syzbot


KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

Status: moderation: reported on 2026/04/24 03:11
Subsystems: kernel
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+20790177528defde1ce2@syzkaller.appspotmail.com
First crash: 64d, last: 1h36m
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
1bacbd2d-3fcb-4ebb-a52e-c08e3a0807a9 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu 2026/05/18 23:43 2026/05/18 23:43 2026/05/19 00:15 9f74d39908454b73546eaf1b8211b48b66e5c0fe

			
		
897f09ae-06f3-4bab-bf66-e2077a40f5d0 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu 2026/04/24 03:10 2026/04/24 03:10 2026/04/24 03:29 629ff21a2358bd38f4dbede12a995fb52356ed72

			
		

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

write to 0xffff888237d1b768 of 8 bytes by task 4554 on cpu 1:
 hrtimer_rearm kernel/time/hrtimer.c:2130 [inline]
 __hrtimer_rearm_deferred+0x531/0x650 kernel/time/hrtimer.c:2161
 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:53 [inline]
 hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:62 [inline]
 irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:505 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline]
 irqentry_exit+0x58f/0x610 kernel/entry/common.c:167
 sysvec_apic_timer_interrupt+0x44/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 preempt_count arch/x86/include/asm/preempt.h:27 [inline]
 get_ctx kernel/kcsan/core.c:206 [inline]
 check_access kernel/kcsan/core.c:750 [inline]
 __tsan_unaligned_write4+0xf3/0x180 kernel/kcsan/core.c:1024
 pagefault_disabled_inc include/linux/uaccess.h:248 [inline]
 pagefault_disable include/linux/uaccess.h:265 [inline]
 copy_folio_from_iter_atomic+0x1bd/0x10a0 lib/iov_iter.c:490
 generic_perform_write+0x2c4/0x490 mm/filemap.c:4376
 shmem_file_write_iter+0xc5/0xf0 mm/shmem.c:3414
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57d/0x990 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x27e1/0x3020 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237d1b768 of 8 bytes by task 4564 on cpu 0:
 print_cpu+0x2fb/0x5d0 kernel/time/timer_list.c:129
 timer_list_show+0x107/0x170 kernel/time/timer_list.c:287
 seq_read_iter+0x5f6/0x8f0 fs/seq_file.c:273
 proc_reg_read_iter+0x110/0x180 fs/proc/inode.c:299
 copy_splice_read+0x47a/0x6b0 fs/splice.c:362
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x261/0x680 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x7fffffffffffffff -> 0x0000000e51532c90

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4564 Comm: syz.2.371 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/27 15:12 upstream 5a66900afbd6 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/06/18 05:27 upstream e771677c937d b62b3ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/05/25 14:32 upstream e7ae89a0c97c c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/04/24 03:16 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/04/24 03:10 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
* Struck through repros no longer work on HEAD.