/23 00:31 upstream c4e9f74da438 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/22 07:29 upstream f0100363d8c3 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/22 00:19 upstream f0100363d8c3 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/21 11:09 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/09/20 00:59 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/22 04:38 upstream 26260251022f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
2026/08/20 22:03 upstream cf62c7084acf 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in kick_pool_pick / wq_worker_running
* Struck through repros no longer work on HEAD.