==================================================================
BUG: KCSAN: data-race in copy_mm / percpu_counter_destroy_many

write to 0xffff88810c64a878 of 8 bytes by interrupt on cpu 0:
 __list_del include/linux/list.h:241 [inline]
 __list_del_entry include/linux/list.h:264 [inline]
 list_del include/linux/list.h:275 [inline]
 percpu_counter_destroy_many+0xbd/0x320 lib/percpu_counter.c:244
 percpu_counter_destroy include/linux/percpu_counter.h:52 [inline]
 user_epoll_free kernel/user.c:153 [inline]
 free_user kernel/user.c:166 [inline]
 free_uid+0xec/0x130 kernel/user.c:195
 put_cred_rcu+0x107/0x230 kernel/cred.c:58
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x722/0xcd0 kernel/rcu/tree.c:2919
 rcu_core_si+0xd/0x20 kernel/rcu/tree.c:2936
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x44/0xe0 kernel/softirq.c:767
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x74/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 __sanitizer_cov_trace_pc+0x8/0x80 kernel/kcov.c:209
 folio_test_anon include/linux/page-flags.h:718 [inline]
 __folio_mod_stat mm/rmap.c:1341 [inline]
 __folio_add_rmap mm/rmap.c:1434 [inline]
 __folio_add_file_rmap mm/rmap.c:1712 [inline]
 folio_add_file_rmap_ptes+0xf1/0x1e0 mm/rmap.c:1738
 set_pte_range+0x2c1/0x4f0 mm/memory.c:5726
 filemap_map_order0_folio mm/filemap.c:3889 [inline]
 filemap_map_pages+0x581/0xf70 mm/filemap.c:3960
 do_fault_around mm/memory.c:5958 [inline]
 do_read_fault mm/memory.c:5991 [inline]
 do_fault mm/memory.c:6134 [inline]
 do_pte_missing mm/memory.c:4700 [inline]
 handle_pte_fault mm/memory.c:6558 [inline]
 __handle_mm_fault mm/memory.c:6707 [inline]
 handle_mm_fault+0x2166/0x3bb0 mm/memory.c:6876
 do_user_addr_fault+0x636/0x1060 arch/x86/mm/fault.c:1343
 handle_page_fault arch/x86/mm/fault.c:1483 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

read to 0xffff88810c64a300 of 1728 bytes by task 19608 on cpu 1:
 dup_mm kernel/fork.c:1537 [inline]
 copy_mm+0xd6/0x340 kernel/fork.c:1595
 copy_process+0x10ad/0x2340 kernel/fork.c:2307
 kernel_clone+0x1c0/0x5f0 kernel/fork.c:2766
 __do_sys_clone kernel/fork.c:2908 [inline]
 __se_sys_clone kernel/fork.c:2892 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2892
 x64_sys_call+0x2479/0x2550 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 19608 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================