KCSAN: data-race in ktime_get / timekeeping_update_from_shadow

Status: moderation: reported on 2026/03/05 06:20
Subsystems: kernel
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+e0fb27f89217ad8c3486@syzkaller.appspotmail.com
First crash: 195d, last: 1d21h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
731f8d51 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ✅ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ✅ VMHostTrigger: ✅ KCSAN: data-race in ktime_get / timekeeping_update_from_shadow 2026/05/19 22:56 2026/05/19 22:56 2026/05/19 23:29 1d9407ad
92b8d583 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in ktime_get / timekeeping_update_from_shadow 2026/03/05 06:19 2026/03/05 06:19 2026/03/05 06:22 305c0ec5

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get / timekeeping_update_from_shadow

write to 0xffffffff895f4508 of 320 bytes by interrupt on cpu 1:
 timekeeping_update_from_shadow+0x448/0x480 kernel/time/timekeeping.c:866
 __timekeeping_advance+0xb36/0xcf0 kernel/time/timekeeping.c:2663
 timekeeping_advance kernel/time/timekeeping.c:2671 [inline]
 update_wall_time+0x21/0x50 kernel/time/timekeeping.c:2681
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_interrupt+0x27b/0x860 kernel/time/hrtimer.c:2250
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 blk_complete_reqs block/blk-mq.c:1222 [inline]
 blk_done_softirq+0x77/0xb0 block/blk-mq.c:1227
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x44/0xe0 kernel/softirq.c:758
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 preempt_schedule_irq+0x27/0x50 kernel/sched/core.c:7599
 raw_irqentry_exit_cond_resched+0x49/0x60 kernel/entry/common.c:145
 irqentry_exit_to_kernel_mode_preempt+0x2b/0x40 include/linux/irq-entry-common.h:468
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x7d/0x610 kernel/entry/common.c:167
 sysvec_apic_timer_interrupt+0x44/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 syscall_enter_from_user_mode_work include/linux/entry-common.h:142 [inline]
 do_syscall_64+0x88/0x360 arch/x86/entry/syscall_64.c:81
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff895f4528 of 8 bytes by task 13549 on cpu 0:
 timekeeping_cycles_to_ns kernel/time/timekeeping.c:477 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:482 [inline]
 ktime_get+0x130/0x240 kernel/time/timekeeping.c:1004
 ktime_get_ns include/linux/timekeeping.h:174 [inline]
 blk_time_get_ns block/blk.h:734 [inline]
 blk_account_io_start+0x376/0x450 block/blk-mq.c:1100
 blk_mq_bio_to_request block/blk-mq.c:2676 [inline]
 blk_mq_submit_bio+0xba2/0x1120 block/blk-mq.c:3182
 __submit_bio+0x54/0x3d0 block/blk-core.c:673
 __submit_bio_noacct_mq block/blk-core.c:756 [inline]
 submit_bio_noacct_nocheck+0x153/0x620 block/blk-core.c:790
 submit_bio_noacct+0x760/0x980 block/blk-core.c:925
 submit_bio+0x2a4/0x2c0 block/blk-core.c:966
 bio_chain_and_submit+0x84/0xb0 block/bio.c:376
 __blkdev_issue_zero_pages+0x1f7/0x240 block/blk-lib.c:215
 blkdev_issue_zero_pages block/blk-lib.c:231 [inline]
 blkdev_issue_zeroout+0x3a1/0x4f0 block/blk-lib.c:312
 blk_ioctl_zeroout block/ioctl.c:244 [inline]
 blkdev_common_ioctl+0x1a07/0x2060 block/ioctl.c:667
 blkdev_ioctl+0x31f/0x460 block/ioctl.c:792
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x239d/0x2550 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000976f1b6f9ae42 -> 0x000a0f8837291208

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 13549 Comm: syz.7.2621 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (35):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/14 14:39 upstream 704340f1cd0d 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/09/12 21:45 upstream 5225b8eec4c9 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/09/11 16:18 upstream 08df884136f1 b6a5eeb7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/09/05 21:20 upstream 0d9ff90a5422 4f7b22a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/30 03:40 upstream 08dbfad3f504 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/23 18:10 upstream 2709dd5ae32f 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/18 02:55 upstream ff68e5f557f6 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/12 23:53 upstream 3d6d817622b0 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/10 20:06 upstream d58772d8520c 508909ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/03 06:34 upstream bd1dde877520 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/08/02 06:11 upstream 2d2338c93da7 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/07/27 15:45 upstream f5098b6bae76 aae9036b .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/07/15 15:33 upstream 58717b2a1365 a4ed0f4f .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/07/11 13:15 upstream 61c03dfde854 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/29 23:40 upstream dc59e4fea9d8 6a0c72dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/24 10:27 upstream 558ef39aeb9a 042555ff .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/22 21:27 upstream 1dc18801be29 5a630be6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/18 09:58 upstream e771677c937d a776b0d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/17 16:03 upstream 66affa37cfac b62b3ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/13 19:41 upstream 062871f1371b 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/06/13 02:37 upstream 1dadb7e7eb5a 1d2f3589 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/26 19:18 upstream d60ec36cab33 a3e47276 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/23 09:56 upstream 79bd2dded182 c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/17 23:25 upstream e5d505e3664b de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/15 14:58 upstream 70eda68668d1 9cd3beaa .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/11 22:36 upstream 5d6919055dec d168f260 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/07 22:55 upstream 8ab992f815d6 cbf9e0fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/05/02 10:35 upstream f1a5e78a55eb a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/04/27 14:42 upstream 254f49634ee1 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/04/18 09:54 upstream 8541d8f725c6 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/04/15 05:09 upstream 508fed679541 e2e976a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/03/25 13:49 upstream bbeb83d3182a 8ee77f7d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/03/20 12:25 upstream 8a30aeb0d1b4 2f245add .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/03/08 01:28 upstream 4ae12d8bd9a8 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
2026/03/05 06:19 upstream ecc64d2dc9ff a9fe5c9e .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.