syzbot


KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

Status: moderation: reported on 2026/04/24 03:11
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+20790177528defde1ce2@syzkaller.appspotmail.com
First crash: 15h18m, last: 15h12m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
897f09ae-06f3-4bab-bf66-e2077a40f5d0 assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu 2026/04/24 03:10 2026/04/24 03:10 2026/04/24 03:29 629ff21a2358bd38f4dbede12a995fb52356ed72

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

write to 0xffff888237d1b8e8 of 8 bytes by task 20065 on cpu 1:
 hrtimer_rearm kernel/time/hrtimer.c:2028 [inline]
 __hrtimer_rearm_deferred+0x537/0x670 kernel/time/hrtimer.c:2059
 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:53 [inline]
 hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:62 [inline]
 irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:513 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:550 [inline]
 irqentry_exit+0x527/0x5b0 kernel/entry/common.c:164
 sysvec_apic_timer_interrupt+0x44/0x80 arch/x86/kernel/apic/apic.c:1061
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 get_current arch/x86/include/asm/current.h:25 [inline]
 get_ctx kernel/kcsan/core.c:206 [inline]
 check_access kernel/kcsan/core.c:750 [inline]
 __tsan_read8+0xdf/0x190 kernel/kcsan/core.c:1025
 mod_memcg_lruvec_state mm/memcontrol.c:939 [inline]
 account_slab_nmi_safe mm/memcontrol.c:2805 [inline]
 mod_objcg_mlstate mm/memcontrol.c:2817 [inline]
 drain_obj_stock+0x3bf/0x620 mm/memcontrol.c:3277
 __refill_obj_stock+0x37/0x2e0 mm/memcontrol.c:3322
 __memcg_slab_post_alloc_hook+0x5b8/0x7d0 mm/memcontrol.c:3490
 memcg_slab_post_alloc_hook mm/slub.c:2461 [inline]
 slab_post_alloc_hook mm/slub.c:4580 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 kmem_cache_alloc_lru_noprof+0x1eb/0x400 mm/slub.c:4917
 sock_alloc_inode+0x36/0xf0 net/socket.c:328
 alloc_inode+0x40/0x170 fs/inode.c:345
 new_inode_pseudo include/linux/fs.h:3015 [inline]
 sock_alloc net/socket.c:697 [inline]
 __sock_create+0x120/0x580 net/socket.c:1628
 sock_create_kern+0x38/0x50 net/socket.c:1740
 inet_ctl_sock_create+0x58/0x130 net/ipv4/af_inet.c:1641
 igmp6_net_init+0xfc/0x260 net/ipv6/mcast.c:3183
 ops_init+0x22a/0x2e0 net/core/net_namespace.c:137
 setup_net+0x9f/0x230 net/core/net_namespace.c:446
 copy_net_ns+0x310/0x450 net/core/net_namespace.c:579
 create_new_namespaces+0x20e/0x440 kernel/nsproxy.c:132
 copy_namespaces+0x1ad/0x210 kernel/nsproxy.c:195
 copy_process+0x10ae/0x23a0 kernel/fork.c:2265
 kernel_clone+0x1a5/0x5e0 kernel/fork.c:2723
 __do_sys_clone kernel/fork.c:2864 [inline]
 __se_sys_clone kernel/fork.c:2848 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2848
 x64_sys_call+0x1222/0x3020 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237d1b8e8 of 8 bytes by task 20079 on cpu 0:
 print_cpu+0x2fb/0x670 kernel/time/timer_list.c:129
 timer_list_show+0x107/0x170 kernel/time/timer_list.c:291
 seq_read_iter+0x636/0x940 fs/seq_file.c:273
 proc_reg_read_iter+0x110/0x180 fs/proc/inode.c:299
 copy_splice_read+0x471/0x6c0 fs/splice.c:362
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x26e/0x670 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x382/0x650 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1433 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1419
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x7fffffffffffffff -> 0x00000090c8a54cc0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 20079 Comm: syz.3.5253 Tainted: G        W           syzkaller #0 PREEMPT(full) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/04/24 03:16 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/04/24 03:10 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
* Struck through repros no longer work on HEAD.