syzbot


KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow (2)

Status: moderation: reported on 2025/07/05 18:57
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+235d17ec384c9409ac5e@syzkaller.appspotmail.com
First crash: 56d, last: 38d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow kernel 6 1 121d 121d 0/29 auto-obsoleted due to no activity on 2025/06/27 01:56

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow

write to 0xffffffff88e730c8 of 280 bytes by interrupt on cpu 0:
 timekeeping_update_from_shadow+0x280/0x2b0 kernel/time/timekeeping.c:705
 timekeeping_advance+0xa07/0xba0 kernel/time/timekeeping.c:2242
 update_wall_time+0x10/0x30 kernel/time/timekeeping.c:2253
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:232 [inline]
 tick_nohz_handler+0x7f/0x2d0 kernel/time/tick-sched.c:290
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x20f/0x5a0 kernel/time/hrtimer.c:1825
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1887
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1056
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 kcsan_setup_watchpoint+0x415/0x430 kernel/kcsan/core.c:705
 __pte_offset_map_lock+0x1d4/0x230 mm/pgtable-generic.c:404
 pte_offset_map_lock include/linux/mm.h:3015 [inline]
 follow_page_pte+0x63/0x750 mm/gup.c:848
 follow_pmd_mask mm/gup.c:971 [inline]
 follow_pud_mask mm/gup.c:1023 [inline]
 follow_p4d_mask mm/gup.c:1040 [inline]
 follow_page_mask mm/gup.c:1083 [inline]
 __get_user_pages+0x7e9/0x1fb0 mm/gup.c:1486
 __get_user_pages_locked mm/gup.c:1754 [inline]
 get_dump_page+0xb5/0x250 mm/gup.c:2258
 dump_user_range+0x14a/0x8c0 fs/coredump.c:1180
 elf_core_dump+0x1dc2/0x1f80 fs/binfmt_elf.c:2075
 do_coredump+0x1dfa/0x27b0 fs/coredump.c:950
 get_signal+0xd85/0xf70 kernel/signal.c:3019
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 irqentry_exit_to_user_mode+0x5e/0xa0 kernel/entry/common.c:184
 irqentry_exit+0x12/0x50 kernel/entry/common.c:287
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

read to 0xffffffff88e73100 of 8 bytes by task 12830 on cpu 1:
 ktime_get_real_seconds+0x15/0x30 kernel/time/timekeeping.c:965
 kmmpd+0x486/0x660 fs/ext4/mmp.c:244
 kthread+0x489/0x510 kernel/kthread.c:464
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x00000000688192c5 -> 0x00000000688192c6

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 12830 Comm: kmmpd-loop1 Tainted: G        W           6.16.0-rc7-syzkaller-00018-g01a412d06bc5 #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/24 01:56 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow
2025/07/05 18:57 upstream a79a588fc176 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_real_seconds / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.