Re: [PATCH] timekeeping: Use data_race() and READ_ONCE() in ktime_get_real_seconds()

[Thomas Gleixner]

On Tue, Jun 16 2026 at 10:11, Dennis Moshegov wrote:
> From: Dennis M <dennismoshegov@xxxxxxxxx>
> Subject: [PATCH v2] timekeeping: Use READ_ONCE/WRITE_ONCE for
> xtime_sec to prevent tearing
>
> The timekeeper update path uses a bulk memcpy() to
>  synchronize the timekeeper structure, which is not guaranteed to be atomic.
>  This allows for torn reads in ktime_get_real_seconds() on 64-bit systems,
>  where the sequence counter protection is bypassed for performance.
>
> To prevent reading a torn 64-bit xtime_sec value, enforce atomic-like
> access by using WRITE_ONCE() for the critical field before the bulk
> memcpy() in timekeeping_update_from_shadow(). Correspondingly, use
> READ_ONCE() in ktime_get_real_seconds() to ensure a fresh, consistent
> load from memory.
>
> Reported-by: syzbot+72789cd1697965e714ca@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspotmail.com/bug?extid=72789cd1697965e714ca
> Signed-off-by: Dennis Moshegov <dennis@xxxxxxxx>
> ---
>  timekeeping.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/timekeeping.c b/timekeeping.c
> index c493a40..461a68e 100644
> --- a/timekeeping.c
> +++ b/timekeeping.c

You need to create the patch in the top level directory so that this
becomes a/kernel/time/timekeeping.c

> @@ -826,6 +826,7 @@ static void timekeeping_update_from_shadow(struct
> tk_data *tkd, unsigned int act

There is a line break after 'struct', which makes the patch malformed
and it can't be applied as is.

Thanks,

        tglx