==================================================================
BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64

read-write to 0xffffffff86e07a00 of 8 bytes by interrupt on cpu 0:
 tick_do_update_jiffies64+0x113/0x1c0 kernel/time/tick-sched.c:118
 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline]
 tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310
 __run_hrtimer kernel/time/hrtimer.c:2074 [inline]
 __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2131
 hrtimer_interrupt+0x27b/0x860 kernel/time/hrtimer.c:2250
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1062
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
 nr_pcp_high mm/page_alloc.c:2811 [inline]
 free_frozen_page_commit+0x16b/0x3b0 mm/page_alloc.c:2893
 free_unref_folios+0x8bf/0x980 mm/page_alloc.c:3090
 folios_put_refs+0x2a5/0x300 mm/folio.c:1036
 folios_put include/linux/mm.h:2219 [inline]
 __folio_batch_release+0x8e/0xb0 mm/folio.c:1096
 folio_batch_release include/linux/folio_batch.h:101 [inline]
 shmem_undo_range+0x346/0xb60 mm/shmem.c:1161
 shmem_truncate_range mm/shmem.c:1289 [inline]
 shmem_evict_inode+0x12d/0x580 mm/shmem.c:1420
 evict+0x2a5/0x510 fs/inode.c:822
 iput_final fs/inode.c:2014 [inline]
 iput+0x430/0x5a0 fs/inode.c:2063
 dentry_unlink_inode+0x24a/0x260 fs/dcache.c:479
 dentry_kill+0x184/0x500 fs/dcache.c:826
 finish_dput+0x16/0x1d0 fs/dcache.c:1001
 dput+0x48/0x50 fs/dcache.c:1042
 __fput+0x43e/0x630 fs/file_table.c:520
 ____fput+0x1c/0x30 fs/file_table.c:541
 task_work_run+0x130/0x1a0 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x4a4/0x1510 kernel/exit.c:986
 do_group_exit+0xfe/0x140 kernel/exit.c:1129
 get_signal+0xe07/0xf10 kernel/signal.c:3112
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x14d/0x610 kernel/entry/common.c:165
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595

read to 0xffffffff86e07a00 of 8 bytes by task 838 on cpu 1:
 mem_cgroup_flush_stats_ratelimited+0x29/0x50 mm/memcontrol.c:788
 prepare_scan_control mm/vmscan.c:2297 [inline]
 shrink_node+0x109f/0x2000 mm/vmscan.c:6262
 shrink_zones mm/vmscan.c:6503 [inline]
 do_try_to_free_pages+0x408/0xca0 mm/vmscan.c:6565
 try_to_free_mem_cgroup_pages+0x201/0x420 mm/vmscan.c:6887
 try_charge_memcg+0x422/0xae0 mm/memcontrol.c:2718
 try_charge mm/memcontrol.c:2860 [inline]
 obj_cgroup_charge_pages mm/memcontrol.c:3161 [inline]
 __obj_cgroup_charge+0x120/0x250 mm/memcontrol.c:3539
 __memcg_slab_post_alloc_hook+0x4c4/0x8d0 mm/memcontrol.c:3669
 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline]
 slab_post_alloc_hook mm/slub.c:4702 [inline]
 kmem_cache_alloc_bulk_noprof+0x31a/0x410 mm/slub.c:7543
 __io_alloc_req_refill+0x65/0x1d0 io_uring/io_uring.c:981
 io_alloc_req io_uring/io_uring.h:537 [inline]
 io_submit_sqes+0x8e0/0x1180 io_uring/io_uring.c:2039
 __do_sys_io_uring_enter io_uring/io_uring.c:2640 [inline]
 __se_sys_io_uring_enter+0x25c/0xf90 io_uring/io_uring.c:2589
 __x64_sys_io_uring_enter+0x78/0x90 io_uring/io_uring.c:2589
 x64_sys_call+0x1780/0x2550 arch/x86/include/generated/asm/syscalls_64.h:427
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000100029ae1 -> 0x0000000100029ae2

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 838 Comm: syz.4.19798 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================