syzbot


KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (6)

Status: moderation: reported on 2026/01/18 01:30
Subsystems: rtc
[Documentation on labels]
Reported-by: syzbot+2d4127acca35ed7b31ad@syzkaller.appspotmail.com
Fix commit: rtc: add data_race() in rtc_dev_poll()
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 93d, last: 20d
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
e9efc9ac-ec40-4965-ac24-a8bd08fcce59 repro KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (6) 2026/03/07 15:45 2026/03/07 15:45 2026/03/07 15:52 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
0beb4006-3efd-4bc7-8c5e-47bda9910829 assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (6) 2026/01/18 01:29 2026/01/18 01:29 2026/01/18 01:32 a9d6a79219801d2130df3b1a792c57f0e5428e9f
Discussions (1)
Title Replies (including bot) Last reply
[PATCH] rtc: add data_race() in rtc_dev_poll() 2 (2) 2026/04/03 14:54
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (2) rtc 6 1 1560d 1560d 0/29 auto-closed as invalid on 2022/02/16 06:16
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (5) rtc 6 45 154d 504d 0/29 auto-obsoleted due to no activity on 2026/01/13 07:07
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (4) rtc 6 1 655d 655d 0/29 auto-obsoleted due to no activity on 2024/08/09 01:42
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq rtc 6 1 1683d 1683d 0/29 auto-closed as invalid on 2021/10/16 01:04
upstream KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (3) rtc 6 1 723d 723d 0/29 auto-obsoleted due to no activity on 2024/06/01 19:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq

read-write to 0xffff88810385eb98 of 8 bytes by interrupt on cpu 0:
 rtc_handle_legacy_irq drivers/rtc/interface.c:651 [inline]
 rtc_pie_update_irq+0x7b/0xd0 drivers/rtc/interface.c:699
 __run_hrtimer kernel/time/hrtimer.c:1785 [inline]
 __hrtimer_run_queues+0x218/0x4f0 kernel/time/hrtimer.c:1849
 hrtimer_interrupt+0x269/0x810 kernel/time/hrtimer.c:1911
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1f0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 __sanitizer_cov_trace_switch+0x7f/0x130 kernel/kcov.c:-1
 devcgroup_inode_permission include/linux/device_cgroup.h:21 [inline]
 inode_permission+0x1bc/0x3b0 fs/namei.c:652
 lookup_inode_permission_may_exec fs/namei.c:688 [inline]
 may_lookup fs/namei.c:1958 [inline]
 link_path_walk+0x779/0xe30 fs/namei.c:2601
 path_lookupat+0x8c/0x500 fs/namei.c:2809
 filename_lookup+0x190/0x390 fs/namei.c:2839
 vfs_statx+0x96/0x170 fs/stat.c:353
 vfs_fstatat+0x118/0x170 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat+0x55/0x3e0 fs/stat.c:532
 __x64_sys_newfstatat+0x55/0x70 fs/stat.c:532
 x64_sys_call+0x2c64/0x3020 arch/x86/include/generated/asm/syscalls_64.h:263
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810385eb98 of 8 bytes by task 14338 on cpu 1:
 rtc_dev_poll+0x78/0xb0 drivers/rtc/dev.c:198
 vfs_poll include/linux/poll.h:82 [inline]
 io_file_supports_nowait io_uring/rw.c:47 [inline]
 __io_read+0x312/0xc50 io_uring/rw.c:937
 io_read+0x4a/0x190 io_uring/rw.c:1031
 __io_issue_sqe+0xfd/0x2d0 io_uring/io_uring.c:1384
 io_issue_sqe+0x206/0xc00 io_uring/io_uring.c:1407
 io_queue_sqe io_uring/io_uring.c:1634 [inline]
 io_req_task_submit+0x46/0xa0 io_uring/io_uring.c:1044
 io_handle_tw_list+0x1f5/0x230 io_uring/tw.c:72
 tctx_task_work_run+0x42/0x170 io_uring/tw.c:132
 tctx_task_work+0x3f/0x80 io_uring/tw.c:150
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 get_signal+0xe0e/0xf60 kernel/signal.c:2807
 arch_do_signal_or_restart+0x96/0x450 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x6a/0x6f0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x249/0x370 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000059c0 -> 0x0000000000005ac0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 14338 Comm: syz.2.3775 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/01 14:45 upstream dbf00d8d23b4 9a1f7828 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/03/23 10:44 upstream c369299895a5 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/03/23 02:44 upstream ec69c9e88315 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/03/09 22:19 upstream 1f318b96cc84 176bead5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/02/23 03:22 upstream 6de23f81a5e0 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/02/12 23:01 upstream 37a93dd5c49b 504cb1bf .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/23 05:29 upstream c072629f05d7 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/23 05:29 upstream c072629f05d7 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/23 01:19 upstream a66191c590b3 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/23 01:19 upstream a66191c590b3 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/23 01:19 upstream a66191c590b3 82c9c083 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
2026/01/18 01:29 upstream d3eeb99bbc99 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq
* Struck through repros no longer work on HEAD.