syzbot


KCSAN: data-race in io_submit_sqes / io_uring_poll (9)

Status: moderation: reported on 2026/02/09 06:16
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+7ef14dc2fcc5d562bfa3@syzkaller.appspotmail.com
First crash: 2d15h, last: 2d15h
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (2) fs 6 1 1864d 1864d 0/29 auto-closed as invalid on 2021/02/08 06:39
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (3) fs 6 55 1542d 1620d 0/29 auto-closed as invalid on 2021/12/27 08:47
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (7) io-uring 6 1 666d 666d 0/29 auto-obsoleted due to no activity on 2024/05/21 11:08
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll fs 6 2 1966d 1992d 0/29 auto-closed as invalid on 2020/10/29 16:22
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (5) io-uring 6 21 1023d 1212d 0/29 auto-obsoleted due to no activity on 2023/05/30 00:18
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (8) io-uring 6 18 526d 599d 0/29 auto-obsoleted due to no activity on 2024/10/08 01:12
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (6) io-uring 6 1 822d 793d 0/29 auto-obsoleted due to no activity on 2023/12/25 00:08
upstream KCSAN: data-race in io_submit_sqes / io_uring_poll (4) io-uring 6 123 1264d 1430d 0/29 auto-obsoleted due to no activity on 2022/10/01 12:19

Sample crash report:
==================================================================
BUG: KCSAN: data-race in io_submit_sqes / io_uring_poll

write to 0xffff88811b0b0804 of 2 bytes by task 3493 on cpu 0:
 io_init_req io_uring/io_uring.c:2177 [inline]
 io_submit_sqe io_uring/io_uring.c:2282 [inline]
 io_submit_sqes+0xc11/0x11b0 io_uring/io_uring.c:2435
 __do_sys_io_uring_enter io_uring/io_uring.c:3285 [inline]
 __se_sys_io_uring_enter+0x1bf/0x1c70 io_uring/io_uring.c:3224
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3224
 x64_sys_call+0x27e4/0x3000 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811b0b0804 of 2 bytes by task 3489 on cpu 1:
 io_uring_poll+0x2f/0x1b0 io_uring/io_uring.c:2930
 vfs_poll include/linux/poll.h:82 [inline]
 __io_arm_poll_handler+0x1ee/0xb80 io_uring/poll.c:581
 io_poll_add+0x69/0xf0 io_uring/poll.c:899
 __io_issue_sqe+0xfd/0x2d0 io_uring/io_uring.c:1793
 io_issue_sqe+0x20b/0xc20 io_uring/io_uring.c:1816
 io_queue_sqe io_uring/io_uring.c:2043 [inline]
 io_submit_sqe io_uring/io_uring.c:2321 [inline]
 io_submit_sqes+0x78a/0x11b0 io_uring/io_uring.c:2435
 __do_sys_io_uring_enter io_uring/io_uring.c:3285 [inline]
 __se_sys_io_uring_enter+0x1bf/0x1c70 io_uring/io_uring.c:3224
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:3224
 x64_sys_call+0x27e4/0x3000 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0100 -> 0x0304

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3489 Comm: syz.2.3 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/09 06:15 upstream e98f34af6116 4c131dc4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in io_submit_sqes / io_uring_poll
* Struck through repros no longer work on HEAD.