==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64

read-write to 0xffffffff86c07a00 of 8 bytes by interrupt on cpu 1:
 tick_do_update_jiffies64+0x113/0x1c0 kernel/time/tick-sched.c:118
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2096
 hrtimer_interrupt+0x257/0x810 kernel/time/hrtimer.c:2215
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 sbitmap_queue_wake_up+0x0/0x570 lib/sbitmap.c:581
 sbitmap_queue_clear+0x64/0xf0 lib/sbitmap.c:699
 blk_mq_put_tag+0x84/0xa0 block/blk-mq-tag.c:-1
 __blk_mq_free_request+0x1ad/0x240 block/blk-mq.c:812
 blk_mq_free_request+0x187/0x1b0 block/blk-mq.c:830
 __blk_mq_end_request+0x31a/0x380 block/blk-mq.c:-1
 scsi_end_request+0x28f/0x4c0 drivers/scsi/scsi_lib.c:704
 scsi_io_completion+0x7f/0x1d0 drivers/scsi/scsi_lib.c:1112
 scsi_finish_command+0x1c7/0x1e0 drivers/scsi/scsi.c:198
 scsi_complete+0x155/0x4d0 drivers/scsi/scsi_lib.c:1592
 blk_complete_reqs block/blk-mq.c:1222 [inline]
 blk_done_softirq+0x77/0xb0 block/blk-mq.c:1227
 handle_softirqs+0xb9/0x280 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x42/0xd0 kernel/softirq.c:735
 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:273
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:665
 should_watch kernel/kcsan/core.c:280 [inline]
 check_access kernel/kcsan/core.c:752 [inline]
 __tsan_read1+0x113/0x180 kernel/kcsan/core.c:1022
 memcmp+0x5e/0x90 lib/string.c:676
 memcmp include/linux/fortify-string.h:677 [inline]
 namecmp fs/proc/proc_sysctl.c:107 [inline]
 insert_entry fs/proc/proc_sysctl.c:167 [inline]
 insert_header+0x6ad/0x970 fs/proc/proc_sysctl.c:252
 __register_sysctl_table+0xb60/0xbe0 fs/proc/proc_sysctl.c:1398
 register_net_sysctl_sz+0x19e/0x1c0 net/sysctl_net.c:171
 ipv4_sysctl_init_net+0x130/0x240 net/ipv4/sysctl_net_ipv4.c:1688
 ops_init+0x22a/0x2e0 net/core/net_namespace.c:137
 setup_net+0x9f/0x230 net/core/net_namespace.c:446
 copy_net_ns+0x31a/0x460 net/core/net_namespace.c:579
 create_new_namespaces+0x1f6/0x420 kernel/nsproxy.c:132
 unshare_nsproxy_namespaces+0x115/0x150 kernel/nsproxy.c:234
 ksys_unshare+0x411/0x760 kernel/fork.c:3269
 __do_sys_unshare kernel/fork.c:3343 [inline]
 __se_sys_unshare kernel/fork.c:3341 [inline]
 __x64_sys_unshare+0x1f/0x30 kernel/fork.c:3341
 x64_sys_call+0x1cef/0x3020 arch/x86/include/generated/asm/syscalls_64.h:273
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffffffff86c07a00 of 8 bytes by task 4596 on cpu 0:
 mem_cgroup_flush_stats_ratelimited+0x29/0x50 mm/memcontrol.c:743
 count_shadow_nodes+0x6a/0x250 mm/workingset.c:694
 do_shrink_slab+0x61/0x650 mm/shrinker.c:389
 shrink_slab_memcg mm/shrinker.c:560 [inline]
 shrink_slab+0x53b/0x8e0 mm/shrinker.c:638
 shrink_node_memcgs mm/vmscan.c:6126 [inline]
 shrink_node+0x6d9/0x20f0 mm/vmscan.c:6168
 shrink_zones mm/vmscan.c:6407 [inline]
 do_try_to_free_pages+0x408/0xc90 mm/vmscan.c:6469
 try_to_free_mem_cgroup_pages+0x201/0x420 mm/vmscan.c:6791
 mem_cgroup_resize_max+0x1cd/0x240 mm/memcontrol-v1.c:1522
 mem_cgroup_write+0x1ad/0x250 mm/memcontrol-v1.c:-1
 cgroup_file_write+0x197/0x350 kernel/cgroup/cgroup.c:4316
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57d/0x990 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x27e1/0x3020 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffa1ef -> 0x00000000ffffa1f0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4596 Comm: syz.1.220 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
==================================================================