syzbot


KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (9)

Status: moderation: reported on 2024/12/23 09:25
Subsystems: fs mm
[Documentation on labels]
Reported-by: syzbot+6e5620a42d170a5219cf@syzkaller.appspotmail.com
First crash: 3d14h, last: 3d14h
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (3) fs mm 2 1467d 1480d 0/28 auto-closed as invalid on 2021/01/24 22:24
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (7) fs mm 295 178d 385d 0/28 auto-obsoleted due to no activity on 2024/08/05 19:12
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (5) fs mm 3 1244d 1278d 0/28 auto-closed as invalid on 2021/09/04 14:56
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (4) fs mm 6 1322d 1421d 0/28 auto-closed as invalid on 2021/06/18 08:34
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (6) fs mm 17 1128d 1205d 0/28 auto-closed as invalid on 2021/12/29 06:33
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (8) mm fs 4 99d 140d 0/28 auto-obsoleted due to no activity on 2024/10/23 14:01
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (2) fs mm 3 1544d 1583d 0/28 auto-closed as invalid on 2020/11/08 10:33
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch mm fs 9 1686d 1845d 0/28 closed as invalid on 2020/06/18 14:24

Sample crash report:
[EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=e842c11c, mo2=0002]
System zones: 0-2, 18-18, 34-34
EXT4-fs error (device loop6): ext4_validate_block_bitmap:441: comm syz.6.4777: bg 0: block 248: padding at end of block bitmap is not set
EXT4-fs error (device loop6): ext4_acquire_dquot:6938: comm syz.6.4777: Failed to acquire dquot type 1
==================================================================
BUG: KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch

read-write to 0xffff8881020d2948 of 8 bytes by interrupt on cpu 1:
 percpu_counter_add_batch+0x120/0x140 lib/percpu_counter.c:107
 wb_stat_mod include/linux/backing-dev.h:66 [inline]
 __wb_writeout_add+0x45/0x1d0 mm/page-writeback.c:607
 __folio_end_writeback+0x20d/0x490 mm/page-writeback.c:3099
 folio_end_writeback+0x74/0x1f0 mm/filemap.c:1633
 ext4_finish_bio+0x476/0x8e0 fs/ext4/page-io.c:144
 ext4_end_bio+0x18c/0x2c0
 bio_endio+0x369/0x410 block/bio.c:1645
 blk_update_request+0x368/0x860 block/blk-mq.c:981
 blk_mq_end_request+0x26/0x50 block/blk-mq.c:1143
 lo_complete_rq+0xce/0x180 drivers/block/loop.c:386
 blk_complete_reqs block/blk-mq.c:1218 [inline]
 blk_done_softirq+0x74/0xb0 block/blk-mq.c:1223
 handle_softirqs+0xbf/0x280 kernel/softirq.c:561
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:950
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x1d1/0x210 kernel/kthread.c:389
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff8881020d2948 of 8 bytes by task 16583 on cpu 0:
 percpu_counter_read include/linux/percpu_counter.h:110 [inline]
 __wb_update_bandwidth+0x9b/0x5d0 mm/page-writeback.c:1548
 wb_update_bandwidth mm/page-writeback.c:1575 [inline]
 do_writepages+0x443/0x480 mm/page-writeback.c:2728
 __writeback_single_inode+0x89/0x850 fs/fs-writeback.c:1680
 writeback_single_inode+0x16c/0x3f0 fs/fs-writeback.c:1801
 write_inode_now+0xd2/0x100 fs/fs-writeback.c:2851
 iput_final fs/inode.c:1933 [inline]
 iput+0x362/0x5b0 fs/inode.c:1972
 ext4_process_orphan+0x1a9/0x1c0 fs/ext4/orphan.c:360
 ext4_orphan_cleanup+0x696/0x9e0 fs/ext4/orphan.c:474
 __ext4_fill_super fs/ext4/super.c:5610 [inline]
 ext4_fill_super+0x36bb/0x3a10 fs/ext4/super.c:5733
 get_tree_bdev_flags+0x29f/0x310 fs/super.c:1636
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5765
 vfs_get_tree+0x56/0x1e0 fs/super.c:1814
 do_new_mount+0x227/0x690 fs/namespace.c:3507
 path_mount+0x49b/0xb30 fs/namespace.c:3834
 do_mount fs/namespace.c:3847 [inline]
 __do_sys_mount fs/namespace.c:4057 [inline]
 __se_sys_mount+0x27c/0x2d0 fs/namespace.c:4034
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4034
 x64_sys_call+0x2c84/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000005b0 -> 0x00000000000005c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 16583 Comm: syz.6.4777 Not tainted 6.13.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
==================================================================
EXT4-fs (loop6): 1 truncate cleaned up
ext4 filesystem being mounted at /597/file0 supports timestamps until 2038-01-19 (0x7fffffff)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/12/23 09:25 upstream 4bbf9020becb b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch
* Struck through repros no longer work on HEAD.