==================================================================
BUG: KCSAN: data-race in add_timer / run_timer_softirq

write to 0xffff88812c11dbc8 of 8 bytes by interrupt on cpu 1:
 expire_timers kernel/time/timer.c:1451 [inline]
 __run_timers kernel/time/timer.c:1774 [inline]
 __run_timers kernel/time/timer.c:1741 [inline]
 run_timer_softirq+0xb1c/0xbd0 kernel/time/timer.c:1787
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xb5/0xd0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe2/0x270 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 __read_once_size include/linux/compiler.h:232 [inline]
 arch_atomic64_read arch/x86/include/asm/atomic64_64.h:22 [inline]
 atomic64_read include/asm-generic/atomic-instrumented.h:838 [inline]
 atomic_long_read include/asm-generic/atomic-long.h:29 [inline]
 find_watchpoint kernel/kcsan/core.c:117 [inline]
 check_access kernel/kcsan/core.c:537 [inline]
 __tsan_read4+0x30/0x100 kernel/kcsan/core.c:685
 rcu_preempt_read_exit kernel/rcu/tree_plugin.h:358 [inline]
 __rcu_read_unlock+0x42/0x2f0 kernel/rcu/tree_plugin.h:391
 rcu_read_unlock include/linux/rcupdate.h:654 [inline]
 __unlock_page_memcg+0x3e/0xb0 mm/memcontrol.c:2019
 unlock_page_memcg+0x20/0x30 mm/memcontrol.c:2028
 page_remove_file_rmap mm/rmap.c:1273 [inline]
 page_remove_rmap+0x36a/0x790 mm/rmap.c:1330
 zap_pte_range mm/memory.c:1080 [inline]
 zap_pmd_range mm/memory.c:1184 [inline]
 zap_pud_range mm/memory.c:1213 [inline]
 zap_p4d_range mm/memory.c:1234 [inline]
 unmap_page_range+0xb99/0x1a60 mm/memory.c:1255
 unmap_single_vma+0x13c/0x1f0 mm/memory.c:1300
 unmap_vmas+0xe2/0x1b0 mm/memory.c:1332
 exit_mmap+0x13e/0x2f0 mm/mmap.c:3130
 __mmput kernel/fork.c:1088 [inline]
 mmput+0xe2/0x260 kernel/fork.c:1109
 exit_mm kernel/exit.c:485 [inline]
 do_exit+0x640/0x1880 kernel/exit.c:788
 do_group_exit+0xae/0x1a0 kernel/exit.c:899
 get_signal+0x2a7/0x1290 kernel/signal.c:2734
 do_signal+0x2b/0x670 arch/x86/kernel/signal.c:813
 exit_to_usermode_loop+0x24a/0x2c0 arch/x86/entry/common.c:160
 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:278 [inline]
 do_syscall_64+0x36e/0x390 arch/x86/entry/common.c:304
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88812c11dbc8 of 8 bytes by task 7343 on cpu 0:
 __mod_timer kernel/time/timer.c:1027 [inline]
 add_timer+0x175/0x550 kernel/time/timer.c:1137
 __queue_delayed_work+0x13c/0x1d0 kernel/workqueue.c:1644
 queue_delayed_work_on+0xef/0x110 kernel/workqueue.c:1669
 queue_delayed_work include/linux/workqueue.h:509 [inline]
 bond_3ad_state_machine_handler+0xaca/0x28a0 drivers/net/bonding/bond_3ad.c:2353
 process_one_work+0x424/0x930 kernel/workqueue.c:2264
 worker_thread+0x9a/0x7e0 kernel/workqueue.c:2410
 kthread+0x1cb/0x1f0 kernel/kthread.c:255
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 7343 Comm: kworker/u4:0 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bond9 bond_3ad_state_machine_handler
==================================================================