[PATCH v2] Fix data races on hrtimer_sleeper ->task field

From: Paul E. McKenney

Date: Fri Sep 18 2026 - 20:13:31 EST


Hello!

In CONFIG_KCSAN_STRICT=y mode, KCSAN finds data races on the
hrtimer_sleeper structure's ->task field. This field is used to indicate
owner of this structure, and also to signal the sleeper that the sleep
is over through use of a store of NULL.

Because access to the ->task field is open-coded across several kernel
subsystems, this series creates accessor functions creatively named
hrtimer_sleeper_task_get() and hrtimer_sleeper_task_set(), and uses
these throughout.

While in the area, also apply READ_ONCE() to lockless loads from
base->running.

A key goal of this and similar serieses is to reduce KCSAN noise in
strict mode so that new data races are more visible.

The series is as follows:

1. Mark data-racy accesses to hrtimer_sleeper ->task field.

2. Use accessor for hrtimer_sleeper ->task field.

3. Use accessor for hrtimer_sleeper ->task field.

4. Use accessor for hrtimer_sleeper ->task field.

5. Use accessor for hrtimer_sleeper ->task field in waitwake.c.

6. Use accessor for hrtimer_sleeper ->task field in sleep_timeout.c.

7. pktgen: Use accessor for hrtimer_sleeper ->task field.

8. Use accessor for hrtimer_sleeper ->task field.

9. Use accessor for hrtimer_sleeper ->task field in requeue.

10. Update hrtimer_resolution only if value changes.

11. Mark the hrtimer_sleeper structure's ->task field __private.

12. Apply READ_ONCE() to lockless base->running loads.

Thanx, Paul

Changes since RFC v1:

o Add patch 10 to avoid both cache misses and KCSAN false positives
when updating hrtimer_resolution.

o Add patch 11 to mark the hrtimer_sleeper structure's ->task
field __private, as suggested by Thomas Gleixner.

o Add patch 12 for a similar KCSAN issue involving lockless
loads from base->running.

------------------------------------------------------------------------

b/fs/aio.c | 2 +-
b/include/linux/hrtimer.h | 8 ++++++++
b/include/linux/wait.h | 2 +-
b/io_uring/rw.c | 2 +-
b/kernel/futex/requeue.c | 2 +-
b/kernel/futex/waitwake.c | 8 ++++----
b/kernel/locking/rtmutex.c | 2 +-
b/kernel/time/hrtimer.c | 14 +++++++-------
b/kernel/time/sleep_timeout.c | 4 ++--
b/net/core/pktgen.c | 4 ++--
include/linux/hrtimer.h | 6 +++---
kernel/time/hrtimer.c | 9 +++++----
12 files changed, 36 insertions(+), 27 deletions(-)