KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared

Status: moderation: reported on 2026/09/10 11:02
Subsystems: block
Labels: race:benign prio:high
[Documentation on labels]
Reported-by: syzbot+10ab08c960e5502d0e8d@syzkaller.appspotmail.com
First crash: 37d, last: 13d
▶ ▼ ✨ AI Jobs (4)
ID Workflow Result Correct Bug Created Started Finished Revision
8d08cb38 repro-c 💥 KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared 2026/09/28 05:25 2026/09/28 05:25 2026/09/28 05:54 a3c7249d
4932452f repro-c 💥 KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared 2026/09/26 17:30 2026/09/26 17:30 2026/09/26 18:23 a3c7249d
5fcc11e6 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ✅ VMHostTrigger: ❌ ❓ KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared 2026/09/12 00:00 2026/09/12 00:00 2026/09/12 00:32 6816f32e
60faef65 assessment-kcsan Benign: ✅ ❓ KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared 2026/09/10 11:01 2026/09/10 11:02 2026/09/10 11:37 1fe56c0a

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared

read-write to 0xffff888102279144 of 4 bytes by task 23039 on cpu 0:
 __blk_mq_unfreeze_queue block/blk-mq.c:218 [inline]
 blk_mq_unfreeze_queue_nomemrestore block/blk-mq.c:232 [inline]
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 blk_mq_update_tag_set_shared+0xa9/0x170 block/blk-mq.c:4321
 blk_mq_add_queue_tag_set block/blk-mq.c:4352 [inline]
 blk_mq_init_allocated_queue+0x75d/0x910 block/blk-mq.c:4672
 blk_mq_alloc_queue+0xd8/0x130 block/blk-mq.c:4435
 scsi_alloc_sdev+0x3e3/0x5f0 drivers/scsi/scsi_scan.c:339
 scsi_probe_and_add_lun+0xa3/0x2030 drivers/scsi/scsi_scan.c:1228
 __scsi_scan_target+0x143/0x7f0 drivers/scsi/scsi_scan.c:1805
 scsi_scan_channel drivers/scsi/scsi_scan.c:1895 [inline]
 scsi_scan_host_selected+0x2ba/0x3f0 drivers/scsi/scsi_scan.c:1924
 scsi_scan drivers/scsi/scsi_sysfs.c:151 [inline]
 store_scan+0x371/0x3c0 drivers/scsi/scsi_sysfs.c:191
 dev_attr_store+0x4a/0x70 drivers/base/core.c:2509
 sysfs_kf_write+0xfe/0x120 fs/sysfs/file.c:145
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888102279144 of 4 bytes by task 23176 on cpu 1:
 __bio_queue_enter+0x279/0x580 block/blk-core.c:397
 bio_queue_enter block/blk.h:99 [inline]
 blk_mq_submit_bio+0x195/0x1220 block/blk-mq.c:3138
 __submit_bio+0x54/0x3d0 block/blk-core.c:673
 __submit_bio_noacct_mq block/blk-core.c:756 [inline]
 submit_bio_noacct_nocheck+0x153/0x620 block/blk-core.c:790
 submit_bio_noacct+0x760/0x980 block/blk-core.c:925
 submit_bio+0x2a4/0x2c0 block/blk-core.c:966
 swap_bdev_submit_write+0x31b/0x450 mm/page_io.c:606
 swap_write_submit+0x60/0x80 mm/page_io.c:689
 shrink_folio_list+0x26b1/0x26f0 mm/vmscan.c:1585
 evict_folios+0x1c6e/0x2830 mm/vmscan.c:4910
 try_to_shrink_lruvec+0x8fd/0xb30 mm/vmscan.c:5076
 lru_gen_shrink_lruvec mm/vmscan.c:5221 [inline]
 shrink_lruvec+0x252/0x1d40 mm/vmscan.c:5981
 shrink_node_memcgs mm/vmscan.c:6220 [inline]
 shrink_node+0x67c/0x2000 mm/vmscan.c:6264
 shrink_zones mm/vmscan.c:6503 [inline]
 do_try_to_free_pages+0x408/0xca0 mm/vmscan.c:6565
 try_to_free_mem_cgroup_pages+0x201/0x420 mm/vmscan.c:6887
 mem_cgroup_resize_max+0x13d/0x290 mm/memcontrol-v1.c:1816
 mem_cgroup_write+0x132/0x1c0 mm/memcontrol-v1.c:-1
 cgroup_file_write+0x197/0x350 kernel/cgroup/cgroup.c:4412
 kernfs_fop_write_iter+0x1d2/0x2e0 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x57f/0x9a0 fs/read_write.c:687
 ksys_write+0xdc/0x1a0 fs/read_write.c:739
 __do_sys_write fs/read_write.c:750 [inline]
 __se_sys_write fs/read_write.c:747 [inline]
 __x64_sys_write+0x40/0x50 fs/read_write.c:747
 x64_sys_call+0x154e/0x2550 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x112/0x360 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 23176 Comm: syz.6.4233 Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/03 17:30 upstream e767a4ea70a3 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared
2026/09/10 11:01 upstream 50d05c7c76c9 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bio_queue_enter / blk_mq_update_tag_set_shared
* Struck through repros no longer work on HEAD.