[moderation] [kernel?] KCSAN: data-race in __tmigr_cpu_activate / tmigr_update_events

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 3c999d1ae3c7 Merge tag 'wq-for-6.10' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12e1bd82980000
kernel config: https://syzkaller.appspot.com/x/.config?x=41b6b83a95ebb268
dashboard link: https://syzkaller.appspot.com/bug?extid=4dd1dd2e87e81f3d1b95
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [anna-...@linutronix.de fred...@kernel.org linux-...@vger.kernel.org tg...@linutronix.de]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3202939b3e7a/disk-3c999d1a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/95266f6b0d61/vmlinux-3c999d1a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0484a1ee0e68/bzImage-3c999d1a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4dd1dd...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __tmigr_cpu_activate / tmigr_update_events

write to 0xffff888237d205e4 of 1 bytes by task 0 on cpu 1:
__tmigr_cpu_activate+0x55/0x1f0 kernel/time/timer_migration.c:682
tmigr_cpu_activate+0x8a/0xc0 kernel/time/timer_migration.c:705
timer_clear_idle+0x28/0x100 kernel/time/timer.c:2380
tick_nohz_restart_sched_tick+0x22/0x110 kernel/time/tick-sched.c:1095
tick_nohz_idle_update_tick kernel/time/tick-sched.c:1440 [inline]
tick_nohz_idle_exit+0xfe/0x1d0 kernel/time/tick-sched.c:1483
do_idle+0x1ee/0x230 kernel/sched/idle.c:345
cpu_startup_entry+0x25/0x30 kernel/sched/idle.c:430
start_secondary+0x94/0xa0 arch/x86/kernel/smpboot.c:313
common_startup_64+0x12c/0x137

read to 0xffff888237d205e4 of 1 bytes by task 0 on cpu 0:
tmigr_next_groupevt kernel/time/timer_migration.c:569 [inline]
tmigr_next_groupevt_expires kernel/time/timer_migration.c:611 [inline]
tmigr_update_events+0x41d/0x5d0 kernel/time/timer_migration.c:846
tmigr_inactive_up kernel/time/timer_migration.c:1318 [inline]
__walk_groups kernel/time/timer_migration.c:488 [inline]
walk_groups kernel/time/timer_migration.c:500 [inline]
__tmigr_cpu_deactivate+0x28a/0x470 kernel/time/timer_migration.c:1354
tmigr_cpu_deactivate+0x66/0x180 kernel/time/timer_migration.c:1378
timer_use_tmigr kernel/time/timer.c:2193 [inline]
__get_next_timer_interrupt+0x137/0x530 kernel/time/timer.c:2268
timer_base_try_to_set_idle+0x54/0x60 kernel/time/timer.c:2357
tick_nohz_stop_tick kernel/time/tick-sched.c:987 [inline]
tick_nohz_idle_stop_tick+0x15b/0x640 kernel/time/tick-sched.c:1226
cpuidle_idle_call kernel/sched/idle.c:232 [inline]
do_idle+0x178/0x230 kernel/sched/idle.c:332
cpu_startup_entry+0x25/0x30 kernel/sched/idle.c:430
rest_init+0xef/0xf0 init/main.c:739
start_kernel+0x57c/0x5e0 init/main.c:1081
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:507
x86_64_start_kernel+0x94/0xa0 arch/x86/kernel/head64.c:488
common_startup_64+0x12c/0x137

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.9.0-syzkaller-07726-g3c999d1ae3c7 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup