[PATCH RFC 0/9] Fix data races on hrtimer_sleeper ->task field

From: Paul E. McKenney

Date: Thu Jul 30 2026 - 20:40:50 EST


Hello!

In CONFIG_KCSAN_STRICT=y mode, KCSAN finds data races on the
hrtimer_sleeper structure's ->task field. This field is used to indicate
owner of this structure, and also to signal the sleeper that the sleep
is over through use of a store of NULL.

Because access to the ->task field is open-coded across several kernel
subsystems, this series creates accessor functions creatively named
hrtimer_sleeper_task_get() and hrtimer_sleeper_task_set(), and uses
these throughout.

A key goal of this and similar serieses is to reduce KCSAN noise in
strict mode so that new data races are more visible.

The series is as follows:

1. hrtimer: Mark data-racy accesses to hrtimer_sleeper ->task field.

2. aio: Use accessor for hrtimer_sleeper ->task field.

3. wait: Use accessor for hrtimer_sleeper ->task field.

4. io-uring: Use accessor for hrtimer_sleeper ->task field.

5. futex: Use accessor for hrtimer_sleeper ->task field in waitwake.c.

6. timers: Use accessor for hrtimer_sleeper ->task field in
sleep_timeout.c.

7. net: pktgen: Use accessor for hrtimer_sleeper ->task field.

8. rtmutex: Use accessor for hrtimer_sleeper ->task field.

9. futex: Use accessor for hrtimer_sleeper ->task field in requeue.

Thanx, Paul

------------------------------------------------------------------------

fs/aio.c | 2 +-
include/linux/hrtimer.h | 8 ++++++++
include/linux/wait.h | 2 +-
io_uring/rw.c | 2 +-
kernel/futex/requeue.c | 2 +-
kernel/futex/waitwake.c | 8 ++++----
kernel/locking/rtmutex.c | 2 +-
kernel/time/hrtimer.c | 14 +++++++-------
kernel/time/sleep_timeout.c | 4 ++--
net/core/pktgen.c | 4 ++--
10 files changed, 28 insertions(+), 20 deletions(-)