syzbot


KCSAN: data-race in hrtimer_start_range_ns / print_cpu

Status: moderation: reported on 2026/05/11 21:43
Subsystems: kernel
Labels: race:benign prio:low
[Documentation on labels]
Reported-by: syzbot+bd7e9288990a753cffff@syzkaller.appspotmail.com
First crash: 34d, last: 2d21h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
85f75bf3-5d42-45cc-b3fb-d8da417ed344 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in hrtimer_start_range_ns / print_cpu 2026/05/30 02:25 2026/05/30 02:25 2026/05/30 02:29 6b4a844333e83556da95d61d7f207e7ef5cd4bc6
52de4020-3b4e-4a1a-9012-7ea57b24b6f1 assessment-kcsan Benign: ✅ KCSAN: data-race in hrtimer_start_range_ns / print_cpu 2026/05/11 23:02 2026/05/11 23:46 2026/05/11 23:47 d168f2605715ec7b7ab6840d636f69c758e424d9

Sample crash report:
==================================================================
BUG: KCSAN: data-race in hrtimer_start_range_ns / print_cpu

write to 0xffff888237d1b8e8 of 8 bytes by task 3880 on cpu 1:
 __hrtimer_reprogram kernel/time/hrtimer.c:713 [inline]
 hrtimer_reprogram kernel/time/hrtimer.c:899 [inline]
 hrtimer_start_range_ns+0xc73/0x10c0 kernel/time/hrtimer.c:1492
 hrtimer_start_expires include/linux/hrtimer.h:234 [inline]
 hrtimer_sleeper_start_expires kernel/time/hrtimer.c:2216 [inline]
 do_nanosleep+0x70/0x320 kernel/time/hrtimer.c:2290
 hrtimer_nanosleep+0xf2/0x290 kernel/time/hrtimer.c:2339
 common_nsleep+0x62/0x80 kernel/time/posix-timers.c:1345
 __do_sys_clock_nanosleep kernel/time/posix-timers.c:1391 [inline]
 __se_sys_clock_nanosleep+0x223/0x260 kernel/time/posix-timers.c:1368
 __x64_sys_clock_nanosleep+0x55/0x70 kernel/time/posix-timers.c:1368
 x64_sys_call+0x146e/0x3020 arch/x86/include/generated/asm/syscalls_64.h:231
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237d1b8e8 of 8 bytes by task 3902 on cpu 0:
 print_cpu+0x2fb/0x670 kernel/time/timer_list.c:129
 timer_list_show+0x107/0x170 kernel/time/timer_list.c:291
 seq_read_iter+0x2d9/0x8f0 fs/seq_file.c:231
 proc_reg_read_iter+0x110/0x180 fs/proc/inode.c:299
 copy_splice_read+0x47a/0x6b0 fs/splice.c:362
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x261/0x680 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x37d/0x640 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1433 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1419
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000119553b7b5 -> 0x00000011954f7ef2

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 3902 Comm: syz.4.91 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/12 19:59 upstream 1dadb7e7eb5a 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_start_range_ns / print_cpu
2026/05/11 21:43 upstream 5d6919055dec d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in hrtimer_start_range_ns / print_cpu
* Struck through repros no longer work on HEAD.