Kernel Concurrency Sanitizer (KCSAN) is a sampling watchpoint-based data race detector for the Linux kernel. More details can be found in Documentation.

There is one main branch related to KCSAN:

• kcsan: Contains KCSAN only, rebased on top of stable upstream kernel (as long as KCSAN is not yet upstream).

Initially (Sep 2019) we have been running KCSAN via Syzkaller for several weeks, and have found numerous bugs (running for just 2 days found over 300 unique data races).

We now have a public Syzkaller instance. Bugs will slowly appear on the dashboard, currently after moderation only, to keep the volume of reported bugs manageable.

KCSAN detects data races according to the LKMM. Although some data races are due to logic bugs, or missed synchronization elsewhere, we expect a large number of data races to be due to concurrent plain accesses.

We want to point out that racing accesses that are not considered logic bugs ("benign"), are still data-races while not marked atomic (READ_ONCE, WRITE_ONCE, atomic_t, etc.) and behaviour may still be undefined -- this LWN article provides good background why such data races are problems, with some more info on our wiki page.

This is a list of known upstream fixes due to data races found by KCSAN. Last updated: Nov 08, 2019.

v5.3:

• tcp: fix data-race in tcp_recvmsg()
• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state
• ipv6: fixes rt6_probe() and fib6_nh->last_probe init
• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end
• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() | report
• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)
• rcu: Fix data-race due to atomic_t copy-by-value
• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour
• taskstats: fix data-race | report