KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

Status: moderation: reported on 2026/08/19 09:04
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+ae0bbb13f9677c2227da@syzkaller.appspotmail.com
First crash: 49d, last: 4h48m
▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
016ee2f8 repro-c Reproduced: ✅ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/09/27 05:41 2026/09/27 05:41 2026/09/27 06:08 a3c7249d
1ab79ce8 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/21 00:00 2026/08/21 00:00 2026/08/21 00:43 1e72964b
038079b3 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit 2026/08/19 09:04 2026/08/19 09:04 2026/08/19 09:29 1e72964b
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/27 07:28 14m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fddfc3ec31799a932bb92f1b8a84cb3d1f963be9 report job log log

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 12382 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6009 [inline]
 rb_get_reader_page+0x8a3/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 12321 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4394 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 trace_buffer_unlock_commit_regs+0x43/0x310 kernel/trace/trace.c:2049
 trace_event_buffer_commit+0x149/0x590 kernel/trace/trace.c:2024
 do_trace_event_raw_event_memcg_rstat_stats include/trace/events/memcg.h:12 [inline]
 trace_event_raw_event_memcg_rstat_stats+0xd2/0x130 include/trace/events/memcg.h:12
 __do_trace_mod_memcg_lruvec_state include/trace/events/memcg.h:41 [inline]
 trace_mod_memcg_lruvec_state include/trace/events/memcg.h:41 [inline]
 __mod_memcg_lruvec_state+0x292/0x2a0 mm/memcontrol.c:977
 mod_memcg_lruvec_state mm/memcontrol.c:995 [inline]
 mod_lruvec_state+0x107/0x120 mm/memcontrol.c:1018
 lruvec_stat_mod_folio+0xeb/0x130 mm/memcontrol.c:1038
 shmem_update_stats mm/shmem.c:886 [inline]
 shmem_add_to_page_cache+0x49e/0x5b0 mm/shmem.c:936
 shmem_alloc_and_add_folio mm/shmem.c:2004 [inline]
 shmem_get_folio_gfp+0x517/0xd90 mm/shmem.c:2531
 shmem_get_folio mm/shmem.c:2637 [inline]
 shmem_write_begin+0xfc/0x1f0 mm/shmem.c:3268
 generic_perform_write+0x186/0x490 mm/filemap.c:4374
 shmem_file_write_iter+0xc5/0xf0 mm/shmem.c:3443
 __kernel_write_iter+0x30f/0x590 fs/read_write.c:621
 dump_emit_page fs/coredump.c:1293 [inline]
 dump_user_range+0xa73/0xd00 fs/coredump.c:1367
 elf_core_dump+0x21c0/0x2340 fs/binfmt_elf.c:2106
 coredump_write+0xafb/0xdd0 fs/coredump.c:1047
 do_coredump fs/coredump.c:1126 [inline]
 vfs_coredump+0x2762/0x3270 fs/coredump.c:1195
 get_signal+0xd33/0xf10 kernel/signal.c:3097
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x14d/0x610 kernel/entry/common.c:165
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

value changed: 0xffff88810019b140 -> 0xffff88810019b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12321 Comm: syz.3.2809 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/07 18:38 upstream 602042bf29f6 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/09/26 04:43 upstream 6812ce4e4379 a3c7249d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/09/16 10:51 upstream 9b87fdc9af2f 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/08/24 07:00 upstream 388b607d107c 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
2026/08/19 09:04 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit
* Struck through repros no longer work on HEAD.