syzbot


ID Workflow Result Correct Bug Created Started Finished Revision Error
c69ad9bf-7d1e-4511-ac63-763746717f0c assessment-kcsan 💥 KCSAN: data-race in __mod_timer / blk_add_timer (13) 2026/01/10 00:22 2026/01/10 00:22 2026/01/10 00:41 7519916073b761ced56a7b15fdeeb4674e8dc125 Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. * Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0, Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.QuotaFailure violations:[map[quotaId:GenerateRequestsPerDayPerProjectPerModel quotaMetric:generativelanguage.googleapis.com/generate_requests_per_model_per_day]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. * Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0 [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0" details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "RM\nK\nEgenerativelanguage.googleapis.com/generate_requests_per_model_per_day\030\000\"\000" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } details { [type.googleapis.com/google.rpc.QuotaFailure] { violations { quota_metric: "generativelanguage.googleapis.com/generate_requests_per_model_per_day" quota_id: "GenerateRequestsPerDayPerProjectPerModel" } } } }]]

Crash report:
==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff888101760920 of 8 bytes by task 9042 on cpu 0:
 __mod_timer+0x5a1/0x840 kernel/time/timer.c:1126
 mod_timer+0x1f/0x30 kernel/time/timer.c:1195
 blk_add_timer+0x182/0x1a0 block/blk-timeout.c:164
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug block/blk-core.c:1252 [inline]
 __submit_bio+0x2fc/0x4d0 block/blk-core.c:651
 __submit_bio_noacct_mq block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x152/0x5c0 block/blk-core.c:755
 submit_bio_noacct+0x746/0x9a0 block/blk-core.c:879
 submit_bio+0x2a6/0x2c0 block/blk-core.c:921
 submit_bh_wbc+0x2e0/0x320 fs/buffer.c:2824
 submit_bh fs/buffer.c:2829 [inline]
 __bread_slow fs/buffer.c:1272 [inline]
 __bread_gfp+0x15c/0x240 fs/buffer.c:1518
 sb_bread include/linux/buffer_head.h:346 [inline]
 isofs_fill_super+0x417/0x12b0 fs/isofs/inode.c:632
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1699
 get_tree_bdev+0x1f/0x30 fs/super.c:1722
 isofs_get_tree+0x1c/0x30 fs/isofs/inode.c:1538
 vfs_get_tree+0x57/0x1d0 fs/super.c:1759
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x24d/0x6a0 fs/namespace.c:3712
 path_mount+0x4ab/0xb80 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888101760920 of 8 bytes by task 3665 on cpu 1:
 blk_add_timer+0x115/0x1a0 block/blk-timeout.c:-1
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug+0x48/0x70 block/blk-core.c:1252
 read_pages+0x401/0x480 mm/readahead.c:176
 page_cache_ra_unbounded+0x34e/0x450 mm/readahead.c:302
 do_page_cache_ra mm/readahead.c:332 [inline]
 force_page_cache_ra mm/readahead.c:361 [inline]
 page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579
 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2683
 filemap_read+0x231/0xa00 mm/filemap.c:2793
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:860
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x2889/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffb9d3 -> 0x00000000ffffbdbd

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3665 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================

Trajectory:
Seq Timestamp Type Name Duration
0/0 2026/01/10 00:22 flow assessment-kcsan
18m Model:
unknown

Error:
Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0, Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.QuotaFailure violations:[map[quotaId:GenerateRequestsPerDayPerProjectPerModel quotaMetric:generativelanguage.googleapis.com/generate_requests_per_model_per_day]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0 [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0" details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "RM\nK\nEgenerativelanguage.googleapis.com/generate_requests_per_model_per_day\030\000\"\000" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } details { [type.googleapis.com/google.rpc.QuotaFailure] { violations { quota_metric: "generativelanguage.googleapis.com/generate_requests_per_model_per_day" quota_id: "GenerateRequestsPerDayPerProjectPerModel" } } } }]]

1/1 2026/01/10 00:22 action kernel-checkouter
0m Model:
unknown

Results:
map[KernelSrc:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/src/69c2c03ba46b287e1a31f0282983a6c7e3880f70]

2/1 2026/01/10 00:23 action kernel-builder
3m Model:
unknown

Results:
map[KernelObj:/usr/local/google/home/dvyukov/syzkaller/agent/workdir/cache/build/9f16e702480f6a4a5410021c62bd73b1303a1c77]

3/1 2026/01/10 00:27 action codesearch-prepare
14m Model:
unknown

Results:
map[Index:codesearch-index]

4/1 2026/01/10 00:41 agent expert
0m Model:
unknown

Error:
Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0, Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.QuotaFailure violations:[map[quotaId:GenerateRequestsPerDayPerProjectPerModel quotaMetric:generativelanguage.googleapis.com/generate_requests_per_model_per_day]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0 [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0" details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "RM\nK\nEgenerativelanguage.googleapis.com/generate_requests_per_model_per_day\030\000\"\000" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } details { [type.googleapis.com/google.rpc.QuotaFailure] { violations { quota_metric: "generativelanguage.googleapis.com/generate_requests_per_model_per_day" quota_id: "GenerateRequestsPerDayPerProjectPerModel" } } } }]]

Instruction:
You are an experienced Linux kernel developer tasked with determining if the given kernel
data race is benign or not. The data race report is from KCSAN tool.
It contains 2 stack traces of the memory accesses that constitute a data race.

The report would be non-actionable, if the underlysing data race is "benign".
That is, the race is on a simple int/bool or similar field, and the accesses
are not supposed to be protected by any mutual exclusion primitives.
Common examples of such "benign" data races are accesses to various flags fields,
statistics counters, and similar.
An actionable race is "harmful", that is can lead to corruption/crash even with
a conservative compiler that compiles memory accesses to primitive types
effectively as atomic. A common example of a "harmful" data races is race on
a complex container (list/hashmap/etc), where accesses are supposed to be protected
by a mutual exclusion primitive.
In the final reply explain why you think the report is consistent and the data race is harmful.

Use the provided tools to confirm any assumptions, what variables/fields being accessed, etc.
In particular, don't make assumptions about the kernel source code,
use codesearch tools to read the actual source code.


Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.

Prompt:
The data race report is:

==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff888101760920 of 8 bytes by task 9042 on cpu 0:
 __mod_timer+0x5a1/0x840 kernel/time/timer.c:1126
 mod_timer+0x1f/0x30 kernel/time/timer.c:1195
 blk_add_timer+0x182/0x1a0 block/blk-timeout.c:164
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug block/blk-core.c:1252 [inline]
 __submit_bio+0x2fc/0x4d0 block/blk-core.c:651
 __submit_bio_noacct_mq block/blk-core.c:724 [inline]
 submit_bio_noacct_nocheck+0x152/0x5c0 block/blk-core.c:755
 submit_bio_noacct+0x746/0x9a0 block/blk-core.c:879
 submit_bio+0x2a6/0x2c0 block/blk-core.c:921
 submit_bh_wbc+0x2e0/0x320 fs/buffer.c:2824
 submit_bh fs/buffer.c:2829 [inline]
 __bread_slow fs/buffer.c:1272 [inline]
 __bread_gfp+0x15c/0x240 fs/buffer.c:1518
 sb_bread include/linux/buffer_head.h:346 [inline]
 isofs_fill_super+0x417/0x12b0 fs/isofs/inode.c:632
 get_tree_bdev_flags+0x291/0x300 fs/super.c:1699
 get_tree_bdev+0x1f/0x30 fs/super.c:1722
 isofs_get_tree+0x1c/0x30 fs/isofs/inode.c:1538
 vfs_get_tree+0x57/0x1d0 fs/super.c:1759
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3636 [inline]
 do_new_mount+0x24d/0x6a0 fs/namespace.c:3712
 path_mount+0x4ab/0xb80 fs/namespace.c:4022
 do_mount fs/namespace.c:4035 [inline]
 __do_sys_mount fs/namespace.c:4224 [inline]
 __se_sys_mount+0x28c/0x2e0 fs/namespace.c:4201
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4201
 x64_sys_call+0x2cca/0x3000 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888101760920 of 8 bytes by task 3665 on cpu 1:
 blk_add_timer+0x115/0x1a0 block/blk-timeout.c:-1
 blk_mq_start_request+0x183/0x3d0 block/blk-mq.c:1374
 loop_queue_rq+0x43/0x680 drivers/block/loop.c:1860
 __blk_mq_issue_directly block/blk-mq.c:2714 [inline]
 blk_mq_request_issue_directly+0x1e9/0x380 block/blk-mq.c:2801
 blk_mq_issue_direct+0x19d/0x530 block/blk-mq.c:2822
 blk_mq_dispatch_queue_requests+0x1fc/0x350 block/blk-mq.c:2897
 blk_mq_flush_plug_list+0x2b6/0x330 block/blk-mq.c:2980
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1225
 blk_finish_plug+0x48/0x70 block/blk-core.c:1252
 read_pages+0x401/0x480 mm/readahead.c:176
 page_cache_ra_unbounded+0x34e/0x450 mm/readahead.c:302
 do_page_cache_ra mm/readahead.c:332 [inline]
 force_page_cache_ra mm/readahead.c:361 [inline]
 page_cache_sync_ra+0x26e/0x6a0 mm/readahead.c:579
 filemap_get_pages+0x2d0/0x11b0 mm/filemap.c:2683
 filemap_read+0x231/0xa00 mm/filemap.c:2793
 blkdev_read_iter+0x22d/0x2e0 block/fops.c:860
 new_sync_read fs/read_write.c:491 [inline]
 vfs_read+0x64c/0x770 fs/read_write.c:572
 ksys_read+0xda/0x1a0 fs/read_write.c:715
 __do_sys_read fs/read_write.c:724 [inline]
 __se_sys_read fs/read_write.c:722 [inline]
 __x64_sys_read+0x40/0x50 fs/read_write.c:722
 x64_sys_call+0x2889/0x3000 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffffb9d3 -> 0x00000000ffffbdbd

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3665 Comm: udevd Not tainted syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================


5/2 2026/01/10 00:41 llm expert
0m Model:
unknown

Error:
Error 429, Message: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0, Status: RESOURCE_EXHAUSTED, Details: [map[@type:type.googleapis.com/google.rpc.Help links:[map[description:Learn more about Gemini API quotas url:https://ai.google.dev/gemini-api/docs/rate-limits]]] map[@type:type.googleapis.com/google.rpc.QuotaFailure violations:[map[quotaId:GenerateRequestsPerDayPerProjectPerModel quotaMetric:generativelanguage.googleapis.com/generate_requests_per_model_per_day]]] map[@type:type.googleapis.com/google.rpc.DebugInfo detail:[ORIGINAL ERROR] generic::resource_exhausted: You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. 
* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0 [google.rpc.error_details_ext] { message: "You exceeded your current quota, please check your plan and billing details. For more information on this error, head to: https://ai.google.dev/gemini-api/docs/rate-limits. To monitor your current usage, head to: https://ai.dev/rate-limit. \n* Quota exceeded for metric: generativelanguage.googleapis.com/generate_requests_per_model_per_day, limit: 0" details { type_url: "type.googleapis.com/language_labs.genai.debug.GeminiApiDebugInfo" value: "RM\nK\nEgenerativelanguage.googleapis.com/generate_requests_per_model_per_day\030\000\"\000" } details { [type.googleapis.com/google.rpc.Help] { links { description: "Learn more about Gemini API quotas" url: "https://ai.google.dev/gemini-api/docs/rate-limits" } } } details { [type.googleapis.com/google.rpc.QuotaFailure] { violations { quota_metric: "generativelanguage.googleapis.com/generate_requests_per_model_per_day" quota_id: "GenerateRequestsPerDayPerProjectPerModel" } } } }]]

LLM Calls Summary:
Total Calls Total Tokens Avg Tokens Total Duration (Seconds) Avg Duration (Seconds)
Tool Calls Summary:
Total Calls Total Duration (Seconds) Avg Duration (Seconds)