==================================================================
BUG: KCSAN: data-race in ktime_get / timekeeping_update_from_shadow

write to 0xffffffff895f4508 of 320 bytes by interrupt on cpu 1:
 timekeeping_update_from_shadow+0x448/0x480 kernel/time/timekeeping.c:866
 __timekeeping_advance+0xb36/0xcf0 kernel/time/timekeeping.c:2663
 timekeeping_advance kernel/time/timekeeping.c:2671 [inline]
 update_wall_time+0x21/0x50 kernel/time/timekeeping.c:2681
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_interrupt+0x27b/0x860 kernel/time/hrtimer.c:2250
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 br_handle_frame_finish+0xaa5/0xdf0 net/bridge/br_input.c:146
 br_nf_hook_thresh+0x233/0x270 net/bridge/br_netfilter_hooks.c:-1
 br_nf_pre_routing_finish_ipv6+0x503/0x530 net/bridge/br_netfilter_ipv6.c:-1
 NF_HOOK include/linux/netfilter.h:325 [inline]
 br_nf_pre_routing_ipv6+0x1fa/0x2e0 net/bridge/br_netfilter_ipv6.c:183
 br_nf_pre_routing+0x577/0xc00 net/bridge/br_netfilter_hooks.c:513
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0x892/0xaa0 net/bridge/br_input.c:451
 __netif_receive_skb_core+0x5b1/0x1950 net/core/dev.c:6151
 __netif_receive_skb_one_core net/core/dev.c:6262 [inline]
 __netif_receive_skb net/core/dev.c:6377 [inline]
 process_backlog+0x25d/0x680 net/core/dev.c:6728
 __napi_poll+0x61/0x300 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x456/0x930 net/core/dev.c:8007
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 do_softirq+0x46/0x60 kernel/softirq.c:546
 __local_bh_enable_ip+0x79/0x80 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 batadv_tt_local_purge+0x1a7/0x1f0 net/batman-adv/translation-table.c:1402
 batadv_tt_purge+0x2b/0x610 net/batman-adv/translation-table.c:3753
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffffffff895f4518 of 8 bytes by interrupt on cpu 0:
 timekeeping_cycles_to_ns kernel/time/timekeeping.c:459 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:482 [inline]
 ktime_get+0xcf/0x240 kernel/time/timekeeping.c:1004
 gate_get_time net/sched/act_gate.c:23 [inline]
 gate_timer_func+0xda/0x1d0 net/sched/act_gate.c:101
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_run_softirq+0xde/0x290 kernel/time/hrtimer.c:2148
 handle_softirqs+0xcc/0x2a0 kernel/softirq.c:645
 do_softirq+0x46/0x60 kernel/softirq.c:546
 __local_bh_enable_ip+0x79/0x80 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x17/0x20 kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 addrconf_ifdown+0x3ba/0xf70 net/ipv6/addrconf.c:3943
 addrconf_notify+0x214/0x8e0 net/ipv6/addrconf.c:-1
 notifier_call_chain kernel/notifier.c:85 [inline]
 raw_notifier_call_chain+0x72/0x1a0 kernel/notifier.c:453
 call_netdevice_notifiers_info net/core/dev.c:2275 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 unregister_netdevice_many_notify+0xe2a/0x1560 net/core/dev.c:12518
 unregister_netdevice_many net/core/dev.c:12589 [inline]
 default_device_exit_batch+0x408/0x460 net/core/dev.c:13289
 ops_exit_list net/core/net_namespace.c:206 [inline]
 ops_undo_list+0x2ca/0x420 net/core/net_namespace.c:253
 cleanup_net+0x37c/0x5b0 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x56a/0xa50 kernel/workqueue.c:3479
 worker_thread+0x569/0x750 kernel/workqueue.c:3560
 kthread+0x223/0x270 kernel/kthread.c:436
 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

value changed: 0x000001d3fcbc7d89 -> 0x000001d3fe0c2ef6

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 1857 Comm: kworker/u8:10 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: netns cleanup_net
==================================================================