syzbot


KCSAN: data-race in dd_has_work / deadline_remove_request (8)

Status: auto-closed as invalid on 2022/06/12 02:20
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 329d, last: 271d
similar bugs (7):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in dd_has_work / deadline_remove_request 2 986d 989d 0/24 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (4) 1 728d 728d 0/24 auto-closed as invalid on 2021/03/12 01:36
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (7) 8 387d 465d 0/24 auto-closed as invalid on 2022/02/16 12:39
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (5) 2 652d 682d 0/24 auto-closed as invalid on 2021/05/27 11:41
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (2) 10 860d 947d 0/24 auto-closed as invalid on 2020/10/31 03:43
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (3) 6 788d 788d 0/24 auto-closed as invalid on 2021/01/11 08:35
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (6) 7 557d 588d 0/24 auto-closed as invalid on 2021/09/03 05:59

Sample crash report:
==================================================================
BUG: KCSAN: data-race in dd_has_work / deadline_remove_request

write to 0xffff88810351b888 of 8 bytes by task 20757 on cpu 0:
 __list_del include/linux/list.h:114 [inline]
 __list_del_entry include/linux/list.h:137 [inline]
 list_del_init include/linux/list.h:206 [inline]
 deadline_remove_request+0x58/0x190 block/mq-deadline.c:173
 deadline_move_request block/mq-deadline.c:249 [inline]
 __dd_dispatch_request+0x411/0x4a0 block/mq-deadline.c:465
 dd_dispatch_request+0x1d0/0x2b0 block/mq-deadline.c:531
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:121 [inline]
 blk_mq_do_dispatch_sched+0x201/0x780 block/blk-mq-sched.c:187
 __blk_mq_sched_dispatch_requests+0x1ca/0x270
 blk_mq_sched_dispatch_requests+0x8f/0xf0 block/blk-mq-sched.c:339
 __blk_mq_run_hw_queue+0x7e/0x100 block/blk-mq.c:1974
 __blk_mq_delay_run_hw_queue+0x194/0x390 block/blk-mq.c:2051
 blk_mq_run_hw_queue+0x180/0x310 block/blk-mq.c:2102
 blk_mq_sched_insert_requests+0x1cb/0x2a0 block/blk-mq-sched.c:493
 blk_mq_dispatch_plug_list+0x1e9/0x2c0 block/blk-mq.c:2597
 blk_mq_flush_plug_list+0x2ea/0x340 block/blk-mq.c:2639
 __blk_flush_plug+0x25a/0x2b0 block/blk-core.c:1240
 blk_finish_plug+0x44/0x60 block/blk-core.c:1264
 read_pages+0x759/0x7c0 mm/readahead.c:179
 page_cache_ra_unbounded+0x2a8/0x2e0 mm/readahead.c:261
 do_page_cache_ra mm/readahead.c:291 [inline]
 page_cache_ra_order mm/readahead.c:546 [inline]
 ondemand_readahead+0x5df/0x780 mm/readahead.c:668
 page_cache_sync_ra+0x1a4/0x1b0 mm/readahead.c:695
 page_cache_sync_readahead include/linux/pagemap.h:1185 [inline]
 filemap_get_pages mm/filemap.c:2592 [inline]
 filemap_read+0x3e5/0x1400 mm/filemap.c:2679
 generic_file_read_iter+0x72/0x320 mm/filemap.c:2825
 call_read_iter include/linux/fs.h:2044 [inline]
 generic_file_splice_read+0x1de/0x2c0 fs/splice.c:311
 do_splice_to fs/splice.c:796 [inline]
 splice_direct_to_actor+0x2ac/0x660 fs/splice.c:870
 do_splice_direct+0xfb/0x180 fs/splice.c:979
 do_sendfile+0x3ad/0x900 fs/read_write.c:1246
 __do_sys_sendfile64 fs/read_write.c:1311 [inline]
 __se_sys_sendfile64 fs/read_write.c:1297 [inline]
 __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1297
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810351b888 of 8 bytes by task 73 on cpu 1:
 list_empty_careful include/linux/list.h:329 [inline]
 dd_has_work_for_prio block/mq-deadline.c:836 [inline]
 dd_has_work+0x144/0x260 block/mq-deadline.c:846
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:109 [inline]
 blk_mq_do_dispatch_sched+0x148/0x780 block/blk-mq-sched.c:187
 __blk_mq_sched_dispatch_requests+0x1ca/0x270
 blk_mq_sched_dispatch_requests+0x8f/0xf0 block/blk-mq-sched.c:339
 __blk_mq_run_hw_queue+0x7e/0x100 block/blk-mq.c:1974
 __blk_mq_delay_run_hw_queue+0x194/0x390 block/blk-mq.c:2051
 blk_mq_run_hw_queue+0x180/0x310 block/blk-mq.c:2102
 blk_mq_run_hw_queues+0x1c0/0x240 block/blk-mq.c:2165
 blk_mq_requeue_work+0x3cd/0x400 block/blk-mq.c:1315
 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289
 worker_thread+0x618/0xa70 kernel/workqueue.c:2436
 kthread+0x1a9/0x1e0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30

value changed: 0xffff888103535188 -> 0xffff88810351b880

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 73 Comm: kworker/1:1H Not tainted 5.18.0-rc5-syzkaller-00178-g30c8e80f7932-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: kblockd blk_mq_requeue_work
==================================================================

Crashes (8):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci2-upstream-kcsan-gce 2022/05/08 02:16 upstream 30c8e80f7932 e60b1103 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/05/07 23:40 upstream 30c8e80f7932 e60b1103 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/05/07 17:04 upstream 4b97bac0756a e60b1103 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/05/07 12:03 upstream 4b97bac0756a e60b1103 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/05/07 04:18 upstream 4b97bac0756a e60b1103 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/04/10 15:48 upstream 1862a69c9174 e22c3da3 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/03/28 20:14 upstream ae085d7f9365 6bdac766 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2022/03/11 07:11 upstream 79b00034e9dc 9e8eaa75 .config console log report info KCSAN: data-race in dd_has_work / deadline_remove_request
* Struck through repros no longer work on HEAD.