KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

Status: upstream: reported on 2026/08/04 02:50
Subsystems: trace
Labels: race:harmful prio:low
[Documentation on labels]
Reported-by: syzbot+0168fe25f9e5d46bd5fe@syzkaller.appspotmail.com
First crash: 92d, last: 12d
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
b17a2a2e repro-c Reproduced: ✅ ❓ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/09/24 08:58 2026/09/24 08:58 2026/09/24 09:26 3c3cdf19
a5347919 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/09 06:17 2026/08/09 06:17 2026/08/09 06:49 5d63f80b
ceb74444 assessment-kcsan Benign: ❌ ❓ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/04 02:19 2026/08/04 02:19 2026/08/04 02:49 cb1adeae
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [trace?] KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 1 (2) 2026/08/06 01:43
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/24 09:28 12m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 62f4c998b297cf233997a2b4cd6fc2d2df0319c9 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

write to 0xffff888100074cb4 of 1 bytes by task 12003 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4382 [inline]
 ring_buffer_unlock_commit+0x6f/0x450 kernel/trace/ring_buffer.c:4582
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2060
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2035
 do_trace_event_raw_event_memcg_rstat_stats include/trace/events/memcg.h:12 [inline]
 trace_event_raw_event_memcg_rstat_stats+0xd2/0x130 include/trace/events/memcg.h:12
 __do_trace_mod_memcg_state include/trace/events/memcg.h:34 [inline]
 trace_mod_memcg_state include/trace/events/memcg.h:34 [inline]
 __mod_memcg_state+0x26c/0x280 mm/memcontrol.c:905
 mod_memcg_state mm/memcontrol.c:925 [inline]
 account_kmem_nmi_safe mm/memcontrol.c:3121 [inline]
 obj_cgroup_charge_pages mm/memcontrol.c:3165 [inline]
 __memcg_kmem_charge_page+0x3a2/0x3b0 mm/memcontrol.c:3205
 __alloc_frozen_pages_noprof+0x1f4/0x3d0 mm/page_alloc.c:5453
 alloc_pages_mpol+0xaf/0x1d0 mm/mempolicy.c:2486
 alloc_frozen_pages_noprof mm/mempolicy.c:2557 [inline]
 alloc_pages_noprof+0x94/0x140 mm/mempolicy.c:2577
 pagetable_alloc_noprof include/linux/mm.h:3794 [inline]
 __pte_alloc_one_noprof include/asm-generic/pgalloc.h:76 [inline]
 pte_alloc_one+0x1c/0xc0 arch/x86/mm/pgtable.c:18
 __pte_alloc+0x32/0x2a0 mm/memory.c:453
 copy_pte_range mm/memory.c:1335 [inline]
 copy_pmd_range mm/memory.c:1490 [inline]
 copy_pud_range mm/memory.c:1527 [inline]
 copy_p4d_range mm/memory.c:1551 [inline]
 copy_page_range+0x2caa/0x3350 mm/memory.c:1637
 dup_mmap+0x874/0x10c0 mm/mmap.c:1819
 dup_mm kernel/fork.c:1543 [inline]
 copy_mm+0xf5/0x340 kernel/fork.c:1595
 copy_process+0x10e9/0x23f0 kernel/fork.c:2321
 kernel_clone+0x1c0/0x5f0 kernel/fork.c:2785
 __do_sys_clone kernel/fork.c:2927 [inline]
 __se_sys_clone kernel/fork.c:2911 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2911
 x64_sys_call+0x2479/0x2550 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100074cb4 of 1 bytes by task 16243 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4381 [inline]
 ring_buffer_unlock_commit+0x57/0x450 kernel/trace/ring_buffer.c:4582
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2060
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2035
 do_trace_event_raw_event_sys_exit include/trace/events/syscalls.h:44 [inline]
 trace_event_raw_event_sys_exit+0x9f/0xf0 include/trace/events/syscalls.h:44
 __do_trace_sys_exit include/trace/events/syscalls.h:44 [inline]
 trace_sys_exit include/trace/events/syscalls.h:44 [inline]
 trace_syscall_exit+0xc2/0x120 kernel/entry/syscall-common.c:18
 syscall_exit_work include/linux/entry-common.h:269 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:304 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:341 [inline]
 do_syscall_64+0x31c/0x360 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 16243 Comm: syz.9.3878 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
==================================================================

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/23 19:21 upstream 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/16 11:43 upstream 2f2f7eeef8b0 4c840a2f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/14 13:37 upstream 4056b3c9d3c9 1a71827b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/11 16:57 upstream b88c841d1164 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/06 16:56 upstream 2c3418fffa9d f7710056 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/04 22:05 upstream 6addb4f38557 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/10/04 07:45 upstream a74306e2e676 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/19 02:31 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/19 02:30 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/15 02:08 upstream 704340f1cd0d 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/09 09:04 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/07 12:34 upstream df2908090cda 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/29 08:16 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/19 20:45 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/17 12:20 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/13 12:40 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/08 18:06 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/07 22:07 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/04 02:19 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.