syzbot


KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow

Status: moderation: reported on 2026/04/21 11:15
Subsystems: kernel
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+a1d9ae81eab6ce5f53dd@syzkaller.appspotmail.com
First crash: 48d, last: 15d
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision Error
df786149-6baf-4d5b-881b-445ec8d024d3 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow 2026/05/31 13:16 2026/05/31 13:16 2026/05/31 14:06 6b4a844333e83556da95d61d7f207e7ef5cd4bc6
2d180e8b-e5dc-4d18-8a1f-ea3e566f6622 assessment-security 💥 KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow 2026/05/14 16:54 2026/05/14 16:54 2026/05/14 16:54 6ccb967e465e832a7bfd7a116ad00d52a0923a5d failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 128 From /app/workdir/repo/linux * branch HEAD -> FETCH_HEAD Updating files: 16% (14997/93697) Updating files: 17% (15929/93697) Updating files: 18% (16866/93697) Updating files: 19% (17803/93697) Updating files: 20% (18740/93697) Updating files: 21% (19677/93697) Updating files: 22% (20614/93697) Updating files: 23% (21551/93697) Updating files: 24% (22488/93697) Updating files: 25% (23425/93697) Updating files: 26% (24362/93697) error: unable to write file arch/powerpc/platforms/44x/Kconfig error: unable to write file arch/powerpc/platforms/44x/Makefile error: unable to write file arch/powerpc/platforms/44x/canyonlands.c error: unable to write file arch/powerpc/platforms/44x/cpm.c error: unable to write file arch/powerpc/platforms/44x/ebony.c error: unable to write file arch/powerpc/platforms/44x/fsp2.c error: unable to write file arch/powerpc/platforms/44x/fsp2.h error: unable to write file arch/powerpc/platforms/44x/gpio.c error: unable to write file arch/powerpc/platforms/44x/hsta_msi.c error: unable to write file arch/powerpc/platforms/44x/idle.c error: unable to write file arch/powerpc/platforms/44x/iss4xx.c error: unable to write file arch/powerpc/platforms/44x/machine_check.c error: unable to write file arch/powerpc/platforms/44x/misc_44x.S error: unable to write file arch/powerpc/platforms/44x/pci.c error: unable to write file arch/powerpc/platforms/44x/pci.h error: unable to write file arch/powerpc/platforms/44x/ppc44x_simple.c error: unable to write file arch/powerpc/platforms/44x/ppc476.c error: unable to write file arch/powerpc/platforms/44x/ppc476_modules.lds error: unable to write file arch/powerpc/platforms/44x/sam440ep.c error: unable to write file arch/powerpc/platforms/44x/soc.c error: unable to write file arch/powerpc/platforms/44x/uic.c error: unable to write file arch/powerpc/platforms/44x/warp.c fatal: cannot create directory at 'arch/powerpc/platforms/512x': No space left on device
57d5c7f4-61f8-48bd-83ff-7047f425d85c assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow 2026/04/21 11:15 2026/04/21 11:15 2026/04/21 11:33 3f2e655b2741ba770abc65f58ac94b7e897edae8

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow

write to 0xffffffff893aa488 of 304 bytes by interrupt on cpu 0:
 timekeeping_update_from_shadow+0x40d/0x440 kernel/time/timekeeping.c:829
 __timekeeping_advance+0xa5d/0xc10 kernel/time/timekeeping.c:2532
 timekeeping_advance kernel/time/timekeeping.c:2540 [inline]
 update_wall_time+0x21/0x50 kernel/time/timekeeping.c:2550
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x8d/0x3d0 kernel/time/tick-sched.c:312
 __run_hrtimer kernel/time/hrtimer.c:1930 [inline]
 __hrtimer_run_queues+0x276/0x4f0 kernel/time/hrtimer.c:1994
 hrtimer_interrupt+0x261/0x850 kernel/time/hrtimer.c:2113
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1067
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1061
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
 check_access kernel/kcsan/core.c:753 [inline]
 __tsan_memset+0x1d9/0x1f0 kernel/kcsan/core.c:1335
 cred_has_capability+0x40/0x2a0 security/selinux/hooks.c:1644
 selinux_capable+0x31/0x40 security/selinux/hooks.c:2189
 security_capable+0x7b/0x90 security/security.c:660
 ns_capable_common kernel/capability.c:342 [inline]
 ns_capable+0x4c/0xb0 kernel/capability.c:363
 __netlink_ns_capable net/netlink/af_netlink.c:852 [inline]
 netlink_ns_capable net/netlink/af_netlink.c:869 [inline]
 netlink_net_capable+0xaa/0xc0 net/netlink/af_netlink.c:900
 rtnetlink_rcv_msg+0x14c/0x720 net/core/rtnetlink.c:6924
 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550
 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7024
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 __sys_sendto+0x42e/0x490 net/socket.c:2265
 __do_sys_sendto net/socket.c:2272 [inline]
 __se_sys_sendto net/socket.c:2268 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2268
 x64_sys_call+0x2d35/0x3020 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff893aa4f8 of 4 bytes by task 12748 on cpu 1:
 tk_xtime_coarse kernel/time/timekeeping.c:212 [inline]
 ktime_get_coarse_real_ts64_mg+0x89/0x1a0 kernel/time/timekeeping.c:2606
 current_time+0x41/0x240 fs/inode.c:2376
 need_cmtime_update fs/inode.c:2398 [inline]
 file_update_time_flags+0x83/0x2e0 fs/inode.c:2419
 file_update_time+0x17/0x20 fs/inode.c:2449
 shmem_file_write_iter+0x9c/0xf0 mm/shmem.c:3475
 iter_file_splice_write+0x6c4/0xa80 fs/splice.c:736
 do_splice_from fs/splice.c:936 [inline]
 direct_splice_actor+0x156/0x2a0 fs/splice.c:1159
 splice_direct_to_actor+0x311/0x670 fs/splice.c:1103
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x382/0x650 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1433 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1419
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x2f5594d9 -> 0x2fee2b59

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12748 Comm: syz.7.2273 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/24 11:52 upstream 4cbfe4502e3d c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow
2026/05/22 06:50 upstream 6779b50faa56 70ae9b03 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow
2026/05/13 01:42 upstream c21b90f77687 a0949470 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow
2026/04/29 01:04 upstream dca922e019dd 95008c03 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow
2026/04/21 11:15 upstream b4e07588e743 3f2e655b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_coarse_real_ts64_mg / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.