Kernel Concurrency Sanitizer (KCSAN) is a sampling watchpoint-based data race detector for the Linux kernel. More details can be found in Documentation.

There is one main branch related to KCSAN:

• kcsan: This version is the current development branch, that is also deployed on syzbot (as long as KCSAN is not yet upstream).

The latest stable version of KCSAN can be found in the rcu tree, or also linux-next.

We have a public Syzkaller instance. Reports will appear on the dashboard after internal review, to keep the volume of bugs manageable (which gives us a chance to carefully react to KCSAN reports while best practices are still evolving).

This is a list of known upstream fixes due to data races found by KCSAN. Last updated: Feb 21, 2020.

• mm: annotate a data race in page_zonenum()
• mm/mempool: fix a data race in mempool_free()
• ext4: fix a data race in EXT4_I(inode)->i_disksize
• rcutorture: Annotation lockless accesses to rcu_torture_current
• rcutorture: Add READ_ONCE() to rcu_torture_count and rcu_torture_batch
• rcutorture: Fix stray access to rcu_fwd_cb_nodelay
• rcutorture: Fix rcu_torture_one_read()/rcu_torture_writer() data race
• srcu: Add READ_ONCE() to srcu_struct ->srcu_gp_seq load
• srcu: Fix process_srcu()/srcu_batches_completed() datarace
• srcu: Fix __call_srcu()/srcu_get_delay() datarace
• srcu: Fix __call_srcu()/process_srcu() datarace
• rcu-tasks: *_ONCE() for rcu_tasks_cbs_head
• rcu: Add WRITE_ONCE() to rcu_state ->gp_start
• rcu: Add *_ONCE() to rcu_node ->boost_kthread_status
• rcu: Add *_ONCE() to rcu_data ->rcu_forced_tick
• rcu: Add READ_ONCE() to rcu_data ->gpwrap
• rcu: *_ONCE() for grace-period progress indicators
• rcu: Add READ_ONCE() to rcu_segcblist ->tails
• rcu: Add WRITE_ONCE() to rcu_node ->qsmaskinitnext
• locking/rtmutex: rcu: Add WRITE_ONCE() to rt_mutex ->owner
• rcu: Add WRITE_ONCE() to rcu_state ->gp_req_activity
• rcu: Add READ_ONCE() to rcu_node ->gp_seq
• rcu: Add WRITE_ONCE to rcu_node ->exp_seq_rq store
• rcu: Add WRITE_ONCE() to rcu_node ->qsmask update
• rcu: Fix exp_funnel_lock()/rcu_exp_wait_wake() datarace
• skbuff: fix a data race in skb_queue_len()
• debugobjects: Fix various data races
• tick/sched: Annotate lockless access to last_jiffies_update
• rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
• rcu: Avoid data-race in rcu_gp_fqs_check_wake()
• tomoyo: Use atomic_t for statistics counter
• locking/spinlock/debug: Fix various data races
• vfs: mark pipes and sockets as stream-like file descriptors
• sctp: cache netns in sctp_ep_common
• tun: fix data-race in gro_normal_list()
• tcp: fix data-race in tcp_recvmsg()
• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state
• ipv6: fixes rt6_probe() and fib6_nh->last_probe init | lkml
• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end
• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() | report
• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)
• rcu: Fix data-race due to atomic_t copy-by-value | lkml
• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour
• taskstats: fix data-race | report