syzbot

==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff8881023f4558 of 8 bytes by task 4967 on cpu 0:
 __mod_timer+0x5a1/0x840 kernel/time/timer.c:1126
 mod_timer+0x1f/0x30 kernel/time/timer.c:1195
 blk_add_timer+0x182/0x1a0 block/blk-timeout.c:164
 blk_mq_start_request+0x15b/0x3b0 block/blk-mq.c:1355
 scsi_queue_rq+0x1479/0x19a0 drivers/scsi/scsi_lib.c:1867
 blk_mq_dispatch_rq_list+0x2a3/0xf80 block/blk-mq.c:2118
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
 blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
 __blk_mq_sched_dispatch_requests+0x7e5/0xc60 block/blk-mq-sched.c:307
 blk_mq_sched_dispatch_requests+0x86/0x120 block/blk-mq-sched.c:329
 blk_mq_run_hw_queue+0x17e/0x220 block/blk-mq.c:2356
 blk_mq_dispatch_list+0x840/0xa10 arch/x86/include/asm/bitops.h:-1
 blk_mq_flush_plug_list+0x2d8/0x330 block/blk-mq.c:2965
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1220
 blk_finish_plug block/blk-core.c:1247 [inline]
 __submit_bio+0x2fc/0x4d0 block/blk-core.c:649
 __submit_bio_noacct_mq block/blk-core.c:722 [inline]
 submit_bio_noacct_nocheck+0x208/0x6a0 block/blk-core.c:751
 submit_bio_noacct+0x6c8/0x8f0 block/blk-core.c:874
 submit_bio+0x227/0x240 block/blk-core.c:916
 swap_read_folio_bdev_async mm/page_io.c:611 [inline]
 swap_read_folio+0x875/0xff0 mm/page_io.c:653
 swap_cluster_readahead+0x3c0/0x3e0 mm/swap_state.c:635
 swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
 do_swap_page+0x301/0x2430 mm/memory.c:4603
 handle_pte_fault mm/memory.c:6072 [inline]
 __handle_mm_fault mm/memory.c:6212 [inline]
 handle_mm_fault+0x9a5/0x2be0 mm/memory.c:6381
 do_user_addr_fault+0x3fe/0x1090 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
 __get_user_8+0x14/0x30 arch/x86/lib/getuser.S:100
 fetch_robust_entry kernel/futex/core.c:1138 [inline]
 exit_robust_list+0x31/0x280 kernel/futex/core.c:1166
 futex_cleanup kernel/futex/core.c:1410 [inline]
 futex_exit_release+0xe0/0x130 kernel/futex/core.c:1511
 exit_mm_release+0x1a/0x30 kernel/fork.c:1441
 exit_mm+0x38/0x190 kernel/exit.c:554
 do_exit+0x417/0x1590 kernel/exit.c:952
 do_group_exit+0xff/0x140 kernel/exit.c:1105
 get_signal+0xe59/0xf70 kernel/signal.c:3034
 arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x7a/0x100 kernel/entry/common.c:111
 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
 do_syscall_64+0x1d6/0x200 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881023f4558 of 8 bytes by task 3319 on cpu 1:
 blk_add_timer+0x115/0x1a0 block/blk-timeout.c:-1
 blk_mq_start_request+0x15b/0x3b0 block/blk-mq.c:1355
 scsi_queue_rq+0x1479/0x19a0 drivers/scsi/scsi_lib.c:1867
 blk_mq_dispatch_rq_list+0x2a3/0xf80 block/blk-mq.c:2118
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
 blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
 __blk_mq_sched_dispatch_requests+0x7e5/0xc60 block/blk-mq-sched.c:307
 blk_mq_sched_dispatch_requests+0x86/0x120 block/blk-mq-sched.c:329
 blk_mq_run_hw_queue+0x17e/0x220 block/blk-mq.c:2356
 blk_mq_dispatch_list+0x840/0xa10 arch/x86/include/asm/bitops.h:-1
 blk_mq_flush_plug_list+0x2d8/0x330 block/blk-mq.c:2965
 __blk_flush_plug+0x222/0x2a0 block/blk-core.c:1220
 blk_finish_plug block/blk-core.c:1247 [inline]
 __submit_bio+0x2fc/0x4d0 block/blk-core.c:649
 __submit_bio_noacct_mq block/blk-core.c:722 [inline]
 submit_bio_noacct_nocheck+0x208/0x6a0 block/blk-core.c:751
 submit_bio_noacct+0x6c8/0x8f0 block/blk-core.c:874
 submit_bio+0x227/0x240 block/blk-core.c:916
 swap_read_folio_bdev_async mm/page_io.c:611 [inline]
 swap_read_folio+0x875/0xff0 mm/page_io.c:653
 swap_cluster_readahead+0x3c0/0x3e0 mm/swap_state.c:635
 swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
 do_swap_page+0x301/0x2430 mm/memory.c:4603
 handle_pte_fault mm/memory.c:6072 [inline]
 __handle_mm_fault mm/memory.c:6212 [inline]
 handle_mm_fault+0x9a5/0x2be0 mm/memory.c:6381
 do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00000000ffffa778 -> 0x00000000ffffaa21

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3319 Comm: syz-executor Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================