KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch

Status: moderation: reported on 2026/08/19 20:57
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+0f695b38e92691e0bd5f@syzkaller.appspotmail.com
First crash: 20d, last: 15h38m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
b89c9dcf assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch 2026/08/21 00:01 2026/08/21 00:01 2026/08/21 00:34 1e72964b
754f90a5 assessment-kcsan Benign: ✅ KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch 2026/08/19 20:57 2026/08/19 20:57 2026/08/19 21:22 1e72964b

Sample crash report:
==================================================================
BUG: KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch

write to 0xffffffff895f81e0 of 4 bytes by task 13299 on cpu 0:
 tracing_start_sched_switch+0x8d/0x200 kernel/trace/trace_sched_switch.c:101
 tracing_start_cmdline_record+0x13/0x20 kernel/trace/trace_sched_switch.c:135
 __ftrace_event_enable_disable+0x203/0x4b0 kernel/trace/trace_events.c:894
 ftrace_event_enable_disable kernel/trace/trace_events.c:934 [inline]
 __ftrace_set_clr_event_nolock+0x39e/0x820 kernel/trace/trace_events.c:1404
 __ftrace_set_clr_event kernel/trace/trace_events.c:1437 [inline]
 ftrace_set_clr_event+0x2a8/0x320 kernel/trace/trace_events.c:1487
 ftrace_event_write+0x170/0x1d0 kernel/trace/trace_events.c:1575
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895f81e0 of 4 bytes by task 13337 on cpu 1:
 probe_sched_switch+0x46/0xa0 kernel/trace/trace_sched_switch.c:32
 __traceiter_sched_switch+0x3f/0x60 include/trace/events/sched.h:220
 __do_trace_sched_switch include/trace/events/sched.h:220 [inline]
 trace_sched_switch include/trace/events/sched.h:220 [inline]
 __schedule+0xc34/0xd20 kernel/sched/core.c:7273
 preempt_schedule_common+0x12/0x40 kernel/sched/core.c:7455
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
 _raw_spin_unlock_irqrestore+0x27/0x30 kernel/locking/spinlock.c:221
 __unix_dgram_recvmsg+0x3a4/0x860 net/unix/af_unix.c:2615
 unix_dgram_recvmsg+0x7e/0x90 net/unix/af_unix.c:2689
 sock_recvmsg_nosec+0xc2/0xf0 net/socket.c:1151
 ____sys_recvmsg+0x26f/0x280 net/socket.c:2931
 ___sys_recvmsg+0x11f/0x3a0 net/socket.c:2975
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000477 -> 0x00000478

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 13337 Comm: syz.8.2564 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/08 10:17 upstream 28924df2a08f 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch
2026/09/07 00:53 upstream 88405f0ad1d5 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch
2026/09/05 22:39 upstream 0d9ff90a5422 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch
2026/09/05 02:12 upstream bc35965f6940 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch
2026/08/19 20:56 upstream e8bf40d15402 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in probe_sched_switch / tracing_start_sched_switch
* Struck through repros no longer work on HEAD.