KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

Status: upstream: reported on 2026/08/04 02:50
Subsystems: trace
Labels: race:harmful prio:low
[Documentation on labels]
Reported-by: syzbot+0168fe25f9e5d46bd5fe@syzkaller.appspotmail.com
First crash: 34d, last: 2h29m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
a5347919 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/09 06:17 2026/08/09 06:17 2026/08/09 06:49 5d63f80b
ceb74444 assessment-kcsan Benign: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/04 02:19 2026/08/04 02:19 2026/08/04 02:49 cb1adeae
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [trace?] KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 1 (2) 2026/08/06 01:43

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

read to 0xffff888100074cb4 of 1 bytes by task 9878 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4380 [inline]
 ring_buffer_unlock_commit+0x57/0x450 kernel/trace/ring_buffer.c:4581
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_hrtimer_setup include/trace/events/timer.h:193 [inline]
 trace_event_raw_event_hrtimer_setup+0xca/0x170 include/trace/events/timer.h:193
 __do_trace_hrtimer_setup include/trace/events/timer.h:193 [inline]
 trace_hrtimer_setup include/trace/events/timer.h:193 [inline]
 debug_setup_on_stack kernel/time/hrtimer.c:524 [inline]
 hrtimer_setup_sleeper_on_stack+0xd1/0xf0 kernel/time/hrtimer.c:2396
 schedule_hrtimeout_range_clock+0x71/0x1a0 kernel/time/sleep_timeout.c:211
 schedule_hrtimeout_range+0x28/0x40 kernel/time/sleep_timeout.c:263
 poll_schedule_timeout fs/select.c:241 [inline]
 do_select+0xed3/0xfa0 fs/select.c:603
 core_sys_select+0x453/0x730 fs/select.c:677
 do_pselect fs/select.c:770 [inline]
 __do_sys_pselect6 fs/select.c:809 [inline]
 __se_sys_pselect6+0x23f/0x2a0 fs/select.c:800
 __x64_sys_pselect6+0x78/0x90 fs/select.c:800
 x64_sys_call+0x1dfc/0x2550 arch/x86/include/generated/asm/syscalls_64.h:271
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888100074cb4 of 1 bytes by task 8515 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4381 [inline]
 ring_buffer_unlock_commit+0x6f/0x450 kernel/trace/ring_buffer.c:4581
 __buffer_unlock_commit kernel/trace/trace.h:1697 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_event_raw_event_mm_page_alloc+0xbf/0x110 include/trace/events/kmem.h:180
 __do_trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 trace_mm_page_alloc include/trace/events/kmem.h:180 [inline]
 __alloc_frozen_pages_noprof+0x3d7/0x400 mm/page_alloc.c:5459
 __alloc_pages_noprof mm/page_alloc.c:5471 [inline]
 alloc_pages_bulk_noprof+0x4ca/0x550 mm/page_alloc.c:5295
 alloc_pages_bulk_mempolicy_noprof+0x2ee/0xeb0 mm/mempolicy.c:2794
 vm_area_alloc_pages mm/vmalloc.c:3736 [inline]
 __vmalloc_area_node mm/vmalloc.c:3914 [inline]
 __vmalloc_node_range_noprof+0x7a5/0x1000 mm/vmalloc.c:4104
 __vmalloc_node_noprof mm/vmalloc.c:4165 [inline]
 vzalloc_noprof+0x82/0xb0 mm/vmalloc.c:4243
 alloc_counters+0x38/0x2d0 net/ipv4/netfilter/ip_tables.c:799
 copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:837 [inline]
 get_entries net/ipv6/netfilter/ip6_tables.c:1037 [inline]
 do_ip6t_get_ctl+0x8ae/0xcb0 net/ipv6/netfilter/ip6_tables.c:1678
 nf_getsockopt+0x190/0x1b0 net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x170/0x1e0 net/ipv6/ipv6_sockglue.c:1464
 tcp_getsockopt+0xad/0xe0 net/ipv4/tcp.c:4874
 sock_common_getsockopt+0x60/0x70 net/core/sock.c:4014
 do_sock_getsockopt+0x2f5/0x570 net/socket.c:2503
 __sys_getsockopt net/socket.c:2534 [inline]
 __do_sys_getsockopt net/socket.c:2541 [inline]
 __se_sys_getsockopt net/socket.c:2538 [inline]
 __x64_sys_getsockopt+0x11d/0x1a0 net/socket.c:2538
 x64_sys_call+0x1032/0x2550 arch/x86/include/generated/asm/syscalls_64.h:56
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8515 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (8):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/07 12:34 upstream df2908090cda 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/29 08:16 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/19 20:45 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/17 12:20 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/13 12:40 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/08 18:06 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/07 22:07 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/04 02:19 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.