==================================================================
BUG: KCSAN: data-race in kick_pool_pick / wq_worker_running

read-write to 0xffff888237d2b0a4 of 4 bytes by task 17106 on cpu 1:
 wq_worker_running+0x9c/0x120 kernel/workqueue.c:1465
 schedule_timeout+0xca/0x180 kernel/time/sleep_timeout.c:99
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common+0xef/0x1d0 kernel/sched/completion.c:132
 usb_start_wait_urb+0x12c/0x220 drivers/usb/core/message.c:72
 usb_internal_control_msg drivers/usb/core/message.c:117 [inline]
 usb_control_msg+0x182/0x240 drivers/usb/core/message.c:167
 get_port_status drivers/usb/core/hub.c:610 [inline]
 hub_ext_port_status+0xb4/0x410 drivers/usb/core/hub.c:627
 usb_hub_port_status drivers/usb/core/hub.c:677 [inline]
 port_event drivers/usb/core/hub.c:5779 [inline]
 hub_event+0x47e/0x2aa0 drivers/usb/core/hub.c:5971
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888237d2b0a4 of 4 bytes by task 38 on cpu 0:
 need_more_worker kernel/workqueue.c:954 [inline]
 kick_pool_pick+0x5f/0x310 kernel/workqueue.c:1284
 __queue_work+0x90a/0xbc0 kernel/workqueue.c:2449
 queue_work_on+0xa9/0x140 kernel/workqueue.c:2501
 queue_work include/linux/workqueue.h:700 [inline]
 schedule_work include/linux/workqueue.h:761 [inline]
 nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:-1 [inline]
 nsim_fib_event_nb+0xc3e/0xd90 drivers/net/netdevsim/fib.c:1043
 notifier_call_chain kernel/notifier.c:85 [inline]
 atomic_notifier_call_chain+0x79/0x1a0 kernel/notifier.c:223
 call_fib_notifiers+0x65/0xa0 net/core/fib_notifier.c:36
 call_fib6_notifiers+0x30/0x40 net/ipv6/fib6_notifier.c:23
 call_fib6_entry_notifiers net/ipv6/ip6_fib.c:412 [inline]
 fib6_add_rt2node+0xbbd/0x1a20 net/ipv6/ip6_fib.c:1258
 fib6_add+0x583/0xf50 net/ipv6/ip6_fib.c:1535
 __ip6_ins_rt net/ipv6/route.c:1357 [inline]
 ip6_ins_rt+0x8a/0xc0 net/ipv6/route.c:1367
 __ipv6_ifa_notify+0x326/0x910 net/ipv6/addrconf.c:6320
 ipv6_ifa_notify net/ipv6/addrconf.c:6359 [inline]
 addrconf_dad_completed+0xdb/0x890 net/ipv6/addrconf.c:4356
 addrconf_dad_work+0x8ac/0xbc0 net/ipv6/addrconf.c:-1
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000 -> 0x00000001

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 38 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: ipv6_addrconf addrconf_dad_work
==================================================================