==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64

read-write to 0xffffffff860079c0 of 8 bytes by interrupt on cpu 0:
 tick_do_update_jiffies64+0x112/0x1b0 kernel/time/tick-sched.c:118
 tick_sched_do_timer kernel/time/tick-sched.c:232 [inline]
 tick_nohz_handler+0x7c/0x2d0 kernel/time/tick-sched.c:290
 __run_hrtimer kernel/time/hrtimer.c:1692 [inline]
 __hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
 hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1818
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1043
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 check_access kernel/kcsan/core.c:737 [inline]
 __tsan_read4+0x24/0x180 kernel/kcsan/core.c:1024
 shrink_slab_memcg mm/shrinker.c:518 [inline]
 shrink_slab+0x2f4/0x870 mm/shrinker.c:626
 shrink_node_memcgs mm/vmscan.c:5875 [inline]
 shrink_node+0xab2/0x15a0 mm/vmscan.c:5908
 shrink_zones mm/vmscan.c:6152 [inline]
 do_try_to_free_pages+0x3cc/0xca0 mm/vmscan.c:6214
 try_to_free_mem_cgroup_pages+0x1eb/0x4e0 mm/vmscan.c:6529
 try_charge_memcg+0x279/0xd10 mm/memcontrol.c:2783
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x380/0x3f0 mm/swap_state.c:697
 shmem_swapin_cluster mm/shmem.c:1582 [inline]
 shmem_swapin_folio+0x246/0x740 mm/shmem.c:1891
 shmem_get_folio_gfp+0x278/0xb70 mm/shmem.c:1997
 shmem_get_folio mm/shmem.c:2166 [inline]
 shmem_file_read_iter+0x152/0x550 mm/shmem.c:2821
 do_iter_readv_writev+0x339/0x3e0
 vfs_iter_read+0x172/0x3a0 fs/read_write.c:830
 lo_read_simple drivers/block/loop.c:286 [inline]
 do_req_filebacked drivers/block/loop.c:496 [inline]
 loop_handle_cmd drivers/block/loop.c:1907 [inline]
 loop_process_work+0x7bc/0x1110 drivers/block/loop.c:1942
 loop_rootcg_workfn+0x22/0x30 drivers/block/loop.c:1973
 process_one_work kernel/workqueue.c:3254 [inline]
 process_scheduled_works+0x465/0x990 kernel/workqueue.c:3335
 worker_thread+0x526/0x730 kernel/workqueue.c:3416
 kthread+0x1d1/0x210 kernel/kthread.c:388
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffffffff860079c0 of 8 bytes by task 9362 on cpu 1:
 mem_cgroup_flush_stats_ratelimited+0x29/0x100 mm/memcontrol.c:772
 count_shadow_nodes+0x69/0x3d0 mm/workingset.c:684
 do_shrink_slab+0x5a/0x690 mm/shrinker.c:382
 shrink_slab_memcg mm/shrinker.c:548 [inline]
 shrink_slab+0x4f7/0x870 mm/shrinker.c:626
 shrink_node_memcgs mm/vmscan.c:5875 [inline]
 shrink_node+0xab2/0x15a0 mm/vmscan.c:5908
 shrink_zones mm/vmscan.c:6152 [inline]
 do_try_to_free_pages+0x3cc/0xca0 mm/vmscan.c:6214
 try_to_free_mem_cgroup_pages+0x1eb/0x4e0 mm/vmscan.c:6529
 try_charge_memcg+0x279/0xd10 mm/memcontrol.c:2783
 try_charge mm/memcontrol.c:2931 [inline]
 charge_memcg mm/memcontrol.c:7284 [inline]
 mem_cgroup_swapin_charge_folio+0x107/0x1a0 mm/memcontrol.c:7369
 __read_swap_cache_async+0x2b9/0x520 mm/swap_state.c:514
 swap_cluster_readahead+0x380/0x3f0 mm/swap_state.c:697
 swapin_readahead+0xe2/0x7a0 mm/swap_state.c:904
 do_swap_page+0x3bb/0x15f0 mm/memory.c:4048
 handle_pte_fault mm/memory.c:5303 [inline]
 __handle_mm_fault mm/memory.c:5441 [inline]
 handle_mm_fault+0x7fa/0x27e0 mm/memory.c:5606
 do_user_addr_fault arch/x86/mm/fault.c:1413 [inline]
 handle_page_fault arch/x86/mm/fault.c:1505 [inline]
 exc_page_fault+0x2f5/0x6d0 arch/x86/mm/fault.c:1563
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 __get_user_8+0x11/0x20 arch/x86/lib/getuser.S:85
 rseq_get_rseq_cs kernel/rseq.c:161 [inline]
 rseq_ip_fixup kernel/rseq.c:281 [inline]
 __rseq_handle_notify_resume+0xc8/0xc00 kernel/rseq.c:329
 rseq_handle_notify_resume include/linux/rseq.h:38 [inline]
 resume_user_mode_work include/linux/resume_user_mode.h:62 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x90/0x130 kernel/entry/common.c:218
 do_syscall_64+0xda/0x1d0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001000096dd -> 0x00000001000096de

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 9362 Comm: syz-executor.3 Tainted: G        W          6.9.0-rc4-syzkaller-00031-g96fca68c4fbf #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================
EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000.