================================================================== BUG: KCSAN: data-race in internal_add_timer / update_process_times write to 0xffff888237d176d8 of 8 bytes by interrupt on cpu 0: enqueue_timer kernel/time/timer.c:598 [inline] internal_add_timer+0x14f/0x280 kernel/time/timer.c:611 add_timer_on+0x262/0x2a0 kernel/time/timer.c:1182 clocksource_watchdog+0xa74/0xac0 kernel/time/clocksource.c:478 call_timer_fn+0x2e/0x1d0 kernel/time/timer.c:1421 expire_timers+0x135/0x240 kernel/time/timer.c:1466 __run_timers+0x368/0x430 kernel/time/timer.c:1734 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1747 __do_softirq+0x12c/0x26e kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu kernel/softirq.c:636 [inline] irq_exit_rcu+0x4e/0xa0 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 read to 0xffff888237d176d8 of 8 bytes by interrupt on cpu 1: run_local_timers kernel/time/timer.c:1761 [inline] update_process_times+0x8c/0x150 kernel/time/timer.c:1784 tick_sched_handle kernel/time/tick-sched.c:226 [inline] tick_sched_timer+0x191/0x210 kernel/time/tick-sched.c:1421 __run_hrtimer+0x160/0x480 kernel/time/hrtimer.c:1685 __hrtimer_run_queues kernel/time/hrtimer.c:1749 [inline] hrtimer_interrupt+0x380/0xaf0 kernel/time/hrtimer.c:1811 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline] __sysvec_apic_timer_interrupt+0x6f/0x1c0 arch/x86/kernel/apic/apic.c:1103 sysvec_apic_timer_interrupt+0x64/0x80 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 is_atomic kernel/kcsan/core.c:249 [inline] should_watch kernel/kcsan/core.c:266 [inline] check_access kernel/kcsan/core.c:633 [inline] __tsan_read8+0x134/0x180 kernel/kcsan/core.c:855 PageAnon include/linux/page-flags.h:504 [inline] mm_counter include/linux/mm.h:1966 [inline] zap_pte_range+0x644/0xe20 mm/memory.c:1361 zap_pmd_range mm/memory.c:1481 [inline] zap_pud_range mm/memory.c:1510 [inline] zap_p4d_range mm/memory.c:1531 [inline] unmap_page_range+0x2dc/0x3d0 mm/memory.c:1552 unmap_single_vma+0x157/0x210 mm/memory.c:1597 unmap_vmas+0xd0/0x180 mm/memory.c:1629 exit_mmap+0x23d/0x470 mm/mmap.c:3171 __mmput+0x27/0x1d0 kernel/fork.c:1115 mmput+0x3d/0x50 kernel/fork.c:1136 exit_mm+0x2ec/0x3e0 kernel/exit.c:501 do_exit+0x3ef/0x14a0 kernel/exit.c:812 do_group_exit+0xce/0x1a0 kernel/exit.c:922 get_signal+0xf63/0x15a0 kernel/signal.c:2855 arch_do_signal_or_restart+0x8c/0x280 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x109/0x190 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x20/0x40 kernel/entry/common.c:300 do_syscall_64+0x50/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae value changed: 0x00000000ffffa878 -> 0x00000000ffffa7b9 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 4076 Comm: syz-executor.2 Not tainted 5.15.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ================================================================== scsi_io_completion_action: 19 callbacks suppressed sd 0:0:1:0: tag#3395 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3395 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3395 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3395 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3395 CDB[20]: ba sd 0:0:1:0: tag#3397 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3397 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3397 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3397 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3397 CDB[20]: ba sd 0:0:1:0: tag#3399 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3399 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3399 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3399 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3399 CDB[20]: ba sd 0:0:1:0: tag#3400 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3400 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3400 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3400 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3400 CDB[20]: ba sd 0:0:1:0: tag#3401 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3401 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3401 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3401 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3401 CDB[20]: ba sd 0:0:1:0: tag#3402 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3402 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3402 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3402 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3402 CDB[20]: ba sd 0:0:1:0: tag#3403 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3403 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3403 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3403 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3403 CDB[20]: ba sd 0:0:1:0: tag#3404 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3404 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3404 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3404 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3404 CDB[20]: ba scsi_io_completion_action: 19 callbacks suppressed sd 0:0:1:0: tag#3442 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3442 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3442 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3442 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3442 CDB[20]: ba sd 0:0:1:0: tag#3443 FAILED Result: hostbyte=DID_ABORT driverbyte=DRIVER_OK cmd_age=0s sd 0:0:1:0: tag#3443 CDB: opcode=0xe5 (vendor) sd 0:0:1:0: tag#3443 CDB[00]: e5 f4 32 73 2f 4e 09 6d 26 e2 c7 35 d1 35 12 1c sd 0:0:1:0: tag#3443 CDB[10]: 92 1b da 40 b8 58 5b a8 d4 7d 34 f3 90 4c f1 2d sd 0:0:1:0: tag#3443 CDB[20]: ba