KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow (2)

Status: moderation: reported on 2026/08/05 15:35
Subsystems: kernel
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+50826c1b3fc76e7cc9e9@syzkaller.appspotmail.com
First crash: 4d00h, last: 4d00h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
183b6c32 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ❌ KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow (2) 2026/08/08 23:40 2026/08/08 23:40 2026/08/09 00:23 5d63f80b
a646752c assessment-kcsan Benign: ✅ KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow (2) 2026/08/08 23:27 2026/08/08 23:27 2026/08/08 23:59 5d63f80b
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow race:benign prio:low kernel 6 1 69d 69d 0/29 auto-obsoleted due to no activity on 2026/07/26 16:59

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow

write to 0xffffffff893d74c8 of 304 bytes by interrupt on cpu 1:
 timekeeping_update_from_shadow+0x40d/0x440 kernel/time/timekeeping.c:835
 __timekeeping_advance+0xa68/0xc10 kernel/time/timekeeping.c:2614
 timekeeping_advance kernel/time/timekeeping.c:2622 [inline]
 update_wall_time+0x21/0x50 kernel/time/timekeeping.c:2632
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2096
 hrtimer_interrupt+0x257/0x810 kernel/time/hrtimer.c:2215
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 is_atomic kernel/kcsan/core.c:260 [inline]
 should_watch kernel/kcsan/core.c:277 [inline]
 check_access kernel/kcsan/core.c:752 [inline]
 __tsan_memcpy+0x162/0x3c0 kernel/kcsan/core.c:1364
 avc_has_perm_noaudit+0x86/0x120 security/selinux/avc.c:1164
 selinux_inode_permission+0x4bc/0x740 security/selinux/hooks.c:3280
 security_inode_permission+0x69/0xa0 security/security.c:1842
 inode_permission+0x1da/0x3b0 fs/namei.c:661
 may_open+0x255/0x350 fs/namei.c:4274
 do_open fs/namei.c:4698 [inline]
 path_openat+0x1a43/0x2000 fs/namei.c:4863
 do_file_open+0x16c/0x290 fs/namei.c:4892
 do_sys_openat2+0xa0/0x130 fs/open.c:1368
 do_sys_open fs/open.c:1374 [inline]
 __do_sys_openat fs/open.c:1390 [inline]
 __se_sys_openat fs/open.c:1385 [inline]
 __x64_sys_openat+0xf2/0x120 fs/open.c:1385
 x64_sys_call+0x1e39/0x3020 arch/x86/include/generated/asm/syscalls_64.h:258
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893d7538 of 4 bytes by task 10852 on cpu 0:
 tk_xtime_coarse kernel/time/timekeeping.c:217 [inline]
 ktime_get_coarse_real_ts64+0x6b/0xf0 kernel/time/timekeeping.c:2665
 audit_get_stamp kernel/audit.c:1893 [inline]
 audit_log_start+0x5b7/0x730 kernel/audit.c:1971
 common_lsm_audit+0x65/0x230 security/lsm_audit.c:442
 slow_avc_audit+0x14c/0x190 security/selinux/avc.c:779
 audit_inode_permission+0x119/0x160 security/selinux/hooks.c:3149
 selinux_inode_permission+0x66e/0x740 security/selinux/hooks.c:3291
 security_inode_permission+0x69/0xa0 security/security.c:1842
 inode_permission+0x1da/0x3b0 fs/namei.c:661
 may_delete_dentry+0x1b7/0x4b0 fs/namei.c:3697
 vfs_unlink+0x43/0x490 fs/namei.c:5493
 filename_unlinkat+0x1dc/0x410 fs/namei.c:5585
 __do_sys_unlink fs/namei.c:5620 [inline]
 __se_sys_unlink+0x2b/0xe0 fs/namei.c:5617
 __x64_sys_unlink+0x1f/0x30 fs/namei.c:5617
 x64_sys_call+0x2eb6/0x3020 arch/x86/include/generated/asm/syscalls_64.h:88
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x1df61536 -> 0x1e82e030

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10852 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================
audit: audit_backlog=65 > audit_backlog_limit=64
audit: audit_lost=34913 audit_rate_limit=0 audit_backlog_limit=64
audit: backlog limit exceeded

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/05 15:34 upstream c21bb4193868 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64 / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.