The Kernel Concurrency Sanitizer (KCSAN) is a watchpoint based dynamic race detector for the Linux kernel. More details can be found in Documentation/dev-tools/kcsan.rst.

The latest stable version of KCSAN is in mainline.

The LWN article series "Concurrency bugs should fear the big bad data-race detector" discuss KCSAN in more detail:

• https://lwn.net/Articles/816850/
• https://lwn.net/Articles/816854/

We have a public syzbot instance. Reports will appear on the dashboard after internal review, to keep the volume of bugs manageable (which gives us a chance to carefully react to KCSAN reports while best practices are still evolving).

This is a list of known upstream fixes due to data races found by KCSAN. Last updated: Aug 14, 2020.

• fat: don't allow to mount if the FAT length == 0 | lkml
• rcu: Add *_ONCE() and data_race() to rcu_node ->exp_tasks plus locking
• tcp: annotate sk->sk_rcvbuf lockless reads
• ALSA: seq: Avoid concurrent access to queue flags | syzbot
• ALSA: seq: Fix concurrent access to queue current tick/time
• mm: annotate a data race in page_zonenum()
• mm/mempool: fix a data race in mempool_free()
• ext4: fix a data race in EXT4_I(inode)->i_disksize
• rcutorture: Annotation lockless accesses to rcu_torture_current
• rcutorture: Add READ_ONCE() to rcu_torture_count and rcu_torture_batch
• rcutorture: Fix stray access to rcu_fwd_cb_nodelay
• rcutorture: Fix rcu_torture_one_read()/rcu_torture_writer() data race
• srcu: Add READ_ONCE() to srcu_struct ->srcu_gp_seq load
• srcu: Fix process_srcu()/srcu_batches_completed() datarace
• srcu: Fix __call_srcu()/srcu_get_delay() datarace
• srcu: Fix __call_srcu()/process_srcu() datarace
• rcu-tasks: *_ONCE() for rcu_tasks_cbs_head
• rcu: Add WRITE_ONCE() to rcu_state ->gp_start
• rcu: Add *_ONCE() to rcu_node ->boost_kthread_status
• rcu: Add *_ONCE() to rcu_data ->rcu_forced_tick
• rcu: Add READ_ONCE() to rcu_data ->gpwrap
• rcu: *_ONCE() for grace-period progress indicators
• rcu: Add READ_ONCE() to rcu_segcblist ->tails
• rcu: Add WRITE_ONCE() to rcu_node ->qsmaskinitnext
• locking/rtmutex: rcu: Add WRITE_ONCE() to rt_mutex ->owner
• rcu: Add WRITE_ONCE() to rcu_state ->gp_req_activity
• rcu: Add READ_ONCE() to rcu_node ->gp_seq
• rcu: Add WRITE_ONCE to rcu_node ->exp_seq_rq store
• rcu: Add WRITE_ONCE() to rcu_node ->qsmask update
• rcu: Fix exp_funnel_lock()/rcu_exp_wait_wake() datarace
• skbuff: fix a data race in skb_queue_len()
• debugobjects: Fix various data races
• tick/sched: Annotate lockless access to last_jiffies_update
• rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
• rcu: Avoid data-race in rcu_gp_fqs_check_wake()
• tomoyo: Use atomic_t for statistics counter
• locking/spinlock/debug: Fix various data races
• vfs: mark pipes and sockets as stream-like file descriptors
• sctp: cache netns in sctp_ep_common
• tun: fix data-race in gro_normal_list()
• tcp: fix data-race in tcp_recvmsg()
• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state
• ipv6: fixes rt6_probe() and fib6_nh->last_probe init | lkml
• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end
• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() | report
• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)
• rcu: Fix data-race due to atomic_t copy-by-value | lkml
• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour
• taskstats: fix data-race | report