syzbot


KCSAN: data-race in __mod_timer / blk_add_timer (11)

Status: moderation: reported on 2025/03/24 02:05
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+46b780997d6c7011532b@syzkaller.appspotmail.com
First crash: 31d, last: 4d08h
Similar bugs (10)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __mod_timer / blk_add_timer (6) block 1 750d 731d 0/28 auto-obsoleted due to no activity on 2023/05/09 08:21
upstream KCSAN: data-race in __mod_timer / blk_add_timer (10) block 1 92d 86d 0/28 auto-obsoleted due to no activity on 2025/03/19 05:59
upstream KCSAN: data-race in __mod_timer / blk_add_timer block 2 1434d 1468d 0/28 auto-closed as invalid on 2021/06/25 00:11
upstream KCSAN: data-race in __mod_timer / blk_add_timer (3) block 8 1209d 1307d 0/28 auto-closed as invalid on 2022/02/04 22:18
upstream KCSAN: data-race in __mod_timer / blk_add_timer (2) block 2 1359d 1389d 0/28 auto-closed as invalid on 2021/09/07 18:24
upstream KCSAN: data-race in __mod_timer / blk_add_timer (4) block 2 1116d 1135d 0/28 auto-closed as invalid on 2022/05/08 11:46
upstream KCSAN: data-race in __mod_timer / blk_add_timer (7) block 2 670d 687d 0/28 auto-obsoleted due to no activity on 2023/07/28 08:54
upstream KCSAN: data-race in __mod_timer / blk_add_timer (5) block 1 972d 972d 0/28 auto-closed as invalid on 2022/09/29 13:43
upstream KCSAN: data-race in __mod_timer / blk_add_timer (9) block 1 313d 313d 0/28 auto-obsoleted due to no activity on 2024/07/19 18:23
upstream KCSAN: data-race in __mod_timer / blk_add_timer (8) block 7 463d 501d 0/28 auto-obsoleted due to no activity on 2024/02/20 17:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff8881021c8908 of 8 bytes by task 4815 on cpu 0:
 __mod_timer+0x57f/0x820 kernel/time/timer.c:1168
 mod_timer+0x1f/0x30 kernel/time/timer.c:1237
 blk_add_timer+0x181/0x190 block/blk-timeout.c:164
 blk_mq_start_request+0x185/0x3b0 block/blk-mq.c:1351
 loop_queue_rq+0x44/0x670 drivers/block/loop.c:1803
 __blk_mq_issue_directly block/blk-mq.c:2691 [inline]
 blk_mq_request_issue_directly+0x1dc/0x390 block/blk-mq.c:2778
 blk_mq_plug_issue_direct+0x1ad/0x570 block/blk-mq.c:2799
 blk_mq_flush_plug_list+0x2bd/0xf10 block/blk-mq.c:2910
 __blk_flush_plug+0x21f/0x2a0 block/blk-core.c:1220
 blk_finish_plug block/blk-core.c:1247 [inline]
 __submit_bio+0x310/0x510 block/blk-core.c:649
 __submit_bio_noacct_mq block/blk-core.c:722 [inline]
 submit_bio_noacct_nocheck+0x290/0x6f0 block/blk-core.c:751
 submit_bio_noacct+0x6e1/0x930 block/blk-core.c:874
 submit_bio+0x218/0x230 block/blk-core.c:916
 submit_bh_wbc+0x2ed/0x330 fs/buffer.c:2796
 submit_bh+0x1e/0x30 fs/buffer.c:2801
 __ext4_read_bh fs/ext4/super.c:180 [inline]
 ext4_read_bh+0x136/0x1b0 fs/ext4/super.c:205
 ext4_read_bh_lock fs/ext4/super.c:220 [inline]
 __ext4_sb_bread_gfp+0x141/0x180 fs/ext4/super.c:242
 ext4_sb_bread_unmovable fs/ext4/super.c:265 [inline]
 ext4_load_super fs/ext4/super.c:5060 [inline]
 __ext4_fill_super fs/ext4/super.c:5264 [inline]
 ext4_fill_super+0x47b/0x3580 fs/ext4/super.c:5726
 get_tree_bdev_flags+0x2b4/0x330 fs/super.c:1636
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5758
 vfs_get_tree+0x56/0x1e0 fs/super.c:1759
 do_new_mount+0x246/0x6b0 fs/namespace.c:3881
 path_mount+0x49b/0xb30 fs/namespace.c:4208
 do_mount fs/namespace.c:4221 [inline]
 __do_sys_mount fs/namespace.c:4432 [inline]
 __se_sys_mount+0x28f/0x2e0 fs/namespace.c:4409
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4409
 x64_sys_call+0xd11/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881021c8908 of 8 bytes by task 3532 on cpu 1:
 blk_add_timer+0x115/0x190 block/blk-timeout.c:-1
 blk_mq_start_request+0x185/0x3b0 block/blk-mq.c:1351
 loop_queue_rq+0x44/0x670 drivers/block/loop.c:1803
 __blk_mq_issue_directly block/blk-mq.c:2691 [inline]
 blk_mq_request_issue_directly+0x1dc/0x390 block/blk-mq.c:2778
 blk_mq_plug_issue_direct+0x1ad/0x570 block/blk-mq.c:2799
 blk_mq_flush_plug_list+0x2bd/0xf10 block/blk-mq.c:2910
 __blk_flush_plug+0x21f/0x2a0 block/blk-core.c:1220
 blk_finish_plug+0x48/0x70 block/blk-core.c:1247
 read_pages+0x3ee/0x470 mm/readahead.c:173
 page_cache_ra_unbounded+0x30d/0x350 mm/readahead.c:297
 do_page_cache_ra mm/readahead.c:327 [inline]
 force_page_cache_ra mm/readahead.c:356 [inline]
 page_cache_sync_ra+0x252/0x680 mm/readahead.c:575
 filemap_get_pages+0x2ba/0x11b0 mm/filemap.c:2591
 filemap_read+0x231/0x8d0 mm/filemap.c:2702
 blkdev_read_iter+0x227/0x2d0 block/fops.c:796
 new_sync_read fs/read_write.c:489 [inline]
 vfs_read+0x5e6/0x710 fs/read_write.c:570
 ksys_read+0xeb/0x1b0 fs/read_write.c:713
 __do_sys_read fs/read_write.c:722 [inline]
 __se_sys_read fs/read_write.c:720 [inline]
 __x64_sys_read+0x42/0x50 fs/read_write.c:720
 x64_sys_call+0x2a3b/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:1
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000ffff9bb9 -> 0x00000000ffff9e34

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3532 Comm: udevd Not tainted 6.15.0-rc2-syzkaller-00404-g8560697b23dc #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/19 23:29 upstream 8560697b23dc 2a20f901 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __mod_timer / blk_add_timer
2025/03/24 02:05 upstream 586de92313fc 875573af .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __mod_timer / blk_add_timer
* Struck through repros no longer work on HEAD.