syzbot


KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow (3)

Status: moderation: reported on 2025/11/04 20:48
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+442fd7e52f9be4e429ae@syzkaller.appspotmail.com
First crash: 51d, last: 4d02h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow (2) kernel 6 2 155d 173d 0/29 auto-obsoleted due to no activity on 2025/09/18 01:57
upstream KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow kernel 6 1 238d 238d 0/29 auto-obsoleted due to no activity on 2025/06/27 01:56

Sample crash report:
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
==================================================================
BUG: KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow

write to 0xffffffff88edc0c8 of 280 bytes by interrupt on cpu 1:
 timekeeping_update_from_shadow+0x2b4/0x2f0 kernel/time/timekeeping.c:753
 __timekeeping_advance+0xa3d/0xbc0 kernel/time/timekeeping.c:2377
 timekeeping_advance kernel/time/timekeeping.c:2385 [inline]
 update_wall_time+0x24/0x90 kernel/time/timekeeping.c:2395
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x8d/0x3d0 kernel/time/tick-sched.c:312
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x20f/0x5a0 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1d0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 kcsan_setup_watchpoint+0x406/0x420 kernel/kcsan/core.c:705
 strcmp+0x16/0x50 lib/string.c:283
 kernfs_name_compare fs/kernfs/dir.c:343 [inline]
 kernfs_find_ns+0x11c/0x1c0 fs/kernfs/dir.c:877
 kernfs_remove_by_name_ns+0x6a/0xf0 fs/kernfs/dir.c:1717
 kernfs_remove_by_name include/linux/kernfs.h:633 [inline]
 remove_files fs/sysfs/group.c:28 [inline]
 sysfs_remove_group+0xa5/0x170 fs/sysfs/group.c:328
 sysfs_remove_groups+0x3a/0x80 fs/sysfs/group.c:352
 __kobject_del+0x4b/0x190 lib/kobject.c:595
 kobject_del+0x2e/0x50 lib/kobject.c:627
 ext4_unregister_sysfs+0x75/0x80 fs/ext4/sysfs.c:611
 ext4_put_super+0x4c/0x7d0 fs/ext4/super.c:1292
 generic_shutdown_super+0xe6/0x210 fs/super.c:643
 kill_block_super+0x2a/0x70 fs/super.c:1722
 ext4_kill_sb+0x42/0x80 fs/ext4/super.c:7444
 deactivate_locked_super+0x75/0x1c0 fs/super.c:474
 deactivate_super+0x97/0xa0 fs/super.c:507
 cleanup_mnt+0x2a9/0x320 fs/namespace.c:1318
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1325
 task_work_run+0x131/0x1a0 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0x1fe/0x740 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x1e1/0x2b0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff88edc100 of 8 bytes by task 9733 on cpu 0:
 ktime_get_real_seconds+0x15/0x30 kernel/time/timekeeping.c:1013
 save_error_info fs/ext4/super.c:657 [inline]
 ext4_handle_error+0x2ce/0x550 fs/ext4/super.c:704
 __ext4_std_error+0x1a5/0x370 fs/ext4/super.c:970
 ext4_reserve_inode_write+0x202/0x250 fs/ext4/inode.c:6298
 __ext4_mark_inode_dirty+0x8c/0x3f0 fs/ext4/inode.c:6465
 __ext4_ext_dirty+0xdb/0x1f0 fs/ext4/extents.c:206
 ext4_split_extent_at+0x48c/0x990 fs/ext4/extents.c:3230
 ext4_split_extent+0x1af/0x3b0 fs/ext4/extents.c:3406
 ext4_split_convert_extents fs/ext4/extents.c:3743 [inline]
 ext4_ext_handle_unwritten_extents fs/ext4/extents.c:3915 [inline]
 ext4_ext_map_blocks+0xb58/0x38a0 fs/ext4/extents.c:4274
 ext4_map_create_blocks fs/ext4/inode.c:613 [inline]
 ext4_map_blocks+0x626/0xd20 fs/ext4/inode.c:816
 mpage_map_one_extent fs/ext4/inode.c:2380 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2474 [inline]
 ext4_do_writepages+0x15ef/0x27e0 fs/ext4/inode.c:2932
 ext4_writepages+0x179/0x300 fs/ext4/inode.c:3026
 do_writepages+0x1c6/0x310 mm/page-writeback.c:2598
 __writeback_single_inode+0x80/0x7c0 fs/fs-writeback.c:1737
 writeback_sb_inodes+0x4b0/0xb20 fs/fs-writeback.c:2030
 wb_writeback+0x252/0x5c0 fs/fs-writeback.c:2216
 wb_do_writeback fs/fs-writeback.c:2363 [inline]
 wb_workfn+0x194/0x910 fs/fs-writeback.c:2403
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x0000000069490751 -> 0x0000000069490752

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 9733 Comm: kworker/u8:23 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: writeback wb_workfn (flush-7:7)
==================================================================
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
EXT4-fs error: 77246 callbacks suppressed
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs: 86574 callbacks suppressed
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
kworker/u8:23: attempt to access beyond end of device
loop7: rw=8534017, sector=2, nr_sectors = 2 limit=2
kworker/u8:23: attempt to access beyond end of device
loop7: rw=8534017, sector=2, nr_sectors = 2 limit=2
kworker/u8:23: attempt to access beyond end of device
loop7: rw=8534017, sector=2, nr_sectors = 2 limit=2
kworker/u8:23: attempt to access beyond end of device
loop7: rw=8534017, sector=2, nr_sectors = 2 limit=2
kworker/u8:23: attempt to access beyond end of device
loop7: rw=8534017, sector=2, nr_sectors = 2 limit=2
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
Buffer I/O error on dev loop7, logical block 1, lost sync page write
EXT4-fs error: 107206 callbacks suppressed
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs error (device loop7) in ext4_reserve_inode_write:6298: Out of memory
EXT4-fs error (device loop7): __ext4_ext_dirty:206: inode #18: comm kworker/u8:23: mark_inode_dirty error
EXT4-fs: 107080 callbacks suppressed
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock
EXT4-fs (loop7): I/O error while writing superblock

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/22 08:49 upstream 765b233a9b94 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow
2025/11/04 20:48 upstream c9cfc122f037 686bf657 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.