================================================================== BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64 read-write to 0xffffffff86c07a00 of 8 bytes by interrupt on cpu 0: tick_do_update_jiffies64+0x113/0x1c0 kernel/time/tick-sched.c:118 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline] tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2096 hrtimer_interrupt+0x257/0x810 kernel/time/hrtimer.c:2215 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 native_irq_enable arch/x86/include/asm/irqflags.h:-1 [inline] arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline] handle_softirqs+0x6c/0x280 kernel/softirq.c:606 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:95 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline] _raw_spin_unlock_irqrestore+0x1a/0x30 kernel/locking/spinlock.c:198 spin_unlock_irqrestore include/linux/spinlock.h:408 [inline] lruvec_unlock_irqrestore include/linux/memcontrol.h:1535 [inline] folio_batch_move_lru+0x309/0x3a0 mm/swap.c:206 __folio_batch_add_and_move mm/swap.c:231 [inline] folio_add_lru+0x149/0x250 mm/swap.c:562 shmem_alloc_and_add_folio mm/shmem.c:2018 [inline] shmem_get_folio_gfp+0x7cc/0xd90 mm/shmem.c:2512 shmem_fault+0xf6/0x250 mm/shmem.c:2713 __do_fault mm/memory.c:5425 [inline] do_read_fault mm/memory.c:5860 [inline] do_fault mm/memory.c:5994 [inline] do_pte_missing mm/memory.c:4566 [inline] handle_pte_fault mm/memory.c:6379 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0x167a/0x2da0 mm/memory.c:6686 faultin_page mm/gup.c:1126 [inline] __get_user_pages+0x129c/0x1f10 mm/gup.c:1428 populate_vma_page_range mm/gup.c:1860 [inline] __mm_populate+0x242/0x390 mm/gup.c:1963 mm_populate include/linux/mm.h:4171 [inline] vm_mmap_pgoff+0x23b/0x2d0 mm/util.c:586 ksys_mmap_pgoff+0xc1/0x310 mm/mmap.c:606 x64_sys_call+0x14df/0x3020 arch/x86/include/generated/asm/syscalls_64.h:10 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffffffff86c07a00 of 8 bytes by task 5677 on cpu 1: mem_cgroup_flush_stats_ratelimited+0x29/0x50 mm/memcontrol.c:743 count_shadow_nodes+0x6a/0x250 mm/workingset.c:694 do_shrink_slab+0x61/0x650 mm/shrinker.c:389 shrink_slab_memcg mm/shrinker.c:560 [inline] shrink_slab+0x53b/0x8e0 mm/shrinker.c:638 shrink_node_memcgs mm/vmscan.c:6129 [inline] shrink_node+0x6b8/0x1e30 mm/vmscan.c:6171 shrink_zones mm/vmscan.c:6410 [inline] do_try_to_free_pages+0x408/0xc90 mm/vmscan.c:6472 try_to_free_mem_cgroup_pages+0x201/0x420 mm/vmscan.c:6794 try_charge_memcg+0x375/0xa00 mm/memcontrol.c:2655 charge_memcg+0x6d/0x120 mm/memcontrol.c:5126 mem_cgroup_swapin_charge_folio+0xc2/0x150 mm/memcontrol.c:5210 __swap_cache_alloc mm/swap_state.c:456 [inline] swap_cache_alloc_folio+0x47b/0x5e0 mm/swap_state.c:524 swap_cache_read_folio mm/swap_state.c:646 [inline] swap_cluster_readahead+0x3d2/0x460 mm/swap_state.c:842 swapin_readahead+0xd8/0x8a0 mm/swap_state.c:984 do_swap_page+0x2a2/0x1ec0 mm/memory.c:4836 handle_pte_fault mm/memory.c:6382 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0xb3c/0x2da0 mm/memory.c:6686 do_user_addr_fault+0x634/0x1060 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 value changed: 0x000000010001441f -> 0x0000000100014420 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 5677 Comm: syz-executor Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 ==================================================================