oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz2,mems_allowed=0,oom_memcg=/syz2,task_memcg=/syz2,task=syz-executor.2,pid=12467,uid=0 Memory cgroup out of memory: Killed process 12467 (syz-executor.2) total-vm:46428kB, anon-rss:484kB, file-rss:8960kB, shmem-rss:0kB, UID:0 pgtables:84kB oom_score_adj:1000 ================================================================== BUG: KCSAN: data-race in mem_cgroup_flush_stats / tick_do_update_jiffies64 read-write to 0xffffffff85a079c0 of 8 bytes by interrupt on cpu 1: tick_do_update_jiffies64+0x112/0x1b0 kernel/time/tick-sched.c:118 tick_sched_do_timer kernel/time/tick-sched.c:210 [inline] tick_sched_timer+0x7b/0x2c0 kernel/time/tick-sched.c:1485 __run_hrtimer kernel/time/hrtimer.c:1688 [inline] __hrtimer_run_queues+0x217/0x700 kernel/time/hrtimer.c:1752 hrtimer_interrupt+0x20d/0x7b0 kernel/time/hrtimer.c:1814 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1063 [inline] __sysvec_apic_timer_interrupt+0x52/0x190 arch/x86/kernel/apic/apic.c:1080 sysvec_apic_timer_interrupt+0x68/0x80 arch/x86/kernel/apic/apic.c:1074 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645 mem_cgroup_get_zone_lru_size include/linux/memcontrol.h:920 [inline] lruvec_lru_size mm/vmscan.c:667 [inline] get_scan_count mm/vmscan.c:3120 [inline] shrink_lruvec+0x41f/0x17a0 mm/vmscan.c:6289 shrink_node_memcgs mm/vmscan.c:6505 [inline] shrink_node+0xab3/0x15c0 mm/vmscan.c:6540 shrink_zones mm/vmscan.c:6779 [inline] do_try_to_free_pages+0x43d/0xce0 mm/vmscan.c:6841 try_to_free_mem_cgroup_pages+0x1e2/0x480 mm/vmscan.c:7156 try_charge_memcg+0x280/0xd30 mm/memcontrol.c:2691 try_charge mm/memcontrol.c:2833 [inline] charge_memcg+0x51/0x200 mm/memcontrol.c:6996 mem_cgroup_swapin_charge_folio+0xd0/0x150 mm/memcontrol.c:7052 __read_swap_cache_async+0x339/0x590 mm/swap_state.c:488 swap_cluster_readahead+0x29d/0x4e0 mm/swap_state.c:650 swapin_readahead+0x8d/0x710 mm/swap_state.c:858 do_swap_page+0x306/0x1780 mm/memory.c:3822 handle_pte_fault mm/memory.c:4981 [inline] __handle_mm_fault mm/memory.c:5119 [inline] handle_mm_fault+0xa2e/0x2cc0 mm/memory.c:5284 do_user_addr_fault arch/x86/mm/fault.c:1413 [inline] handle_page_fault arch/x86/mm/fault.c:1505 [inline] exc_page_fault+0x2f7/0x6c0 arch/x86/mm/fault.c:1561 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 __get_user_8+0x11/0x20 arch/x86/lib/getuser.S:85 fetch_robust_entry kernel/futex/core.c:758 [inline] exit_robust_list+0x31/0x270 kernel/futex/core.c:786 futex_cleanup kernel/futex/core.c:1018 [inline] futex_exit_release+0xdf/0x130 kernel/futex/core.c:1119 exit_mm_release+0x1a/0x30 kernel/fork.c:1651 exit_mm+0x37/0x180 kernel/exit.c:539 do_exit+0x580/0x1660 kernel/exit.c:861 do_group_exit+0x101/0x150 kernel/exit.c:1024 get_signal+0xf3c/0x1090 kernel/signal.c:2892 arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:309 exit_to_user_mode_loop+0x6f/0xe0 kernel/entry/common.c:168 exit_to_user_mode_prepare+0x6c/0xb0 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x140 kernel/entry/common.c:296 do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffffff85a079c0 of 8 bytes by task 12467 on cpu 0: do_flush_stats mm/memcontrol.c:653 [inline] mem_cgroup_flush_stats+0x5d/0xd0 mm/memcontrol.c:664 prepare_scan_count mm/vmscan.c:2926 [inline] shrink_node+0x304/0x15c0 mm/vmscan.c:6538 shrink_zones mm/vmscan.c:6779 [inline] do_try_to_free_pages+0x43d/0xce0 mm/vmscan.c:6841 try_to_free_mem_cgroup_pages+0x1e2/0x480 mm/vmscan.c:7156 try_charge_memcg+0x280/0xd30 mm/memcontrol.c:2691 try_charge mm/memcontrol.c:2833 [inline] charge_memcg+0x51/0x200 mm/memcontrol.c:6996 mem_cgroup_swapin_charge_folio+0xd0/0x150 mm/memcontrol.c:7052 __read_swap_cache_async+0x339/0x590 mm/swap_state.c:488 swap_cluster_readahead+0x29d/0x4e0 mm/swap_state.c:650 swapin_readahead+0x8d/0x710 mm/swap_state.c:858 do_swap_page+0x306/0x1780 mm/memory.c:3822 handle_pte_fault mm/memory.c:4981 [inline] __handle_mm_fault mm/memory.c:5119 [inline] handle_mm_fault+0xa2e/0x2cc0 mm/memory.c:5284 do_user_addr_fault arch/x86/mm/fault.c:1364 [inline] handle_page_fault arch/x86/mm/fault.c:1505 [inline] exc_page_fault+0x3ff/0x6c0 arch/x86/mm/fault.c:1561 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:570 value changed: 0x000000010001d849 -> 0x000000010001d84a Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 12467 Comm: syz-executor.2 Not tainted 6.6.0-rc4-syzkaller-00016-g5e62ed3b1c8a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023 ==================================================================