KCSAN: data-race in rb_get_reader_page / rb_move_tail

Status: moderation: reported C repro on 2026/09/27 07:43
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+ea89645dbec33a40e680@syzkaller.appspotmail.com
First crash: 1h07m, last: 1h07m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
9777b2de assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in rb_get_reader_page / rb_move_tail 2026/09/27 07:43 2026/09/27 07:43 2026/09/27 08:37 a3c7249d
94b81d29 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KCSAN: data-race in rb_get_reader_page / rb_move_tail 2026/09/27 07:43 2026/09/27 07:43 2026/09/27 08:43 a3c7249d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b148 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b148 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_move_tail+0xa5/0xbb0 kernel/trace/ring_buffer.c:3964
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b100 -> 0xffff88810019b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b148 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b148 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_set_commit_to_write kernel/trace/ring_buffer.c:4268 [inline]
 rb_end_commit kernel/trace/ring_buffer.c:4321 [inline]
 rb_move_tail+0x4f3/0xbb0 kernel/trace/ring_buffer.c:4009
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b100

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6009 [inline]
 rb_get_reader_page+0x8a3/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 3636 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4394 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 write_marker_to_buffer+0x38a/0x520 kernel/trace/trace.c:5974
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b140

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b108 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b108 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_set_commit_to_write kernel/trace/ring_buffer.c:4268 [inline]
 rb_end_commit kernel/trace/ring_buffer.c:4321 [inline]
 rb_move_tail+0x4f3/0xbb0 kernel/trace/ring_buffer.c:4009
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b140 -> 0xffff88810019b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b148 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b148 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_move_tail+0xa5/0xbb0 kernel/trace/ring_buffer.c:3964
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b100 -> 0xffff88810019b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6009 [inline]
 rb_get_reader_page+0x8a3/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 3636 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4394 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 write_marker_to_buffer+0x38a/0x520 kernel/trace/trace.c:5974
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b100

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b108 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b108 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_set_commit_to_write kernel/trace/ring_buffer.c:4268 [inline]
 rb_end_commit kernel/trace/ring_buffer.c:4321 [inline]
 rb_move_tail+0x4f3/0xbb0 kernel/trace/ring_buffer.c:4009
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b140

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / ring_buffer_unlock_commit

write to 0xffff888100078868 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6009 [inline]
 rb_get_reader_page+0x8a3/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x4d1/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888100078868 of 8 bytes by task 3636 on cpu 1:
 rb_wakeups kernel/trace/ring_buffer.c:4394 [inline]
 ring_buffer_unlock_commit+0x17b/0x450 kernel/trace/ring_buffer.c:4580
 __buffer_unlock_commit kernel/trace/trace.h:1698 [inline]
 write_marker_to_buffer+0x38a/0x520 kernel/trace/trace.c:5974
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b140

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b148 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b148 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_move_tail+0xa5/0xbb0 kernel/trace/ring_buffer.c:3964
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b0c0 -> 0xffff88810019b100

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
==================================================================
BUG: KCSAN: data-race in rb_get_reader_page / rb_move_tail

write to 0xffff88810019b108 of 8 bytes by task 3635 on cpu 0:
 __rb_get_reader_page kernel/trace/ring_buffer.c:6002 [inline]
 rb_get_reader_page+0x854/0xdf0 kernel/trace/ring_buffer.c:6068
 rb_buffer_peek+0x44/0x870 kernel/trace/ring_buffer.c:6149
 ring_buffer_peek+0xb2/0x210 kernel/trace/ring_buffer.c:6352
 peek_next_entry kernel/trace/trace.c:2354 [inline]
 __find_next_entry+0x229/0x420 kernel/trace/trace.c:2398
 trace_find_next_entry_inc kernel/trace/trace.c:2672 [inline]
 tracing_read_pipe+0x2f7/0x790 kernel/trace/trace.c:5442
 vfs_read+0x18e/0x7c0 fs/read_write.c:572
 ksys_read+0xdc/0x1a0 fs/read_write.c:716
 __do_sys_read fs/read_write.c:725 [inline]
 __se_sys_read fs/read_write.c:723 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:723
 x64_sys_call+0x2135/0x2550 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810019b108 of 8 bytes by task 3636 on cpu 1:
 rb_is_reader_page kernel/trace/ring_buffer.c:1351 [inline]
 rb_set_commit_to_write kernel/trace/ring_buffer.c:4268 [inline]
 rb_end_commit kernel/trace/ring_buffer.c:4321 [inline]
 rb_move_tail+0x4f3/0xbb0 kernel/trace/ring_buffer.c:4009
 __rb_reserve_next+0x47d/0x6c0 kernel/trace/ring_buffer.c:4854
 rb_reserve_next_event kernel/trace/ring_buffer.c:5010 [inline]
 ring_buffer_lock_reserve+0x6b3/0x860 kernel/trace/ring_buffer.c:5069
 __trace_buffer_lock_reserve kernel/trace/trace.h:1677 [inline]
 write_marker_to_buffer+0xa6/0x520 kernel/trace/trace.c:5936
 tracing_mark_write+0x17a/0x200 kernel/trace/trace.c:6322
 vfs_write+0x254/0x9a0 fs/read_write.c:685
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88810019b140 -> 0xffff88810019b0c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3636 Comm: syz-executor148 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/27 07:42 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git fddfc3ec3179 a3c7249d .config console log report C ci2-upstream-kcsan-gce KCSAN: data-race in rb_get_reader_page / rb_move_tail
* Struck through repros no longer work on HEAD.