KCSAN: data-race in rb_move_tail / rb_watermark_hit

Status: moderation: reported on 2026/08/19 04:31
Subsystems: trace
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+2339ee1713be6fa74d75@syzkaller.appspotmail.com
First crash: 1d23h, last: 1d23h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
fef7d1f3 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in rb_move_tail / rb_watermark_hit 2026/08/21 01:00 2026/08/21 01:00 2026/08/21 01:02 1e72964b
e05a0b22 assessment-kcsan Benign: ✅ KCSAN: data-race in rb_move_tail / rb_watermark_hit 2026/08/19 04:31 2026/08/19 04:31 2026/08/19 04:55 1e72964b

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rb_move_tail / rb_watermark_hit

read-write to 0xffff88810007a858 of 8 bytes by task 8088 on cpu 0:
 rb_inc_page kernel/trace/ring_buffer.c:1389 [inline]
 rb_set_commit_to_write kernel/trace/ring_buffer.c:4194 [inline]
 rb_end_commit kernel/trace/ring_buffer.c:4239 [inline]
 rb_move_tail+0x556/0xba0 kernel/trace/ring_buffer.c:3926
 __rb_reserve_next+0x485/0x6c0 kernel/trace/ring_buffer.c:4772
 rb_reserve_next_event kernel/trace/ring_buffer.c:4928 [inline]
 ring_buffer_lock_reserve+0x65c/0x810 kernel/trace/ring_buffer.c:4987
 __trace_buffer_lock_reserve kernel/trace/trace.h:1676 [inline]
 trace_event_buffer_lock_reserve+0x14a/0x300 kernel/trace/trace.c:1924
 trace_event_buffer_reserve+0x120/0x180 kernel/trace/trace_events.c:688
 do_trace_event_raw_event_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_event_raw_event_sys_enter+0x6b/0x1f0 include/trace/events/syscalls.h:18
 __do_trace_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_sys_enter include/trace/events/syscalls.h:18 [inline]
 trace_syscall_enter+0xc4/0x110 kernel/entry/syscall-common.c:13
 syscall_trace_enter include/linux/entry-common.h:103 [inline]
 syscall_enter_from_user_mode_work include/linux/entry-common.h:140 [inline]
 do_syscall_64+0x295/0x360 arch/x86/entry/syscall_64.c:81
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810007a858 of 8 bytes by task 8087 on cpu 1:
 rb_watermark_hit+0xb9/0x270 kernel/trace/ring_buffer.c:901
 ring_buffer_poll_wait+0x1b4/0x200 kernel/trace/ring_buffer.c:1059
 trace_poll kernel/trace/trace.c:5323 [inline]
 tracing_poll_pipe+0xf7/0x120 kernel/trace/trace.c:5332
 vfs_poll include/linux/poll.h:82 [inline]
 io_file_supports_nowait io_uring/rw.c:47 [inline]
 __io_read+0x305/0xbd0 io_uring/rw.c:943
 io_read+0x4a/0x1b0 io_uring/rw.c:1036
 __io_issue_sqe+0xfd/0x2e0 io_uring/io_uring.c:1395
 io_issue_sqe+0x1e7/0xb80 io_uring/io_uring.c:1418
 io_queue_sqe io_uring/io_uring.c:1649 [inline]
 io_req_task_submit+0x46/0xa0 io_uring/io_uring.c:1058
 tctx_task_work_run+0x3a9/0x500 io_uring/tw.c:96
 tctx_task_work+0x3f/0x60 io_uring/tw.c:133
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 get_signal+0xdc1/0xf10 kernel/signal.c:2818
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x15d/0x8c0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
 do_syscall_64+0x212/0x360 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0xffff88811b770cc0 -> 0xffff88811b8b4500

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8087 Comm: syz.2.1421 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/19 04:31 upstream bd5f485f3f02 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in rb_move_tail / rb_watermark_hit
* Struck through repros no longer work on HEAD.