syzbot


KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (7)

Status: auto-obsoleted due to no activity on 2024/10/25 05:49
Subsystems: block trace
[Documentation on labels]
Reported-by: syzbot+73d3376333e4f2afe5a2@syzkaller.appspotmail.com
First crash: 92d, last: 92d
Similar bugs (7)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (6) trace block 65 173d 378d 0/28 auto-obsoleted due to no activity on 2024/08/04 19:00
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (2) block trace 3 1503d 1475d 0/28 auto-closed as invalid on 2020/12/21 11:49
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (4) block trace 11 854d 1007d 0/28 auto-closed as invalid on 2022/09/24 02:55
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (3) block trace 6 1055d 1143d 0/28 auto-closed as invalid on 2022/03/06 18:39
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (5) block trace 19 704d 797d 0/28 auto-obsoleted due to no activity on 2023/04/10 19:57
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (8) block trace 4 10h03m 7d16h 0/28 moderation: reported on 2024/12/13 19:16
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf trace block 17 1783d 1879d 0/28 auto-closed as invalid on 2020/04/13 07:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf

write to 0xffff888115db1438 of 8 bytes by task 20391 on cpu 0:
 relay_switch_subbuf+0x39e/0x3b0 kernel/relay.c:708
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x66a/0x730 kernel/trace/blktrace.c:276
 blk_add_trace_plug+0x4c/0x70 kernel/trace/blktrace.c:949
 trace_block_plug include/trace/events/block.h:430 [inline]
 blk_add_rq_to_plug+0x323/0x3d0 block/blk-mq.c:1288
 blk_mq_submit_bio+0xa7e/0xe70 block/blk-mq.c:3030
 __submit_bio+0xf2/0x470 block/blk-core.c:615
 __submit_bio_noacct_mq block/blk-core.c:696 [inline]
 submit_bio_noacct_nocheck+0x295/0x6e0 block/blk-core.c:725
 submit_bio_noacct+0x766/0x9a0 block/blk-core.c:854
 submit_bio+0x218/0x230 block/blk-core.c:896
 ext4_io_submit+0x8a/0xb0 fs/ext4/page-io.c:377
 ext4_do_writepages+0xb3a/0x2110 fs/ext4/inode.c:2771
 ext4_writepages+0x159/0x2e0 fs/ext4/inode.c:2840
 do_writepages+0x1d8/0x480 mm/page-writeback.c:2683
 filemap_fdatawrite_wbc+0xdb/0x100 mm/filemap.c:397
 __filemap_fdatawrite_range mm/filemap.c:430 [inline]
 file_write_and_wait_range+0xc2/0x170 mm/filemap.c:788
 generic_buffers_fsync_noflush+0x46/0x120 fs/buffer.c:600
 ext4_fsync_nojournal fs/ext4/fsync.c:88 [inline]
 ext4_sync_file+0x1ff/0x6c0 fs/ext4/fsync.c:151
 vfs_fsync_range+0x116/0x130 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2870 [inline]
 ext4_buffered_write_iter+0x326/0x370 fs/ext4/file.c:305
 ext4_file_write_iter+0x293/0xe10
 iter_file_splice_write+0x5f1/0x980 fs/splice.c:743
 do_splice_from fs/splice.c:941 [inline]
 direct_splice_actor+0x160/0x2c0 fs/splice.c:1164
 splice_direct_to_actor+0x302/0x670 fs/splice.c:1108
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0xd7/0x150 fs/splice.c:1233
 do_sendfile+0x39b/0x970 fs/read_write.c:1388
 __do_sys_sendfile64 fs/read_write.c:1455 [inline]
 __se_sys_sendfile64 fs/read_write.c:1441 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1441
 x64_sys_call+0xed5/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

write to 0xffff888115db1438 of 8 bytes by task 20400 on cpu 1:
 relay_switch_subbuf+0x39e/0x3b0 kernel/relay.c:708
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x66a/0x730 kernel/trace/blktrace.c:276
 blk_add_trace_bio kernel/trace/blktrace.c:902 [inline]
 blk_add_trace_getrq+0x130/0x140 kernel/trace/blktrace.c:939
 trace_block_getrq include/trace/events/block.h:417 [inline]
 blk_mq_submit_bio+0xe0c/0xe70 block/blk-mq.c:3009
 __submit_bio+0xf2/0x470 block/blk-core.c:615
 __submit_bio_noacct_mq block/blk-core.c:696 [inline]
 submit_bio_noacct_nocheck+0x295/0x6e0 block/blk-core.c:725
 submit_bio_noacct+0x766/0x9a0 block/blk-core.c:854
 submit_bio+0x218/0x230 block/blk-core.c:896
 submit_bio_wait+0x87/0xd0 block/bio.c:1454
 blkdev_issue_flush+0x53/0x80 block/blk-flush.c:473
 ext4_sync_file+0x4bf/0x6c0 fs/ext4/fsync.c:171
 vfs_fsync_range+0x116/0x130 fs/sync.c:188
 generic_write_sync include/linux/fs.h:2870 [inline]
 ext4_buffered_write_iter+0x326/0x370 fs/ext4/file.c:305
 ext4_file_write_iter+0x293/0xe10
 iter_file_splice_write+0x5f1/0x980 fs/splice.c:743
 do_splice_from fs/splice.c:941 [inline]
 direct_splice_actor+0x160/0x2c0 fs/splice.c:1164
 splice_direct_to_actor+0x302/0x670 fs/splice.c:1108
 do_splice_direct_actor fs/splice.c:1207 [inline]
 do_splice_direct+0xd7/0x150 fs/splice.c:1233
 do_sendfile+0x39b/0x970 fs/read_write.c:1388
 __do_sys_sendfile64 fs/read_write.c:1455 [inline]
 __se_sys_sendfile64 fs/read_write.c:1441 [inline]
 __x64_sys_sendfile64+0x110/0x150 fs/read_write.c:1441
 x64_sys_call+0xed5/0x2d60 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xc9/0x1c0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x0000000000000030 -> 0x0000000000000038

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 20400 Comm: syz.3.5460 Tainted: G        W          6.11.0-syzkaller-07337-g2004cef11ea0 #0
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/09/20 05:48 upstream 2004cef11ea0 6f888b75 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
* Struck through repros no longer work on HEAD.