KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek

Status: upstream: reported on 2026/08/09 05:29
Subsystems: trace
Labels: prio:low race:harmful
[Documentation on labels]
Reported-by: syzbot+b57601b220ccc4fa1551@syzkaller.appspotmail.com
First crash: 35d, last: 3d22h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
e3fa6599 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek 2026/08/09 04:55 2026/08/09 04:55 2026/08/09 05:13 5d63f80b
e0dd956f assessment-kcsan Benign: ❌ KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek 2026/08/09 04:45 2026/08/09 04:45 2026/08/09 05:29 5d63f80b
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [trace?] KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek 0 (1) 2026/08/09 05:29

Sample crash report:
device-mapper: ioctl: ioctl interface mismatch: kernel(4.50.0), user(0.0.0), cmd(3)
==================================================================
BUG: KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek

write to 0xffff88810d436000 of 8 bytes by task 3023 on cpu 0:
 __rb_reserve_next+0x5e9/0x6c0 kernel/trace/ring_buffer.c:4937
 rb_reserve_next_event kernel/trace/ring_buffer.c:5011 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5070
 __trace_buffer_lock_reserve kernel/trace/trace.h:1676 [inline]
 trace_event_buffer_lock_reserve+0x14a/0x300 kernel/trace/trace.c:1924
 trace_event_buffer_reserve+0x120/0x180 kernel/trace/trace_events.c:715
 do_trace_event_raw_event_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_event_raw_event_sys_enter+0x6b/0x1f0 include/trace/events/syscalls.h:18
 __do_trace_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_syscall_enter+0xcc/0x130 kernel/entry/syscall-common.c:13
 syscall_trace_enter include/linux/entry-common.h:103 [inline]
 syscall_enter_from_user_mode_work include/linux/entry-common.h:140 [inline]
 do_syscall_64+0x295/0x360 arch/x86/entry/syscall_64.c:81
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810d436000 of 8 bytes by task 8919 on cpu 1:
 ring_buffer_iter_empty kernel/trace/ring_buffer.c:5733 [inline]
 rb_iter_peek kernel/trace/ring_buffer.c:6231 [inline]
 ring_buffer_iter_peek+0x265/0xb10 kernel/trace/ring_buffer.c:6393
 peek_next_entry kernel/trace/trace.c:2349 [inline]
 __find_next_entry+0x1a9/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 s_next+0x10e/0x370 kernel/trace/trace.c:2711
 traverse+0x1c1/0x3b0 fs/seq_file.c:121
 seq_lseek+0xb5/0x170 fs/seq_file.c:324
 tracing_lseek+0x63/0x80 kernel/trace/trace.c:3773
 vfs_llseek fs/read_write.c:391 [inline]
 ksys_lseek fs/read_write.c:404 [inline]
 __do_sys_lseek fs/read_write.c:414 [inline]
 __se_sys_lseek fs/read_write.c:412 [inline]
 __x64_sys_lseek+0xe8/0x160 fs/read_write.c:412
 x64_sys_call+0x156b/0x2550 arch/x86/include/generated/asm/syscalls_64.h:9
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000028bd853a4a -> 0x00000028cd5f82a8

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8919 Comm: syz.8.726 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/07 22:01 upstream df2908090cda 680aa3e1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
2026/08/22 03:20 upstream 26260251022f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
2026/08/19 13:51 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
2026/08/17 18:48 upstream 8d3ae59288f1 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
2026/08/09 19:10 upstream 06cf61899d64 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
2026/08/07 18:17 upstream f9a2394a2348 e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __rb_reserve_next / ring_buffer_iter_peek
* Struck through repros no longer work on HEAD.