Kernel Concurrency Sanitizer (KCSAN) is a sampling watchpoint-based data race detector. More details can be found in Documentation.

There is one main branch related to KCSAN:

• kcsan: Contains KCSAN only, rebased on top of stable upstream kernel (as long as KCSAN is not yet upstream).

Some tags of interest:

• kcsan_v5.3-with-fixes: Contains initial KCSAN release with various bug-fixes for races detected -- not exhaustive, only for bugs reported very frequently in order to suppress them in initial testing; the commit messages for those bugfixes include the KCSAN report as-is.

Initially (Sep 2019) we have been running KCSAN via Syzkaller for several weeks, and have found numerous bugs (running for just 2 days found over 300 unique data races).

We now have a public Syzkaller instance. Bugs will slowly appear on the dashboard, currently after moderation only, to keep the volume of reported bugs manageable.

KCSAN detects data races according to the LKMM. Although some data races are due to logic bugs, or missed synchronization elsewhere, we expect a large number of data races to be due to concurrent plain accesses.

We want to point out that racing accesses that are not considered logic bugs ("benign"), are still data-races while not marked atomic (READ_ONCE, WRITE_ONCE, atomic_t, etc.) and behaviour may still be undefined -- this LWN article provides good background why such data races are problems, with some more info on our wiki page.

To rebase KCSAN against latest upstream tree:

• git rebase <upstream> kcsan
• Then force-push kcsan.

Rebasing KCSAN with fixes on top can be done as follows:

• git rebase -i --onto kcsan $(git log --format=oneline <my-branch-with-fixes> | grep -v 'BUG: KCSAN' | head -n 1 | cut -d " " -f 1) <my-branch-with-fixes>

This is a list of known upstream fixes due to data races found by KCSAN. Last updated: Nov 07, 2019.

v5.3:

• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state
• ipv6: fixes rt6_probe() and fib6_nh->last_probe init
• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end
• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() | report
• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)
• rcu: Fix data-race due to atomic_t copy-by-value
• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour
• taskstats: fix data-race | report