================================================================== BUG: KCSAN: data-race in mem_cgroup_flush_stats_ratelimited / tick_do_update_jiffies64 read-write to 0xffffffff86c07a00 of 8 bytes by interrupt on cpu 1: tick_do_update_jiffies64+0x113/0x1c0 kernel/time/tick-sched.c:118 tick_sched_do_timer kernel/time/tick-sched.c:253 [inline] tick_nohz_handler+0x88/0x380 kernel/time/tick-sched.c:310 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x1f8/0x510 kernel/time/hrtimer.c:2096 hrtimer_interrupt+0x257/0x810 kernel/time/hrtimer.c:2215 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x5f/0x1c0 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x6f/0x80 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 fib_table_insert+0x737/0xee0 net/ipv4/fib_trie.c:1250 fib_magic+0x213/0x270 net/ipv4/fib_frontend.c:1128 fib_add_ifaddr+0x267/0x310 net/ipv4/fib_frontend.c:1165 fib_netdev_event+0x33e/0x420 net/ipv4/fib_frontend.c:1510 notifier_call_chain kernel/notifier.c:85 [inline] raw_notifier_call_chain+0x72/0x1a0 kernel/notifier.c:453 call_netdevice_notifiers_info net/core/dev.c:2250 [inline] call_netdevice_notifiers_extack net/core/dev.c:2288 [inline] call_netdevice_notifiers net/core/dev.c:2302 [inline] netif_open+0x123/0x180 net/core/dev.c:1730 dev_open+0xb8/0x170 net/core/dev_api.c:202 bond_enslave+0x975/0x2050 drivers/net/bonding/bond_main.c:2089 do_set_master+0x37b/0x450 net/core/rtnetlink.c:3020 do_setlink+0x976/0x2860 net/core/rtnetlink.c:3222 rtnl_changelink net/core/rtnetlink.c:3849 [inline] __rtnl_newlink net/core/rtnetlink.c:4022 [inline] rtnl_newlink+0x1086/0x1400 net/core/rtnetlink.c:4159 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:7076 netlink_rcv_skb+0x11e/0x220 net/netlink/af_netlink.c:2556 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7103 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x5a7/0x680 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x5be/0x6f0 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:775 [inline] __sock_sendmsg net/socket.c:790 [inline] ____sys_sendmsg+0x532/0x580 net/socket.c:2684 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2738 __sys_sendmsg net/socket.c:2770 [inline] __do_sys_sendmsg net/socket.c:2775 [inline] __se_sys_sendmsg net/socket.c:2773 [inline] __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2773 x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x136/0x3c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffffffff86c07a00 of 8 bytes by task 7585 on cpu 0: mem_cgroup_flush_stats_ratelimited+0x29/0x50 mm/memcontrol.c:743 count_shadow_nodes+0x6a/0x250 mm/workingset.c:694 do_shrink_slab+0x61/0x650 mm/shrinker.c:389 shrink_slab_memcg mm/shrinker.c:560 [inline] shrink_slab+0x53b/0x8e0 mm/shrinker.c:638 shrink_node_memcgs mm/vmscan.c:6129 [inline] shrink_node+0x6d9/0x20f0 mm/vmscan.c:6171 shrink_zones mm/vmscan.c:6410 [inline] do_try_to_free_pages+0x408/0xc90 mm/vmscan.c:6472 try_to_free_mem_cgroup_pages+0x201/0x420 mm/vmscan.c:6794 try_charge_memcg+0x375/0xa00 mm/memcontrol.c:2655 charge_memcg+0x6d/0x120 mm/memcontrol.c:5126 mem_cgroup_swapin_charge_folio+0xc2/0x150 mm/memcontrol.c:5210 __swap_cache_alloc mm/swap_state.c:456 [inline] swap_cache_alloc_folio+0x47b/0x5e0 mm/swap_state.c:524 swap_cache_read_folio mm/swap_state.c:646 [inline] swap_cluster_readahead+0x2b1/0x460 mm/swap_state.c:831 swapin_readahead+0xd8/0x8a0 mm/swap_state.c:984 do_swap_page+0x2a2/0x1ec0 mm/memory.c:4836 handle_pte_fault mm/memory.c:6382 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0xb3c/0x2da0 mm/memory.c:6686 do_user_addr_fault+0x402/0x1060 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 __get_user_8+0x14/0x40 arch/x86/lib/getuser.S:100 fetch_robust_entry kernel/futex/core.c:1093 [inline] exit_robust_list+0x31/0x220 kernel/futex/core.c:1120 futex_cleanup kernel/futex/core.c:1427 [inline] futex_exit_release+0xe0/0x130 kernel/futex/core.c:1532 exit_mm_release+0x1a/0x30 kernel/fork.c:1507 exit_mm+0x37/0x1a0 kernel/exit.c:585 do_exit+0x438/0x1500 kernel/exit.c:997 do_group_exit+0xfe/0x140 kernel/exit.c:1152 get_signal+0xe07/0xf10 kernel/signal.c:3046 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x15d/0x8c0 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x23c/0x3c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000100001353 -> 0x0000000100001354 Reported by Kernel Concurrency Sanitizer on: CPU: 0 UID: 0 PID: 7585 Comm: syz.4.752 Tainted: G W syzkaller #0 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 ================================================================== syz.4.752 (7585) used greatest stack depth: 8448 bytes left