syzbot


KCSAN: data-race in ktime_get_seconds / timekeeping_update_from_shadow

Status: moderation: reported on 2025/07/27 13:54
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+ef1ef7bda4f27bf85b1a@syzkaller.appspotmail.com
First crash: 23d, last: 23d

Sample crash report:
==================================================================
BUG: KCSAN: data-race in ktime_get_seconds / timekeeping_update_from_shadow

write to 0xffffffff88e730c8 of 280 bytes by interrupt on cpu 1:
 timekeeping_update_from_shadow+0x280/0x2b0 kernel/time/timekeeping.c:705
 timekeeping_advance+0xa07/0xba0 kernel/time/timekeeping.c:2242
 update_wall_time+0x10/0x30 kernel/time/timekeeping.c:2253
 tick_do_update_jiffies64+0x169/0x1c0 kernel/time/tick-sched.c:149
 tick_sched_do_timer kernel/time/tick-sched.c:232 [inline]
 tick_nohz_handler+0x7f/0x2d0 kernel/time/tick-sched.c:290
 __run_hrtimer kernel/time/hrtimer.c:1761 [inline]
 __hrtimer_run_queues+0x20c/0x5a0 kernel/time/hrtimer.c:1825
 hrtimer_interrupt+0x21a/0x460 kernel/time/hrtimer.c:1887
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1039 [inline]
 __sysvec_apic_timer_interrupt+0x5c/0x1d0 arch/x86/kernel/apic/apic.c:1056
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1050
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
 console_flush_all+0x55b/0x730 arch/x86/include/asm/irqflags.h:-1
 __console_flush_and_unlock kernel/printk/printk.c:3285 [inline]
 console_unlock+0xa1/0x330 kernel/printk/printk.c:3325
 vprintk_emit+0x388/0x650 kernel/printk/printk.c:2450
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2465
 vprintk+0x1d/0x30 kernel/printk/printk_safe.c:82
 _printk+0x79/0xa0 kernel/printk/printk.c:2475
 kauditd_printk_skb kernel/audit.c:546 [inline]
 kauditd_hold_skb+0x1b1/0x1c0 kernel/audit.c:581
 kauditd_send_queue+0x273/0x2c0 kernel/audit.c:766
 kauditd_thread+0x421/0x630 kernel/audit.c:890
 kthread+0x486/0x510 kernel/kthread.c:464
 ret_from_fork+0xda/0x150 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffffffff88e73108 of 8 bytes by task 5719 on cpu 0:
 ktime_get_seconds+0x3a/0x60 kernel/time/timekeeping.c:944
 tcp_store_ts_recent net/ipv4/tcp_input.c:3826 [inline]
 __tcp_replace_ts_recent net/ipv4/tcp_input.c:3831 [inline]
 tcp_replace_ts_recent net/ipv4/tcp_input.c:3849 [inline]
 tcp_ack+0x65b/0x3040 net/ipv4/tcp_input.c:4010
 tcp_rcv_established+0x496/0xef0 net/ipv4/tcp_input.c:6312
 tcp_v4_do_rcv+0x672/0x740 net/ipv4/tcp_ipv4.c:1925
 sk_backlog_rcv+0x71/0x190 include/net/sock.h:1148
 __release_sock+0xb4/0x130 net/core/sock.c:3213
 release_sock+0x44/0x150 net/core/sock.c:3767
 sk_stream_wait_memory+0x461/0x860 net/core/stream.c:145
 tcp_sendmsg_locked+0xad4/0x2c10 net/ipv4/tcp.c:1349
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1396
 inet_sendmsg+0x76/0xd0 net/ipv4/af_inet.c:851
 sock_sendmsg_nosec net/socket.c:712 [inline]
 __sock_sendmsg+0x102/0x180 net/socket.c:727
 __sys_sendto+0x268/0x330 net/socket.c:2180
 __do_sys_sendto net/socket.c:2187 [inline]
 __se_sys_sendto net/socket.c:2183 [inline]
 __x64_sys_sendto+0x76/0x90 net/socket.c:2183
 x64_sys_call+0x2eb6/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd2/0x200 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000067 -> 0x0000000000000068

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 5719 Comm: syz.0.690 Not tainted 6.16.0-rc7-syzkaller-00140-gec2df4364666 #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/07/27 13:54 upstream ec2df4364666 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in ktime_get_seconds / timekeeping_update_from_shadow
* Struck through repros no longer work on HEAD.