KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

Status: upstream: reported on 2026/08/04 02:50
Subsystems: trace
Labels: race:harmful prio:low
[Documentation on labels]
Reported-by: syzbot+0168fe25f9e5d46bd5fe@syzkaller.appspotmail.com
First crash: 47d, last: 1d19h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
a5347919 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/09 06:17 2026/08/09 06:17 2026/08/09 06:49 5d63f80b
ceb74444 assessment-kcsan Benign: ❌ KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 2026/08/04 02:19 2026/08/04 02:19 2026/08/04 02:49 cb1adeae
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [trace?] KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit 1 (2) 2026/08/06 01:43

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit

write to 0xffff888100074cb4 of 1 bytes by task 9427 on cpu 0:
 rb_wakeups kernel/trace/ring_buffer.c:4380 [inline]
 ring_buffer_unlock_commit+0x6f/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_sched_wakeup_template include/trace/events/sched.h:141 [inline]
 trace_event_raw_event_sched_wakeup_template+0xb2/0x100 include/trace/events/sched.h:141
 __do_trace_sched_waking include/trace/events/sched.h:170 [inline]
 trace_sched_waking include/trace/events/sched.h:170 [inline]
 try_to_wake_up+0x5d6/0x6d0 kernel/sched/core.c:4314
 autoremove_wake_function+0x10/0x50 kernel/sched/wait.c:404
 __wake_up_common kernel/sched/wait.c:109 [inline]
 __wake_up_common_lock kernel/sched/wait.c:126 [inline]
 __wake_up_sync_key+0x52/0x80 kernel/sched/wait.c:193
 __unix_dgram_recvmsg+0x3a4/0x860 net/unix/af_unix.c:2615
 unix_dgram_recvmsg+0x7e/0x90 net/unix/af_unix.c:2689
 sock_recvmsg_nosec+0xc2/0xf0 net/socket.c:1151
 ____sys_recvmsg+0x26f/0x280 net/socket.c:2931
 ___sys_recvmsg+0x11f/0x3a0 net/socket.c:2975
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100074cb4 of 1 bytes by task 9411 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4379 [inline]
 ring_buffer_unlock_commit+0x57/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_sched_stat_runtime include/trace/events/sched.h:553 [inline]
 trace_event_raw_event_sched_stat_runtime+0xef/0x150 include/trace/events/sched.h:553
 __do_trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 trace_sched_stat_runtime include/trace/events/sched.h:576 [inline]
 update_se+0x14f/0x450 kernel/sched/fair.c:1425
 update_curr+0x1e/0x210 kernel/sched/fair.c:2048
 update_curr_eevdf kernel/sched/fair.c:7980 [inline]
 __dequeue_task+0x60/0x800 kernel/sched/fair.c:8132
 dequeue_task kernel/sched/core.c:2226 [inline]
 block_task kernel/sched/core.c:2278 [inline]
 try_to_block_task kernel/sched/core.c:6768 [inline]
 __schedule+0x2a5/0xd20 kernel/sched/core.c:7185
 __schedule_loop kernel/sched/core.c:7354 [inline]
 schedule+0x5b/0xa0 kernel/sched/core.c:7369
 schedule_hrtimeout_range_clock+0x126/0x1a0 kernel/time/sleep_timeout.c:207
 schedule_hrtimeout_range+0x28/0x40 kernel/time/sleep_timeout.c:263
 poll_schedule_timeout fs/select.c:241 [inline]
 do_select+0xed3/0xfa0 fs/select.c:603
 core_sys_select+0x453/0x730 fs/select.c:677
 do_pselect fs/select.c:770 [inline]
 __do_sys_pselect6 fs/select.c:809 [inline]
 __se_sys_pselect6+0x23f/0x2a0 fs/select.c:800
 __x64_sys_pselect6+0x78/0x90 fs/select.c:800
 x64_sys_call+0x1dfc/0x2550 arch/x86/include/generated/asm/syscalls_64.h:271
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 9411 Comm: syz.9.1260 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/19 02:31 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/19 02:30 upstream 17e7b8eacf4c 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/15 02:08 upstream 704340f1cd0d 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/09 09:04 upstream 893e11787f78 8387c273 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/09/07 12:34 upstream df2908090cda 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/29 08:16 upstream c20313e98b04 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/19 20:45 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/17 12:20 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/13 12:40 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/08 18:06 upstream a7c7074b58d2 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/07 22:07 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
2026/08/04 02:19 upstream 848acc8ffe1b 9451e17e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ring_buffer_unlock_commit / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.