KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

Status: moderation: reported on 2026/08/19 09:04
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+ae0bbb13f9677c2227da@syzkaller.appspotmail.com
First crash: 48d, last: 10d
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
016ee2f8 repro-c Reproduced: ✅ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/09/27 05:41 2026/09/27 05:41 2026/09/27 06:08 a3c7249d
1ab79ce8 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/21 00:00 2026/08/21 00:00 2026/08/21 00:43 1e72964b
038079b3 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/19 09:04 2026/08/19 09:04 2026/08/19 09:29 1e72964b
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/27 07:28 14m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fddfc3ec31799a932bb92f1b8a84cb3d1f963be9 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 10530 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6009 [inline]
 rb_get_reader_page+0x8a3/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 10442 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4394 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_kfree include/trace/events/kmem.h:97 [inline]
 trace_event_raw_event_kfree+0x94/0xf0 include/trace/events/kmem.h:97
 __do_trace_kfree include/trace/events/kmem.h:97 [inline]
 trace_kfree include/trace/events/kmem.h:97 [inline]
 kfree+0x351/0x3b0 mm/slub.c:6787
 ___sys_recvmsg+0x135/0x3a0 net/socket.c:2976
 do_recvmmsg+0x1e5/0x560 net/socket.c:3070
 __sys_recvmmsg net/socket.c:3144 [inline]
 __do_sys_recvmmsg net/socket.c:3167 [inline]
 __se_sys_recvmmsg net/socket.c:3160 [inline]
 __x64_sys_recvmmsg+0xe5/0x170 net/socket.c:3160
 x64_sys_call+0x77f/0x2550 arch/x86/include/generated/asm/syscalls_64.h:300
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b140 -> 0xffff88811b615c80

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 10442 Comm: syz.1.2351 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/26 04:43 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/09/16 10:51 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/08/24 07:00 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/08/19 09:04 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.