==================================================================
BUG: KCSAN: data-race in advance_sched / taprio_dequeue_from_txq

write to 0xffff88811b63cac0 of 8 bytes by interrupt on cpu 1:
 advance_sched+0x2d1/0x6a0 net/sched/sch_taprio.c:-1
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x20f/0x5a0 kernel/time/hrtimer.c:1841
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1903
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1d0 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
 native_pause arch/x86/include/asm/vdso/processor.h:13 [inline]
 cpu_relax arch/x86/include/asm/vdso/processor.h:18 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:433 [inline]
 __pv_queued_spin_lock_slowpath+0x320/0x800 kernel/locking/qspinlock.c:325
 queued_spin_lock_slowpath+0x27/0x40 arch/x86/include/asm/qspinlock.h:52
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
 _raw_spin_lock+0x98/0xa0 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 net_tx_action+0x2ab/0x590 net/core/dev.c:5765
 handle_softirqs+0xba/0x290 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:723
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0x37/0x80 arch/x86/kernel/apic/apic.c:1056
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

read to 0xffff88811b63cac0 of 8 bytes by task 31 on cpu 0:
 taprio_entry_allows_tx net/sched/sch_taprio.c:167 [inline]
 taprio_dequeue_from_txq+0x348/0x490 net/sched/sch_taprio.c:743
 taprio_dequeue_tc_priority net/sched/sch_taprio.c:793 [inline]
 taprio_dequeue+0x17f/0x5d0 net/sched/sch_taprio.c:857
 dequeue_skb net/sched/sch_generic.c:297 [inline]
 qdisc_restart net/sched/sch_generic.c:402 [inline]
 __qdisc_run+0x193/0xc90 net/sched/sch_generic.c:420
 qdisc_run include/net/pkt_sched.h:120 [inline]
 __dev_xmit_skb net/core/dev.c:4250 [inline]
 __dev_queue_xmit+0x1206/0x1ec0 net/core/dev.c:4783
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 vlan_dev_hard_start_xmit+0x201/0x2c0 net/8021q/vlan_dev.c:126
 __netdev_start_xmit include/linux/netdevice.h:5273 [inline]
 netdev_start_xmit include/linux/netdevice.h:5282 [inline]
 xmit_one net/core/dev.c:3853 [inline]
 dev_hard_start_xmit+0x125/0x3e0 net/core/dev.c:3869
 __dev_queue_xmit+0xda9/0x1ec0 net/core/dev.c:4817
 dev_queue_xmit include/linux/netdevice.h:3381 [inline]
 neigh_connected_output+0x253/0x2c0 net/core/neighbour.c:1623
 neigh_output include/net/neighbour.h:556 [inline]
 ip6_finish_output2+0xa5f/0xd10 net/ipv6/ip6_output.c:136
 __ip6_finish_output net/ipv6/ip6_output.c:-1 [inline]
 ip6_finish_output+0x3a4/0x540 net/ipv6/ip6_output.c:220
 NF_HOOK_COND include/linux/netfilter.h:307 [inline]
 ip6_output+0x10a/0x250 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:464 [inline]
 NF_HOOK include/linux/netfilter.h:318 [inline]
 ndisc_send_skb+0x50f/0x760 net/ipv6/ndisc.c:512
 ndisc_send_rs+0x2e7/0x360 net/ipv6/ndisc.c:722
 addrconf_dad_completed+0x60d/0x890 net/ipv6/addrconf.c:4360
 addrconf_dad_work+0x8ac/0xbf0 net/ipv6/addrconf.c:-1
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0x4ce/0x9d0 kernel/workqueue.c:3340
 worker_thread+0x582/0x770 kernel/workqueue.c:3421
 kthread+0x489/0x510 kernel/kthread.c:463
 ret_from_fork+0x149/0x290 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

value changed: 0x187f636dc7253c8d -> 0x187f636dc725bc8e

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 31 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: ipv6_addrconf addrconf_dad_work
==================================================================