syzbot


KCSAN: data-race in __stop_tty / __uart_start

Status: moderation: reported on 2026/03/21 18:14
Subsystems: serial
[Documentation on labels]
Reported-by: syzbot+e5f02961146b84f62fae@syzkaller.appspotmail.com
First crash: 2d22h, last: 2d22h
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
65a73b0f-8852-44dd-af29-3c3e1728a39c assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in __stop_tty / __uart_start 2026/03/21 18:14 2026/03/21 18:14 2026/03/21 18:31 f84caa2f84dea47b51a188e8d6267f295e89bbcb

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __stop_tty / __uart_start

write to 0xffff88813277f1bc of 1 bytes by task 32434 on cpu 1:
 __stop_tty+0x36/0x90 drivers/tty/tty_io.c:744
 n_tty_ioctl_helper+0x2d1/0x370 drivers/tty/tty_ioctl.c:951
 n_tty_ioctl+0x101/0x230 drivers/tty/n_tty.c:2496
 tty_ioctl+0x83e/0xb80 drivers/tty/tty_io.c:2801
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1563/0x3020 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88813277f1bc of 1 bytes by task 32428 on cpu 0:
 uart_tx_stopped include/linux/serial_core.h:1149 [inline]
 __uart_start+0x8a/0x2d0 drivers/tty/serial/serial_core.c:143
 uart_write+0x186/0x530 drivers/tty/serial/serial_core.c:633
 process_output_block drivers/tty/n_tty.c:557 [inline]
 n_tty_write+0x856/0xc20 drivers/tty/n_tty.c:2366
 iterate_tty_write drivers/tty/tty_io.c:1006 [inline]
 file_tty_write+0x378/0x690 drivers/tty/tty_io.c:1081
 tty_write+0x25/0x30 drivers/tty/tty_io.c:1102
 iter_file_splice_write+0x6c4/0xa80 fs/splice.c:736
 do_splice_from fs/splice.c:936 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1159
 splice_direct_to_actor+0x311/0x670 fs/splice.c:1103
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x382/0x650 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1433 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1419
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x370 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 32428 Comm: syz.8.23941 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/21 18:13 upstream a0c83177734a 5b92003d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __stop_tty / __uart_start
* Struck through repros no longer work on HEAD.