syzbot


KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (9)

Status: moderation: reported on 2024/12/23 09:25
Subsystems: mm fs
[Documentation on labels]
Reported-by: syzbot+6e5620a42d170a5219cf@syzkaller.appspotmail.com
First crash: 95d, last: 34d
Similar bugs (8)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (3) fs mm 2 1558d 1572d 0/28 auto-closed as invalid on 2021/01/24 22:24
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (7) fs mm 295 269d 477d 0/28 auto-obsoleted due to no activity on 2024/08/05 19:12
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (5) fs mm 3 1336d 1369d 0/28 auto-closed as invalid on 2021/09/04 14:56
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (4) fs mm 6 1414d 1513d 0/28 auto-closed as invalid on 2021/06/18 08:34
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (6) fs mm 17 1220d 1296d 0/28 auto-closed as invalid on 2021/12/29 06:33
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (8) mm fs 4 191d 232d 0/28 auto-obsoleted due to no activity on 2024/10/23 14:01
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch (2) fs mm 3 1636d 1675d 0/28 auto-closed as invalid on 2020/11/08 10:33
upstream KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch mm fs 9 1778d 1937d 0/28 closed as invalid on 2020/06/18 14:24

Sample crash report:
loop8: detected capacity change from 0 to 512
EXT4-fs (loop8): encrypted files will use data=ordered instead of data journaling mode
==================================================================
BUG: KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch

read-write to 0xffff888100fbf148 of 8 bytes by interrupt on cpu 0:
 percpu_counter_add_batch+0x120/0x140 lib/percpu_counter.c:107
 wb_stat_mod include/linux/backing-dev.h:66 [inline]
 __wb_writeout_add+0x45/0x1d0 mm/page-writeback.c:607
 __folio_end_writeback+0x20d/0x490 mm/page-writeback.c:3084
 folio_end_writeback+0xca/0x3c0 mm/filemap.c:1649
 ext4_finish_bio+0x476/0x8e0 fs/ext4/page-io.c:144
 ext4_end_bio+0x18c/0x2c0
 bio_endio+0x369/0x410 block/bio.c:1548
 blk_update_request+0x368/0x860 block/blk-mq.c:983
 blk_mq_end_request+0x26/0x50 block/blk-mq.c:1145
 lo_complete_rq+0xce/0x180 drivers/block/loop.c:395
 blk_complete_reqs block/blk-mq.c:1220 [inline]
 blk_done_softirq+0x74/0xb0 block/blk-mq.c:1225
 handle_softirqs+0xbf/0x280 kernel/softirq.c:561
 run_ksoftirqd+0x1c/0x30 kernel/softirq.c:950
 smpboot_thread_fn+0x31c/0x4c0 kernel/smpboot.c:164
 kthread+0x4ae/0x520 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

read to 0xffff888100fbf148 of 8 bytes by task 6442 on cpu 1:
 percpu_counter_read include/linux/percpu_counter.h:110 [inline]
 __wb_update_bandwidth+0x9b/0x5d0 mm/page-writeback.c:1533
 wb_update_bandwidth mm/page-writeback.c:1560 [inline]
 do_writepages+0x443/0x480 mm/page-writeback.c:2713
 __writeback_single_inode+0x89/0x850 fs/fs-writeback.c:1680
 writeback_single_inode+0x16c/0x3f0 fs/fs-writeback.c:1801
 write_inode_now+0xd2/0x100 fs/fs-writeback.c:2851
 iput_final fs/inode.c:1933 [inline]
 iput+0x362/0x5b0 fs/inode.c:1972
 ext4_process_orphan+0x1a9/0x1c0 fs/ext4/orphan.c:360
 ext4_orphan_cleanup+0x696/0x9e0 fs/ext4/orphan.c:474
 __ext4_fill_super fs/ext4/super.c:5602 [inline]
 ext4_fill_super+0x32ec/0x3630 fs/ext4/super.c:5722
 get_tree_bdev_flags+0x29f/0x310 fs/super.c:1636
 get_tree_bdev+0x1f/0x30 fs/super.c:1659
 ext4_get_tree+0x1c/0x30 fs/ext4/super.c:5754
 vfs_get_tree+0x56/0x1e0 fs/super.c:1814
 do_new_mount+0x227/0x690 fs/namespace.c:3560
 path_mount+0x49b/0xb30 fs/namespace.c:3887
 do_mount fs/namespace.c:3900 [inline]
 __do_sys_mount fs/namespace.c:4111 [inline]
 __se_sys_mount+0x27f/0x2d0 fs/namespace.c:4088
 __x64_sys_mount+0x67/0x80 fs/namespace.c:4088
 x64_sys_call+0x2c84/0x2dc0 arch/x86/include/generated/asm/syscalls_64.h:166
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000000000013b0 -> 0x00000000000013c0

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6442 Comm: syz.8.19478 Tainted: G        W          6.14.0-rc3-syzkaller-00213-g8a61cb6e150e #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
==================================================================
EXT4-fs (loop8): 1 orphan inode deleted
EXT4-fs (loop8): 1 truncate cleaned up
EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
EXT4-fs error (device loop8): ext4_inlinedir_to_tree:1404: inode #12: block 7: comm syz.8.19478: path /496/bus/file0: bad entry in directory: directory entry overrun - offset=788, inode=13, rec_len=784, size=60 fake=0
EXT4-fs (loop8): Remounting filesystem read-only

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/02/21 23:29 upstream 8a61cb6e150e d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch
2025/01/20 06:42 upstream 9528d418de4d f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch
2024/12/31 02:28 upstream ccb98ccef0e5 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch
2024/12/23 09:25 upstream 4bbf9020becb b4fbdbd4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __wb_update_bandwidth / percpu_counter_add_batch
* Struck through repros no longer work on HEAD.