syzbot


KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each (4)

Status: auto-obsoleted due to no activity on 2024/04/11 08:13
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+b0c991a6dcf9c3718ec5@syzkaller.appspotmail.com
First crash: 72d, last: 38d
Similar bugs (3)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each (3) block 2 135d 126d 0/26 auto-obsoleted due to no activity on 2024/01/05 10:53
upstream KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each (2) block 19 183d 302d 0/26 auto-obsoleted due to no activity on 2023/11/18 09:13
upstream KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each block 9 356d 434d 0/26 auto-obsoleted due to no activity on 2023/05/29 14:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each

write to 0xffff888102c7ea20 of 4 bytes by task 44 on cpu 1:
 __blk_mq_put_driver_tag block/blk-mq.h:339 [inline]
 blk_mq_put_driver_tag block/blk-mq.h:347 [inline]
 __blk_mq_requeue_request+0x130/0x2a0 block/blk-mq.c:1437
 blk_mq_handle_dev_resource block/blk-mq.c:1938 [inline]
 blk_mq_dispatch_rq_list+0x860/0x10a0 block/blk-mq.c:2079
 __blk_mq_sched_dispatch_requests+0x1ce/0xd20 block/blk-mq-sched.c:301
 blk_mq_sched_dispatch_requests+0x78/0xe0 block/blk-mq-sched.c:331
 blk_mq_run_work_fn+0x65/0xe0 block/blk-mq.c:2455
 process_one_work kernel/workqueue.c:2633 [inline]
 process_scheduled_works+0x5b8/0xa40 kernel/workqueue.c:2706
 worker_thread+0x525/0x730 kernel/workqueue.c:2787
 kthread+0x1d7/0x210 kernel/kthread.c:388
 ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:243

read to 0xffff888102c7ea20 of 4 bytes by task 29091 on cpu 0:
 blk_mq_find_and_get_req block/blk-mq-tag.c:260 [inline]
 bt_tags_iter block/blk-mq-tag.c:356 [inline]
 __sbitmap_for_each_set include/linux/sbitmap.h:281 [inline]
 sbitmap_for_each_set include/linux/sbitmap.h:302 [inline]
 bt_tags_for_each+0x2e2/0x500 block/blk-mq-tag.c:391
 __blk_mq_all_tag_iter block/blk-mq-tag.c:402 [inline]
 blk_mq_tagset_busy_iter+0x114/0x150 block/blk-mq-tag.c:446
 scsi_host_busy+0x4f/0x80 drivers/scsi/hosts.c:604
 scsi_host_queue_ready drivers/scsi/scsi_lib.c:1343 [inline]
 scsi_queue_rq+0x2f3/0x1a00 drivers/scsi/scsi_lib.c:1737
 blk_mq_dispatch_rq_list+0x2d9/0x10a0 block/blk-mq.c:2070
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:170 [inline]
 blk_mq_do_dispatch_sched block/blk-mq-sched.c:184 [inline]
 __blk_mq_sched_dispatch_requests+0x5ec/0xd20 block/blk-mq-sched.c:309
 blk_mq_sched_dispatch_requests+0x78/0xe0 block/blk-mq-sched.c:331
 blk_mq_run_hw_queue+0x298/0x4c0 block/blk-mq.c:2285
 blk_mq_get_tag+0x479/0x590 block/blk-mq-tag.c:170
 __blk_mq_alloc_requests+0x63c/0xa40 block/blk-mq.c:500
 blk_mq_get_new_requests block/blk-mq.c:2905 [inline]
 blk_mq_submit_bio+0x417/0xe30 block/blk-mq.c:3001
 __submit_bio+0x11c/0x350 block/blk-core.c:608
 __submit_bio_noacct_mq block/blk-core.c:687 [inline]
 submit_bio_noacct_nocheck+0x4ad/0x5e0 block/blk-core.c:716
 submit_bio_noacct+0x67d/0x830 block/blk-core.c:826
 submit_bio+0x212/0x220 block/blk-core.c:868
 iomap_dio_submit_bio fs/iomap/direct-io.c:80 [inline]
 iomap_dio_bio_iter+0xa4a/0xbe0 fs/iomap/direct-io.c:417
 __iomap_dio_rw+0x8dd/0x1090 fs/iomap/direct-io.c:659
 iomap_dio_rw+0x40/0x90 fs/iomap/direct-io.c:748
 ext4_dio_write_iter fs/ext4/file.c:577 [inline]
 ext4_file_write_iter+0xa8a/0xe10 fs/ext4/file.c:696
 call_write_iter include/linux/fs.h:2087 [inline]
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x760/0x8d0 fs/read_write.c:590
 ksys_write+0xeb/0x1a0 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __x64_sys_write+0x42/0x50 fs/read_write.c:652
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

value changed: 0x00001395 -> 0x0000139f

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 29091 Comm: syz-executor.1 Not tainted 6.8.0-rc7-syzkaller-00051-g67be068d31d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
==================================================================
syz-executor.1 (29091) used greatest stack depth: 9624 bytes left

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/07 08:12 upstream 67be068d31d4 f39a7eed .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each
2024/03/01 17:29 upstream 87adedeba51a 83acf9e0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each
2024/02/02 09:31 upstream 5c24e4e9e708 d61103fc .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __blk_mq_requeue_request / bt_tags_for_each
* Struck through repros no longer work on HEAD.