syzbot

==================================================================
BUG: KCSAN: data-race in __anon_vma_prepare / handle_mm_fault

write to 0xffff8881043ed640 of 8 bytes by task 337 on cpu 1:
 __anon_vma_prepare+0x172/0x2f0 mm/rmap.c:213
 __vmf_anon_prepare mm/memory.c:3432 [inline]
 vmf_anon_prepare mm/internal.h:410 [inline]
 do_anonymous_page mm/memory.c:4996 [inline]
 do_pte_missing mm/memory.c:4158 [inline]
 handle_pte_fault mm/memory.c:5997 [inline]
 __handle_mm_fault mm/memory.c:6140 [inline]
 handle_mm_fault+0x1e68/0x2ae0 mm/memory.c:6309
 do_user_addr_fault+0x3fe/0x1090 arch/x86/mm/fault.c:1388
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 rep_movs_alternative+0x11/0x90 arch/x86/lib/copy_user_64.S:46
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
 _inline_copy_to_user include/linux/uaccess.h:197 [inline]
 _copy_to_user+0x7c/0xa0 lib/usercopy.c:26
 copy_to_user include/linux/uaccess.h:225 [inline]
 do_timer_create+0x667/0x950 kernel/time/posix-timers.c:541
 __do_sys_timer_create kernel/time/posix-timers.c:-1 [inline]
 __se_sys_timer_create kernel/time/posix-timers.c:582 [inline]
 __x64_sys_timer_create+0xb9/0xe0 kernel/time/posix-timers.c:582
 x64_sys_call+0x1ab0/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:223
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881043ed640 of 8 bytes by task 335 on cpu 0:
 __vmf_anon_prepare mm/memory.c:3426 [inline]
 vmf_anon_prepare mm/internal.h:410 [inline]
 do_anonymous_page mm/memory.c:4996 [inline]
 do_pte_missing mm/memory.c:4158 [inline]
 handle_pte_fault mm/memory.c:5997 [inline]
 __handle_mm_fault mm/memory.c:6140 [inline]
 handle_mm_fault+0x1022/0x2ae0 mm/memory.c:6309
 do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1337
 handle_page_fault arch/x86/mm/fault.c:1480 [inline]
 exc_page_fault+0x54/0xc0 arch/x86/mm/fault.c:1538
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x0000000000000000 -> 0xffff88810658ad68

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 335 Comm: syz.6.10013 Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================