==================================================================
BUG: KCSAN: data-race in __mod_memcg_state / mem_cgroup_css_rstat_flush

write to 0xffffe8ffffd4a400 of 4 bytes by task 3199 on cpu 0:
 mem_cgroup_css_rstat_flush+0x4ea/0x540 mm/memcontrol.c:5848
 cgroup_rstat_flush_locked+0x848/0x980 kernel/cgroup/rstat.c:245
 cgroup_rstat_flush+0x26/0x40 kernel/cgroup/rstat.c:277
 do_flush_stats mm/memcontrol.c:745 [inline]
 flush_memcg_stats_dwork+0x50/0x90 mm/memcontrol.c:782
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read-write to 0xffffe8ffffd4a400 of 4 bytes by task 5169 on cpu 1:
 memcg_rstat_updated mm/memcontrol.c:725 [inline]
 __mod_memcg_state+0x10c/0x170 mm/memcontrol.c:824
 mod_memcg_state include/linux/memcontrol.h:1002 [inline]
 memcg_account_kmem mm/memcontrol.c:3258 [inline]
 obj_cgroup_uncharge_pages+0xe2/0x200 mm/memcontrol.c:3280
 refill_obj_stock+0x15c/0x1e0 mm/memcontrol.c:3553
 obj_cgroup_uncharge+0xe/0x20 mm/memcontrol.c:3602
 __memcg_slab_free_hook+0xa9/0x130 mm/slub.c:2000
 memcg_slab_free_hook mm/slub.c:2020 [inline]
 slab_free mm/slub.c:4278 [inline]
 kmem_cache_free+0x18b/0x250 mm/slub.c:4344
 free_buffer_head+0x49/0x1d0 fs/buffer.c:3017
 try_to_free_buffers+0x121/0x170 fs/buffer.c:2958
 jbd2_journal_try_to_free_buffers+0x155/0x180 fs/jbd2/transaction.c:2182
 ext4_release_folio+0x9f/0x190 fs/ext4/inode.c:3192
 filemap_release_folio+0xd2/0x160 mm/filemap.c:4132
 block_invalidate_folio+0x376/0x3c0 fs/buffer.c:1633
 ext4_invalidate_folio+0x73/0x160 fs/ext4/inode.c:3154
 folio_invalidate mm/truncate.c:158 [inline]
 truncate_cleanup_folio+0x123/0x1b0 mm/truncate.c:178
 truncate_inode_pages_range+0x18d/0x6b0 mm/truncate.c:358
 truncate_inode_pages mm/truncate.c:439 [inline]
 truncate_inode_pages_final+0x55/0x60 mm/truncate.c:474
 ext4_evict_inode+0x174/0xdd0 fs/ext4/inode.c:193
 evict+0x1ae/0x420 fs/inode.c:667
 iput_final fs/inode.c:1741 [inline]
 iput+0x432/0x5c0 fs/inode.c:1767
 dentry_unlink_inode+0x230/0x240 fs/dcache.c:400
 __dentry_kill+0x188/0x4b0 fs/dcache.c:603
 dput+0x5c/0xd0 fs/dcache.c:845
 __fput+0x44c/0x660 fs/file_table.c:430
 ____fput+0x15/0x20 fs/file_table.c:450
 task_work_run+0x13a/0x1a0 kernel/task_work.c:180
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x5fd/0x1740 kernel/exit.c:878
 do_group_exit+0x102/0x150 kernel/exit.c:1027
 get_signal+0xf2f/0x1080 kernel/signal.c:2911
 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 irqentry_exit_to_user_mode+0x94/0x130 kernel/entry/common.c:231
 irqentry_exit+0x12/0x50 kernel/entry/common.c:334
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00000020 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 5169 Comm: syz-executor.2 Not tainted 6.9.0-rc3-syzkaller-00208-g586b5dfb51b9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================
syz-executor.2 (5169) used greatest stack depth: 10032 bytes left