Kernel Concurrency Sanitizer (KCSAN) is a sampling watchpoint-based data race detector for the Linux kernel. More details can be found in Documentation.

There is one main branch related to KCSAN:

• kcsan: This version is the current development branch, that is also deployed on syzbot (as long as KCSAN is not yet upstream).

The latest stable version of KCSAN can be found in the rcu tree, or also linux-next.

Initially (Sep 2019) we have been running KCSAN via Syzkaller for several weeks, and have found numerous bugs (running for just 2 days found over 300 unique data races).

We now have a public Syzkaller instance. Bugs will slowly appear on the dashboard, currently after moderation only, to keep the volume of reported bugs manageable.

KCSAN detects data races according to the LKMM. Although some data races are due to logic bugs, or missed synchronization elsewhere, we expect a large number of data races to be due to concurrent plain accesses.

We want to point out that racing accesses that are not considered logic bugs ("benign"), are still data-races while not marked atomic (READ_ONCE, WRITE_ONCE, atomic_t, etc.) and behaviour may still be undefined -- this LWN article provides good background why such data races are problems, with some more info on our wiki page.

This is a list of known upstream fixes due to data races found by KCSAN. Last updated: Feb 11, 2020.

• skbuff: fix a data race in skb_queue_len()
• debugobjects: Fix various data races
• tick/sched: Annotate lockless access to last_jiffies_update
• rcu: Use WRITE_ONCE() for assignments to ->pprev for hlist_nulls
• rcu: Avoid data-race in rcu_gp_fqs_check_wake()
• tomoyo: Use atomic_t for statistics counter
• locking/spinlock/debug: Fix various data races
• vfs: mark pipes and sockets as stream-like file descriptors
• sctp: cache netns in sctp_ep_common
• tun: fix data-race in gro_normal_list()
• tcp: fix data-race in tcp_recvmsg()
• net: introduce u64_stats_t
• inetpeer: fix data-race in inet_putpeer / inet_putpeer
• list: add hlist_unhashed_lockless()
• hrtimer: Annotate lockless access to timer->state
• ipv6: fixes rt6_probe() and fib6_nh->last_probe init | lkml
• net: silence data-races on sk_backlog.tail
• net: various KCSAN inspired fixes
• rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
• srcu: Apply *_ONCE() to ->srcu_last_gp_end
• mm: vmscan: memcontrol: remove mem_cgroup_select_victim_node() | report
• net: annotate lockless accesses to sk->sk_napi_id
• udp: fix data-race in udp_set_dev_scratch()
• net: avoid KCSAN splats
• proc: fix inode uid/gid writeback race
• netfilter: conntrack: avoid possible false sharing
• tun: remove possible false sharing in tun_flow_update()
• tcp: address KCSAN reports in tcp_poll() (part I)
• rcu: Fix data-race due to atomic_t copy-by-value | lkml
• rcu: avoid data-race in rcu_gp_fqs_check_wake()
• rcu: exp: Avoid race on lockless rcu_node::expmask loop
• stop_machine: avoid potential race behaviour
• taskstats: fix data-race | report