==================================================================
BUG: KCSAN: data-race in copy_mm / percpu_counter_destroy_many

write to 0xffff88812f0c6a48 of 8 bytes by task 8831 on cpu 0:
 __list_del include/linux/list.h:203 [inline]
 __list_del_entry include/linux/list.h:226 [inline]
 list_del include/linux/list.h:237 [inline]
 percpu_counter_destroy_many+0xc7/0x2b0 lib/percpu_counter.c:244
 __mmdrop+0x259/0x3f0 kernel/fork.c:734
 mmdrop include/linux/sched/mm.h:55 [inline]
 mmdrop_sched include/linux/sched/mm.h:83 [inline]
 mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline]
 finish_task_switch+0x180/0x280 kernel/sched/core.c:5143
 context_switch kernel/sched/core.c:5263 [inline]
 __schedule+0x82d/0xc90 kernel/sched/core.c:6867
 preempt_schedule_common kernel/sched/core.c:7051 [inline]
 __cond_resched+0x31/0x60 kernel/sched/core.c:7378
 might_resched include/linux/kernel.h:61 [inline]
 might_alloc include/linux/sched/mm.h:323 [inline]
 prepare_alloc_pages mm/page_alloc.c:5008 [inline]
 __alloc_frozen_pages_noprof+0xfe/0x350 mm/page_alloc.c:5229
 alloc_pages_mpol+0xb3/0x260 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof mm/mempolicy.c:2505 [inline]
 vma_alloc_folio_noprof+0x1a9/0x300 mm/mempolicy.c:2540
 folio_prealloc mm/memory.c:-1 [inline]
 wp_page_copy mm/memory.c:3722 [inline]
 do_wp_page+0xf6d/0x2560 mm/memory.c:4183
 handle_pte_fault mm/memory.c:6292 [inline]
 __handle_mm_fault mm/memory.c:6414 [inline]
 handle_mm_fault+0x8c7/0x3030 mm/memory.c:6583
 do_user_addr_fault+0x3fd/0x1050 arch/x86/mm/fault.c:1385
 handle_page_fault arch/x86/mm/fault.c:1474 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1527
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
 rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:68
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
 copy_to_user_iter lib/iov_iter.c:25 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0x141/0xea0 lib/iov_iter.c:197
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter net/core/datagram.c:521 [inline]
 __skb_datagram_iter+0xc6/0x680 net/core/datagram.c:402
 skb_copy_datagram_iter+0x3d/0x100 net/core/datagram.c:535
 skb_copy_datagram_msg include/linux/skbuff.h:4217 [inline]
 tipc_recvstream+0x4d7/0x780 net/tipc/socket.c:2067
 sock_recvmsg_nosec net/socket.c:1078 [inline]
 sock_recvmsg+0x139/0x160 net/socket.c:1100
 ____sys_recvmsg+0xf5/0x280 net/socket.c:2812
 ___sys_recvmsg+0x11f/0x3b0 net/socket.c:2854
 __sys_recvmsg net/socket.c:2887 [inline]
 __do_sys_recvmsg net/socket.c:2893 [inline]
 __se_sys_recvmsg net/socket.c:2890 [inline]
 __x64_sys_recvmsg+0xd1/0x160 net/socket.c:2890
 x64_sys_call+0x2cbf/0x3000 arch/x86/include/generated/asm/syscalls_64.h:48
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88812f0c6540 of 1664 bytes by task 8830 on cpu 1:
 dup_mm kernel/fork.c:1523 [inline]
 copy_mm+0xe1/0x370 kernel/fork.c:1581
 copy_process+0xcbd/0x1f10 kernel/fork.c:2221
 kernel_clone+0x16b/0x5b0 kernel/fork.c:2651
 __do_sys_clone kernel/fork.c:2792 [inline]
 __se_sys_clone kernel/fork.c:2776 [inline]
 __x64_sys_clone+0x143/0x180 kernel/fork.c:2776
 x64_sys_call+0x12d0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc0/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 8830 Comm: dhcpcd-run-hook Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================