oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3866,pid=15369,uid=0
Memory cgroup out of memory: Killed process 15369 (syz.4.3866) total-vm:93696kB, anon-rss:1096kB, file-rss:20736kB, shmem-rss:0kB, UID:0 pgtables:88kB oom_score_adj:1000
==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64

read-write to 0xffffffff868099c0 of 8 bytes by interrupt on cpu 0:
 tick_do_update_jiffies64+0x113/0x1c0 kernel/time/tick-sched.c:118
 tick_sched_do_timer kernel/time/tick-sched.c:232 [inline]
 tick_nohz_handler+0x7f/0x2d0 kernel/time/tick-sched.c:290
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x20f/0x5a0 kernel/time/hrtimer.c:1825
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1887
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1056
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 __sanitizer_cov_trace_switch+0x7/0x130 kernel/kcov.c:330
 ma_pivots lib/maple_tree.c:666 [inline]
 mtree_range_walk lib/maple_tree.c:2775 [inline]
 mas_state_walk+0x1d3/0x650 lib/maple_tree.c:3636
 mas_walk+0x60/0x150 lib/maple_tree.c:4939
 lock_vma_under_rcu+0x8d/0x160 mm/mmap_lock.c:143
 do_user_addr_fault+0x233/0x1090 arch/x86/mm/fault.c:1327
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

read to 0xffffffff868099c0 of 8 bytes by task 18725 on cpu 1:
 mem_cgroup_flush_stats_ratelimited+0x29/0x70 mm/memcontrol.c:634
 count_shadow_nodes+0x6a/0x230 mm/workingset.c:678
 do_shrink_slab+0x60/0x680 mm/shrinker.c:384
 shrink_slab_memcg mm/shrinker.c:550 [inline]
 shrink_slab+0x448/0x760 mm/shrinker.c:628
 shrink_node_memcgs mm/vmscan.c:6053 [inline]
 shrink_node+0x6c3/0x2120 mm/vmscan.c:6092
 shrink_zones mm/vmscan.c:6336 [inline]
 do_try_to_free_pages+0x3f6/0xcd0 mm/vmscan.c:6398
 try_to_free_mem_cgroup_pages+0x1ab/0x410 mm/vmscan.c:6726
 try_charge_memcg+0x358/0x9e0 mm/memcontrol.c:2357
 try_charge mm/memcontrol.c:2499 [inline]
 charge_memcg+0x51/0xc0 mm/memcontrol.c:4702
 mem_cgroup_swapin_charge_folio+0xcc/0x150 mm/memcontrol.c:4788
 __read_swap_cache_async+0x1df/0x350 mm/swap_state.c:441
 swap_cluster_readahead+0x376/0x3e0 mm/swap_state.c:632
 swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
 do_swap_page+0x301/0x2430 mm/memory.c:4586
 handle_pte_fault mm/memory.c:6055 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x9a5/0x2c20 mm/memory.c:6364
 do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00000001000010ab -> 0x00000001000010ac

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 18725 Comm: syz.4.5253 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
==================================================================
syz.4.5253 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 UID: 0 PID: 18725 Comm: syz.4.5253 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0xe8/0x140 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 dump_header+0x81/0x220 mm/oom_kill.c:467
 oom_kill_process+0x342/0x400 mm/oom_kill.c:1040
 out_of_memory+0x979/0xb80 mm/oom_kill.c:1178
 mem_cgroup_out_of_memory mm/memcontrol.c:1649 [inline]
 mem_cgroup_oom mm/memcontrol.c:1672 [inline]
 try_charge_memcg+0x5e6/0x9e0 mm/memcontrol.c:2399
 try_charge mm/memcontrol.c:2499 [inline]
 charge_memcg+0x51/0xc0 mm/memcontrol.c:4702
 mem_cgroup_swapin_charge_folio+0xcc/0x150 mm/memcontrol.c:4788
 __read_swap_cache_async+0x1df/0x350 mm/swap_state.c:441
 swap_cluster_readahead+0x376/0x3e0 mm/swap_state.c:632
 swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
 do_swap_page+0x301/0x2430 mm/memory.c:4586
 handle_pte_fault mm/memory.c:6055 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x9a5/0x2c20 mm/memory.c:6364
 do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f740a6df166
Code: 48 8d 3d a7 40 1b 00 31 c0 e8 f6 fe fe ff 66 0f 1f 44 00 00 0f b6 05 8e 65 e9 00 84 c0 74 0b 0f b6 05 71 65 e9 00 84 c0 74 0a <c3> 66 0f 1f 84 00 00 00 00 00 0f b6 05 5d 65 e9 00 0f b6 15 52 65
RSP: 002b:00007ffff45edf78 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 00007f740aa45fa0 RCX: 00000000000537f0
RDX: 000000000000028e RSI: 00007ffff45edf60 RDI: 0000000000000001
RBP: 00007f740aa47da0 R08: 00007f740aa45fa0 R09: 7fffffffffffffff
R10: 3fffffffffffffff R11: 0000000000000293 R12: 000000000005371a
R13: 00007f740aa46180 R14: ffffffffffffffff R15: 00007ffff45ee090
 </TASK>
memory: usage 307200kB, limit 307200kB, failcnt 11845
memory+swap: usage 307752kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307184kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz4:
cache 0
rss 0
shmem 0
mapped_file 0
dirty 0
writeback 0
workingset_refault_anon 98
workingset_refault_file 813
swap 565248
swapcached 4096
pgpgin 352634
pgpgout 352630
pgfault 329719
pgmajfault 73
inactive_anon 0
active_anon 4096
inactive_file 0
active_file 12288
unevictable 0
hierarchical_memory_limit 314572800
hierarchical_memsw_limit 9223372036854771712
total_cache 0
total_rss 0
total_shmem 0
total_mapped_file 0
total_dirty 0
total_writeback 0
total_workingset_refault_anon 98
total_workingset_refault_file 813
total_swap 565248
total_swapcached 4096
total_pgpgin 352634
total_pgpgout 352630
total_pgfault 329719
total_pgmajfault 73
total_inactive_anon 0
total_active_anon 4096
total_inactive_file 0
total_active_file 12288
total_unevictable 0
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3653,pid=14785,uid=0
Memory cgroup out of memory: Killed process 14785 (syz.4.3653) total-vm:93696kB, anon-rss:1096kB, file-rss:20736kB, shmem-rss:0kB, UID:0 pgtables:88kB oom_score_adj:1000
syz.4.5253 invoked oom-killer: gfp_mask=0x100cca(GFP_HIGHUSER_MOVABLE), order=0, oom_score_adj=0
CPU: 1 UID: 0 PID: 18725 Comm: syz.4.5253 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
 <TASK>
 __dump_stack+0x1d/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0xe8/0x140 lib/dump_stack.c:120
 dump_stack+0x15/0x1b lib/dump_stack.c:129
 dump_header+0x81/0x220 mm/oom_kill.c:467
 oom_kill_process+0x342/0x400 mm/oom_kill.c:1040
 out_of_memory+0x979/0xb80 mm/oom_kill.c:1178
 mem_cgroup_out_of_memory mm/memcontrol.c:1649 [inline]
 mem_cgroup_oom mm/memcontrol.c:1672 [inline]
 try_charge_memcg+0x5e6/0x9e0 mm/memcontrol.c:2399
 try_charge mm/memcontrol.c:2499 [inline]
 charge_memcg+0x51/0xc0 mm/memcontrol.c:4702
 mem_cgroup_swapin_charge_folio+0xcc/0x150 mm/memcontrol.c:4788
 __read_swap_cache_async+0x1df/0x350 mm/swap_state.c:441
 swap_cluster_readahead+0x277/0x3e0 mm/swap_state.c:613
 swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
 do_swap_page+0x301/0x2430 mm/memory.c:4586
 handle_pte_fault mm/memory.c:6055 [inline]
 __handle_mm_fault mm/memory.c:6195 [inline]
 handle_mm_fault+0x9a5/0x2c20 mm/memory.c:6364
 do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f740a6d1247
Code: 2f fb ff ff eb a6 b8 01 00 00 00 48 81 c4 b8 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 0f 1f 44 00 00 80 3d 62 6b 37 00 00 <48> 8b 47 18 48 8b 4f 28 74 1f 48 8b 30 89 f2 83 c6 02 48 8d 04 f0
RSP: 002b:00007ffff45edf78 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 00007f740aa45fa0 RCX: 00000000000537f0
RDX: 000000000000028e RSI: 00007ffff45edf60 RDI: 00007f740aa46038
RBP: 00007f740aa47da0 R08: 00007f740aa45fa0 R09: 7fffffffffffffff
R10: 3fffffffffffffff R11: 0000000000000293 R12: 000000000005371a
R13: 00007f740aa46180 R14: ffffffffffffffff R15: 00007ffff45ee090
 </TASK>
memory: usage 307200kB, limit 307200kB, failcnt 15940
memory+swap: usage 307672kB, limit 9007199254740988kB, failcnt 0
kmem: usage 307180kB, limit 9007199254740988kB, failcnt 0
Memory cgroup stats for /syz4:
cache 0
rss 0
shmem 0
mapped_file 0
dirty 0
writeback 0
workingset_refault_anon 101
workingset_refault_file 813
swap 483328
swapcached 8192
pgpgin 352637
pgpgout 352632
pgfault 329721
pgmajfault 75
inactive_anon 0
active_anon 8192
inactive_file 0
active_file 12288
unevictable 0
hierarchical_memory_limit 314572800
hierarchical_memsw_limit 9223372036854771712
total_cache 0
total_rss 0
total_shmem 0
total_mapped_file 0
total_dirty 0
total_writeback 0
total_workingset_refault_anon 101
total_workingset_refault_file 813
total_swap 483328
total_swapcached 8192
total_pgpgin 352637
total_pgpgout 352632
total_pgfault 329721
total_pgmajfault 75
total_inactive_anon 0
total_active_anon 8192
total_inactive_file 0
total_active_file 12288
total_unevictable 0
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=/,mems_allowed=0,oom_memcg=/syz4,task_memcg=/syz4,task=syz.4.3569,pid=14560,uid=0
Memory cgroup out of memory: Killed process 14560 (syz.4.3569) total-vm:93696kB, anon-rss:1096kB, file-rss:20736kB, shmem-rss:0kB, UID:0 pgtables:88kB oom_score_adj:1000