syzbot

==================================================================
BUG: KCSAN: data-race in igmp_gq_start_timer / igmp_gq_timer_expire

write to 0xffff88810245e669 of 1 bytes by interrupt on cpu 0:
 igmp_gq_timer_expire+0x1d/0x90 net/ipv4/igmp.c:806
 call_timer_fn+0x3b/0x2c0 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers kernel/time/timer.c:2372 [inline]
 __run_timer_base+0x415/0x610 kernel/time/timer.c:2384
 run_timer_base kernel/time/timer.c:2393 [inline]
 run_timer_softirq+0x31/0x70 kernel/time/timer.c:2403
 handle_softirqs+0xba/0x290 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:680
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 get_current kernel/rcu/tree_plugin.h:413 [inline]
 rcu_preempt_read_enter kernel/rcu/tree_plugin.h:391 [inline]
 __rcu_read_lock+0xa/0x50 kernel/rcu/tree_plugin.h:414
 rcu_read_lock include/linux/rcupdate.h:839 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
 kernfs_root fs/kernfs/kernfs-internal.h:75 [inline]
 kernfs_active fs/kernfs/dir.c:39 [inline]
 kernfs_drain+0x56/0x1f0 fs/kernfs/dir.c:496
 __kernfs_remove+0x1ad/0x2e0 fs/kernfs/dir.c:1508
 kernfs_remove_by_name_ns+0x9b/0x100 fs/kernfs/dir.c:1717
 kernfs_remove_by_name include/linux/kernfs.h:633 [inline]
 remove_files fs/sysfs/group.c:28 [inline]
 sysfs_remove_group+0xa5/0x170 fs/sysfs/group.c:322
 sysfs_remove_groups+0x3a/0x80 fs/sysfs/group.c:346
 device_remove_groups drivers/base/core.c:2843 [inline]
 device_remove_attrs+0x14c/0x190 drivers/base/core.c:2979
 device_del+0x362/0x790 drivers/base/core.c:3877
 device_unregister+0x15/0x40 drivers/base/core.c:3919
 bdi_unregister+0x307/0x3a0 mm/backing-dev.c:1170
 generic_shutdown_super+0x1ab/0x210 fs/super.c:683
 kill_anon_super+0x2a/0x130 fs/super.c:1282
 v9fs_kill_super+0x2f/0x70 fs/9p/vfs_super.c:195
 deactivate_locked_super+0x72/0x1c0 fs/super.c:474
 deactivate_super+0x97/0xa0 fs/super.c:507
 cleanup_mnt+0x269/0x2e0 fs/namespace.c:1375
 __cleanup_mnt+0x19/0x20 fs/namespace.c:1382
 task_work_run+0x131/0x1a0 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop+0xe4/0x100 kernel/entry/common.c:43
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x1d6/0x200 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88810245e669 of 1 bytes by task 28424 on cpu 1:
 igmp_gq_start_timer+0x4d/0x130 net/ipv4/igmp.c:233
 igmp_heard_query net/ipv4/igmp.c:1031 [inline]
 igmp_rcv+0x1473/0x14f0 net/ipv4/igmp.c:1103
 ip_protocol_deliver_rcu+0x423/0x780 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x1fc/0x2f0 net/ipv4/ip_input.c:239
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ip_local_deliver+0xe8/0x1c0 net/ipv4/ip_input.c:260
 dst_input include/net/dst.h:471 [inline]
 ip_sublist_rcv_finish net/ipv4/ip_input.c:585 [inline]
 ip_list_rcv_finish net/ipv4/ip_input.c:634 [inline]
 ip_sublist_rcv+0x58e/0x670 net/ipv4/ip_input.c:642
 ip_list_rcv+0x261/0x290 net/ipv4/ip_input.c:676
 __netif_receive_skb_list_ptype net/core/dev.c:6034 [inline]
 __netif_receive_skb_list_core+0x4dc/0x500 net/core/dev.c:6081
 __netif_receive_skb_list net/core/dev.c:6133 [inline]
 netif_receive_skb_list_internal+0x487/0x600 net/core/dev.c:6224
 netif_receive_skb_list+0x31/0x200 net/core/dev.c:6276
 xdp_recv_frames net/bpf/test_run.c:280 [inline]
 xdp_test_run_batch net/bpf/test_run.c:361 [inline]
 bpf_test_run_xdp_live+0xdcb/0xfe0 net/bpf/test_run.c:390
 bpf_prog_test_run_xdp+0x4f5/0x910 net/bpf/test_run.c:1322
 bpf_prog_test_run+0x22a/0x390 kernel/bpf/syscall.c:4590
 __sys_bpf+0x4b9/0x7b0 kernel/bpf/syscall.c:6047
 __do_sys_bpf kernel/bpf/syscall.c:6139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6137 [inline]
 __x64_sys_bpf+0x41/0x50 kernel/bpf/syscall.c:6137
 x64_sys_call+0x2aea/0x2ff0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x01 -> 0x00

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 28424 Comm: syz.9.8574 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================