syzbot

 sign-in | mailing list | source | docs
🐞 Open [1444]
≡ Subsystems
🐞 Fixed [6934]
🐞 Invalid [18062]
⬇ Missing Backports [223]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

KCSAN: data-race in dd_has_work / deadline_remove_request (3)

Status: auto-closed as invalid on 2021/01/11 08:35
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+56a486ff98c23ebd68f0@syzkaller.appspotmail.com
First crash: 1939d, last: 1903d
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in dd_has_work / deadline_remove_request block 6 2 2101d 2104d 0/29 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (8) block 6 8 1386d 1444d 0/29 auto-closed as invalid on 2022/06/12 02:20
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (4) block 6 1 1843d 1843d 0/29 auto-closed as invalid on 2021/03/12 01:36
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (7) block 6 8 1501d 1580d 0/29 auto-closed as invalid on 2022/02/16 12:39
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (5) block 6 2 1766d 1797d 0/29 auto-closed as invalid on 2021/05/27 11:41
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (2) block 6 10 1975d 2062d 0/29 auto-closed as invalid on 2020/10/31 03:43
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (6) block 6 7 1672d 1703d 0/29 auto-closed as invalid on 2021/09/03 05:59

Sample crash report:
==================================================================
BUG: KCSAN: data-race in dd_has_work / deadline_remove_request

write to 0xffff8881036e5ca8 of 8 bytes by task 25893 on cpu 1:
 __list_del include/linux/list.h:112 [inline]
 __list_del_entry include/linux/list.h:135 [inline]
 list_del_init include/linux/list.h:204 [inline]
 deadline_remove_request+0x6a/0x180 block/mq-deadline.c:113
 deadline_move_request block/mq-deadline.c:176 [inline]
 __dd_dispatch_request block/mq-deadline.c:365 [inline]
 dd_dispatch_request+0x690/0x730 block/mq-deadline.c:387
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:146 [inline]
 blk_mq_do_dispatch_sched+0x1df/0x610 block/blk-mq-sched.c:199
 __blk_mq_sched_dispatch_requests+0x1fd/0x2a0 block/blk-mq-sched.c:310
 blk_mq_sched_dispatch_requests+0x8f/0xf0 block/blk-mq-sched.c:341
 __blk_mq_run_hw_queue+0xee/0x1c0 block/blk-mq.c:1532
 __blk_mq_delay_run_hw_queue+0x17d/0x330 block/blk-mq.c:1609
 blk_mq_run_hw_queue+0x231/0x260 block/blk-mq.c:1662
 blk_mq_sched_insert_requests+0x144/0x210 block/blk-mq-sched.c:501
 blk_mq_flush_plug_list+0x2f5/0x400 block/blk-mq.c:1932
 blk_flush_plug_list+0x235/0x260 block/blk-core.c:1760
 blk_finish_plug+0x44/0x60 block/blk-core.c:1777
 __iomap_dio_rw+0x60f/0x9b0 fs/iomap/direct-io.c:539
 iomap_dio_rw+0x30/0x70 fs/iomap/direct-io.c:605
 ext4_dio_write_iter fs/ext4/file.c:552 [inline]
 ext4_file_write_iter+0xe06/0x1090 fs/ext4/file.c:662
 call_write_iter include/linux/fs.h:1903 [inline]
 do_iter_readv_writev+0x2cb/0x360 fs/read_write.c:740
 do_iter_write+0x112/0x4b0 fs/read_write.c:866
 vfs_iter_write+0x4c/0x70 fs/read_write.c:907
 iter_file_splice_write+0x42a/0x780 fs/splice.c:686
 do_splice_from fs/splice.c:764 [inline]
 direct_splice_actor+0x80/0xa0 fs/splice.c:933
 splice_direct_to_actor+0x345/0x650 fs/splice.c:888
 do_splice_direct+0xf5/0x170 fs/splice.c:976
 do_sendfile+0x5db/0xca0 fs/read_write.c:1257
 __do_sys_sendfile64 fs/read_write.c:1318 [inline]
 __se_sys_sendfile64 fs/read_write.c:1304 [inline]
 __x64_sys_sendfile64+0xf2/0x130 fs/read_write.c:1304
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8881036e5ca8 of 8 bytes by task 25910 on cpu 0:
 list_empty_careful include/linux/list.h:319 [inline]
 dd_has_work+0xfe/0x110 block/mq-deadline.c:590
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:135 [inline]
 blk_mq_do_dispatch_sched+0x138/0x610 block/blk-mq-sched.c:199
 __blk_mq_sched_dispatch_requests+0x1fd/0x2a0 block/blk-mq-sched.c:310
 blk_mq_sched_dispatch_requests+0x8f/0xf0 block/blk-mq-sched.c:341
 __blk_mq_run_hw_queue+0xee/0x1c0 block/blk-mq.c:1532
 __blk_mq_delay_run_hw_queue+0x17d/0x330 block/blk-mq.c:1609
 blk_mq_run_hw_queue+0x231/0x260 block/blk-mq.c:1662
 blk_mq_sched_insert_requests+0x144/0x210 block/blk-mq-sched.c:501
 blk_mq_flush_plug_list+0x2f5/0x400 block/blk-mq.c:1932
 blk_flush_plug_list+0x235/0x260 block/blk-core.c:1760
 blk_finish_plug+0x44/0x60 block/blk-core.c:1777
 __iomap_dio_rw+0x60f/0x9b0 fs/iomap/direct-io.c:539
 iomap_dio_rw+0x30/0x70 fs/iomap/direct-io.c:605
 ext4_dio_write_iter fs/ext4/file.c:552 [inline]
 ext4_file_write_iter+0xe06/0x1090 fs/ext4/file.c:662
 call_write_iter include/linux/fs.h:1903 [inline]
 do_iter_readv_writev+0x2cb/0x360 fs/read_write.c:740
 do_iter_write+0x112/0x4b0 fs/read_write.c:866
 vfs_iter_write+0x4c/0x70 fs/read_write.c:907
 iter_file_splice_write+0x42a/0x780 fs/splice.c:686
 do_splice_from fs/splice.c:764 [inline]
 direct_splice_actor+0x80/0xa0 fs/splice.c:933
 splice_direct_to_actor+0x345/0x650 fs/splice.c:888
 do_splice_direct+0xf5/0x170 fs/splice.c:976
 do_sendfile+0x5db/0xca0 fs/read_write.c:1257
 __do_sys_sendfile64 fs/read_write.c:1318 [inline]
 __se_sys_sendfile64 fs/read_write.c:1304 [inline]
 __x64_sys_sendfile64+0xf2/0x130 fs/read_write.c:1304
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 25910 Comm: syz-executor.5 Not tainted 5.10.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/12/07 08:34 upstream 0477e9288185 f80ce148 .config console log report info ci2-upstream-kcsan-gce
2020/11/30 04:20 upstream b65054597872 a0092f9d .config console log report info ci2-upstream-kcsan-gce
2020/11/22 22:02 upstream 68d3fa235fd8 0d27f508 .config console log report info ci2-upstream-kcsan-gce
2020/11/16 08:40 upstream 09162bc32c88 1bf9a662 .config console log report info ci2-upstream-kcsan-gce
2020/11/15 03:10 upstream e28c0d7c92c8 1bf9a662 .config console log report info ci2-upstream-kcsan-gce
2020/10/31 11:25 upstream 5fc6b075e165 8bc4594f .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.