syzbot


KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

Status: moderation: reported on 2026/04/24 03:11
Subsystems: kernel
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+20790177528defde1ce2@syzkaller.appspotmail.com
First crash: 58d, last: 3d20h
✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
1bacbd2d-3fcb-4ebb-a52e-c08e3a0807a9 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu 2026/05/18 23:43 2026/05/18 23:43 2026/05/19 00:15 9f74d39908454b73546eaf1b8211b48b66e5c0fe

			
		
897f09ae-06f3-4bab-bf66-e2077a40f5d0 assessment-kcsan Benign: ✅ Confident: ✅ KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu 2026/04/24 03:10 2026/04/24 03:10 2026/04/24 03:29 629ff21a2358bd38f4dbede12a995fb52356ed72

			
		

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu

write to 0xffff888237c1b768 of 8 bytes by task 4139 on cpu 0:
 hrtimer_rearm kernel/time/hrtimer.c:2130 [inline]
 __hrtimer_rearm_deferred+0x531/0x650 kernel/time/hrtimer.c:2161
 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:53 [inline]
 hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:62 [inline]
 irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:505 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline]
 irqentry_exit+0x58f/0x610 kernel/entry/common.c:167
 sysvec_apic_timer_interrupt+0x44/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 bdev_open+0x38/0x7d0 block/bdev.c:933
 bdev_file_open_by_dev+0x1cc/0x230 block/bdev.c:1062
 setup_bdev_super+0x46/0x370 fs/super.c:1552
 get_tree_bdev_flags+0x21c/0x300 fs/super.c:1632
 get_tree_bdev+0x1f/0x30 fs/super.c:1657
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5856
 vfs_get_tree+0x57/0x1d0 fs/super.c:1694
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3765 [inline]
 do_new_mount+0x288/0x8d0 fs/namespace.c:3841
 path_mount+0x4ad/0xb90 fs/namespace.c:4161
 do_mount fs/namespace.c:4174 [inline]
 __do_sys_mount fs/namespace.c:4390 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4367
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4367
 x64_sys_call+0x2d61/0x3020 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888237c1b768 of 8 bytes by task 4149 on cpu 1:
 print_cpu+0x2fb/0x5d0 kernel/time/timer_list.c:129
 timer_list_show+0x107/0x170 kernel/time/timer_list.c:287
 seq_read_iter+0x2d9/0x8f0 fs/seq_file.c:231
 proc_reg_read_iter+0x110/0x180 fs/proc/inode.c:299
 copy_splice_read+0x47a/0x6b0 fs/splice.c:362
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x261/0x680 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x37d/0x640 fs/read_write.c:1371
 __do_sys_sendfile64 fs/read_write.c:1432 [inline]
 __se_sys_sendfile64 fs/read_write.c:1418 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1418
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x7fffffffffffffff -> 0x0000000ecf4ec1ed

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 4149 Comm: syz.0.127 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/18 05:27 upstream e771677c937d b62b3ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/05/25 14:32 upstream e7ae89a0c97c c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/04/24 03:16 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
2026/04/24 03:10 upstream 45dcf5e28813 9cfb3ca7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __hrtimer_rearm_deferred / print_cpu
* Struck through repros no longer work on HEAD.