oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=12490,uid=0
Memory cgroup out of memory: Killed process 12491 (syz-executor.0) total-vm:46472kB, anon-rss:380kB, file-rss:8960kB, shmem-rss:0kB, UID:0 pgtables:92kB oom_score_adj:1000
==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64

read-write to 0xffffffff860079c0 of 8 bytes by interrupt on cpu 1:
 tick_do_update_jiffies64+0x112/0x1b0 kernel/time/tick-sched.c:117
 tick_sched_do_timer kernel/time/tick-sched.c:229 [inline]
 tick_nohz_handler+0x7c/0x2d0 kernel/time/tick-sched.c:287
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
 hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1818
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
 mem_cgroup_online include/linux/memcontrol.h:924 [inline]
 get_scan_count mm/vmscan.c:2496 [inline]
 shrink_lruvec+0x50a/0x1640 mm/vmscan.c:5657
 shrink_node_memcgs mm/vmscan.c:5873 [inline]
 shrink_node+0xa78/0x15a0 mm/vmscan.c:5908
 shrink_zones mm/vmscan.c:6152 [inline]
 do_try_to_free_pages+0x3cc/0xca0 mm/vmscan.c:6214
 try_to_free_mem_cgroup_pages+0x1eb/0x4e0 mm/vmscan.c:6529
 try_charge_memcg+0x279/0xd10 mm/memcontrol.c:2783
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x276/0x3f0 mm/swap_state.c:678
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1413 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x2f5/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 __get_user_8+0x11/0x20 arch/x86/lib/getuser.S:85
 rseq_get_rseq_cs kernel/rseq.c:161 [inline]
 rseq_ip_fixup kernel/rseq.c:281 [inline]
 __rseq_handle_notify_resume+0xc8/0xc00 kernel/rseq.c:329
 rseq_handle_notify_resume include/linux/rseq.h:38 [inline]
 resume_user_mode_work include/linux/resume_user_mode.h:62 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 irqentry_exit_to_user_mode+0xcb/0x130 kernel/entry/common.c:231
 irqentry_exit+0x12/0x50 kernel/entry/common.c:334
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

read to 0xffffffff860079c0 of 8 bytes by task 16911 on cpu 0:
 mem_cgroup_flush_stats_ratelimited+0x29/0x100 mm/memcontrol.c:772
 count_shadow_nodes+0x69/0x3d0 mm/workingset.c:684
 do_shrink_slab+0x5a/0x690 mm/shrinker.c:382
 shrink_slab_memcg mm/shrinker.c:548 [inline]
 shrink_slab+0x4f7/0x870 mm/shrinker.c:626
 shrink_node_memcgs mm/vmscan.c:5875 [inline]
 shrink_node+0xab2/0x15a0 mm/vmscan.c:5908
 shrink_zones mm/vmscan.c:6152 [inline]
 do_try_to_free_pages+0x3cc/0xca0 mm/vmscan.c:6214
 try_to_free_mem_cgroup_pages+0x1eb/0x4e0 mm/vmscan.c:6529
 try_charge_memcg+0x279/0xd10 mm/memcontrol.c:2783
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x276/0x3f0 mm/swap_state.c:678
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x3eb/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x0000000100017c67 -> 0x0000000100017c68

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 16911 Comm: syz-executor.0 Tainted: G        W          6.9.0-rc3-syzkaller-00011-g20cb38a7af88 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================
syz-executor.0 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 PID: 16911 Comm: syz-executor.0 Tainted: G        W          6.9.0-rc3-syzkaller-00011-g20cb38a7af88 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xf2/0x150 lib/dump_stack.c:114
 dump_stack+0x15/0x20 lib/dump_stack.c:123
 dump_header+0x83/0x2d0 mm/oom_kill.c:462
 oom_kill_process+0x33e/0x4c0 mm/oom_kill.c:1036
 out_of_memory+0x9cb/0xc00 mm/oom_kill.c:1174
 mem_cgroup_out_of_memory+0x13e/0x190 mm/memcontrol.c:1817
 mem_cgroup_oom mm/memcontrol.c:2047 [inline]
 try_charge_memcg+0x752/0xd10 mm/memcontrol.c:2831
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x276/0x3f0 mm/swap_state.c:678
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x3eb/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fceb23c512e
Code: 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89
RSP: 002b:00007ffccba40fc0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007fceb2468560 RCX: 000000000000000d
RDX: 0000000000000baf RSI: 0000000000000109 RDI: 00007fceb2468560
RBP: 00007ffccba4110c R08: 0000000000000010 R09: 00007fceb25280b0
R10: 00007fceb2528080 R11: 000000000003c490 R12: 0000000000000064
R13: 0000000000135b63 R14: 0000000000135b51 R15: 000000000000000d
 </TASK>
memory: usage 307200kB, limit 307200kB, failcnt 18831
memory+swap: usage 308584kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307176kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
cache 24576
rss 0
shmem 0
mapped_file 0
dirty 0
writeback 0
workingset_refault_anon 558
workingset_refault_file 260
swap 1417216
swapcached 0
pgpgin 837788
pgpgout 837782
pgfault 877921
pgmajfault 287
inactive_anon 0
active_anon 0
inactive_file 20480
active_file 4096
unevictable 0
hierarchical_memory_limit 314572800
hierarchical_memsw_limit 9223372036854771712
total_cache 24576
total_rss 0
total_shmem 0
total_mapped_file 0
total_dirty 0
total_writeback 0
total_workingset_refault_anon 558
total_workingset_refault_file 260
total_swap 1417216
total_swapcached 0
total_pgpgin 837788
total_pgpgout 837782
total_pgfault 877921
total_pgmajfault 287
total_inactive_anon 0
total_active_anon 0
total_inactive_file 20480
total_active_file 4096
total_unevictable 0
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=15786,uid=0
Memory cgroup out of memory: Killed process 15793 (syz-executor.0) total-vm:46476kB, anon-rss:512kB, file-rss:8960kB, shmem-rss:0kB, UID:0 pgtables:84kB oom_score_adj:1000
syz-executor.0 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 PID: 16911 Comm: syz-executor.0 Tainted: G        W          6.9.0-rc3-syzkaller-00011-g20cb38a7af88 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xf2/0x150 lib/dump_stack.c:114
 dump_stack+0x15/0x20 lib/dump_stack.c:123
 dump_header+0x83/0x2d0 mm/oom_kill.c:462
 oom_kill_process+0x33e/0x4c0 mm/oom_kill.c:1036
 out_of_memory+0x9cb/0xc00 mm/oom_kill.c:1174
 mem_cgroup_out_of_memory+0x13e/0x190 mm/memcontrol.c:1817
 mem_cgroup_oom mm/memcontrol.c:2047 [inline]
 try_charge_memcg+0x752/0xd10 mm/memcontrol.c:2831
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x276/0x3f0 mm/swap_state.c:678
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x3eb/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fceb23c512e
Code: 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89
RSP: 002b:00007ffccba40fc0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007fceb2468560 RCX: 000000000000000d
RDX: 0000000000000baf RSI: 0000000000000109 RDI: 00007fceb2468560
RBP: 00007ffccba4110c R08: 0000000000000010 R09: 00007fceb25280b0
R10: 00007fceb2528080 R11: 000000000003c490 R12: 0000000000000064
R13: 0000000000135b63 R14: 0000000000135b51 R15: 000000000000000d
 </TASK>
memory: usage 307200kB, limit 307200kB, failcnt 30424
memory+swap: usage 308328kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307176kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
cache 24576
rss 0
shmem 0
mapped_file 0
dirty 0
writeback 0
workingset_refault_anon 558
workingset_refault_file 260
swap 1155072
swapcached 0
pgpgin 837788
pgpgout 837782
pgfault 877921
pgmajfault 287
inactive_anon 0
active_anon 0
inactive_file 20480
active_file 4096
unevictable 0
hierarchical_memory_limit 314572800
hierarchical_memsw_limit 9223372036854771712
total_cache 24576
total_rss 0
total_shmem 0
total_mapped_file 0
total_dirty 0
total_writeback 0
total_workingset_refault_anon 558
total_workingset_refault_file 260
total_swap 1155072
total_swapcached 0
total_pgpgin 837788
total_pgpgout 837782
total_pgfault 877921
total_pgmajfault 287
total_inactive_anon 0
total_active_anon 0
total_inactive_file 20480
total_active_file 4096
total_unevictable 0
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=13423,uid=0
Memory cgroup out of memory: Killed process 13424 (syz-executor.0) total-vm:46476kB, anon-rss:508kB, file-rss:8960kB, shmem-rss:0kB, UID:0 pgtables:80kB oom_score_adj:1000
syz-executor.0 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 PID: 16911 Comm: syz-executor.0 Tainted: G        W          6.9.0-rc3-syzkaller-00011-g20cb38a7af88 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xf2/0x150 lib/dump_stack.c:114
 dump_stack+0x15/0x20 lib/dump_stack.c:123
 dump_header+0x83/0x2d0 mm/oom_kill.c:462
 oom_kill_process+0x33e/0x4c0 mm/oom_kill.c:1036
 out_of_memory+0x9cb/0xc00 mm/oom_kill.c:1174
 mem_cgroup_out_of_memory+0x13e/0x190 mm/memcontrol.c:1817
 mem_cgroup_oom mm/memcontrol.c:2047 [inline]
 try_charge_memcg+0x752/0xd10 mm/memcontrol.c:2831
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x276/0x3f0 mm/swap_state.c:678
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1362 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x3eb/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fceb23c512e
Code: 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89
RSP: 002b:00007ffccba40fc0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007fceb2468560 RCX: 000000000000000d
RDX: 0000000000000baf RSI: 0000000000000109 RDI: 00007fceb2468560
RBP: 00007ffccba4110c R08: 0000000000000010 R09: 00007fceb25280b0
R10: 00007fceb2528080 R11: 000000000003c490 R12: 0000000000000064
R13: 0000000000135b63 R14: 0000000000135b51 R15: 000000000000000d
 </TASK>
memory: usage 307200kB, limit 307200kB, failcnt 42885
memory+swap: usage 308328kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307176kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz0:
cache 24576
rss 0
shmem 0
mapped_file 0
dirty 0
writeback 0
workingset_refault_anon 558
workingset_refault_file 260
swap 1155072
swapcached 0
pgpgin 837788
pgpgout 837782
pgfault 877921
pgmajfault 287
inactive_anon 0
active_anon 0
inactive_file 12288
active_file 12288
unevictable 0
hierarchical_memory_limit 314572800
hierarchical_memsw_limit 9223372036854771712
total_cache 24576
total_rss 0
total_shmem 0
total_mapped_file 0
total_dirty 0
total_writeback 0
total_workingset_refault_anon 558
total_workingset_refault_file 260
total_swap 1155072
total_swapcached 0
total_pgpgin 837788
total_pgpgout 837782
total_pgfault 877921
total_pgmajfault 287
total_inactive_anon 0
total_active_anon 0
total_inactive_file 12288
total_active_file 12288
total_unevictable 0
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz0,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=22423,uid=0
Memory cgroup out of memory: Killed process 22424 (syz-executor.0) total-vm:46476kB, anon-rss:384kB, file-rss:8960kB, shmem-rss:0kB, UID:0 pgtables:84kB oom_score_adj:1000