syzbot


KCSAN: data-race in calc_wb_limits.part.0 / wbt_wait

Status: closed as invalid on 2019/11/19 14:54
Subsystems: block
[Documentation on labels]
First crash: 1635d, last: 1626d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in calc_wb_limits.part.0 / wbt_wait (3) block 9 1429d 1536d 0/26 closed as invalid on 2020/06/18 14:24
upstream KCSAN: data-race in calc_wb_limits.part.0 / wbt_wait (2) block 1 1609d 1609d 0/26 auto-closed as invalid on 2020/02/06 18:57

Sample crash report:
==================================================================
BUG: KCSAN: data-race in calc_wb_limits.part.0 / wbt_wait

write to 0xffff88812a365604 of 4 bytes by interrupt on cpu 0:
 calc_wb_limits.part.0+0x7b/0xb0 block/blk-wbt.c:304
 calc_wb_limits block/blk-wbt.c:298 [inline]
 scale_up block/blk-wbt.c:313 [inline]
 scale_up+0x7f/0x250 block/blk-wbt.c:309
 wb_timer_fn+0x2cd/0xad0 block/blk-wbt.c:393
 blk_stat_timer_fn+0x3b0/0x3d0 block/blk-stat.c:98
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 find_watchpoint kernel/kcsan/core.c:77 [inline]
 check_access kernel/kcsan/core.c:388 [inline]
 __tsan_read8+0x9e/0x1f0 kernel/kcsan/core.c:530
 set_pte_at arch/x86/include/asm/paravirt.h:450 [inline]
 copy_one_pte mm/memory.c:780 [inline]
 copy_pte_range mm/memory.c:823 [inline]
 copy_pmd_range mm/memory.c:874 [inline]
 copy_pud_range mm/memory.c:908 [inline]
 copy_p4d_range mm/memory.c:930 [inline]
 copy_page_range+0xd7e/0x1a80 mm/memory.c:992
 dup_mmap kernel/fork.c:601 [inline]
 dup_mm+0x74a/0xba0 kernel/fork.c:1361
 copy_mm kernel/fork.c:1417 [inline]
 copy_process+0x36f3/0x3b50 kernel/fork.c:2012
 _do_fork+0xfe/0x6e0 kernel/fork.c:2366
 __do_sys_clone kernel/fork.c:2521 [inline]
 __se_sys_clone kernel/fork.c:2502 [inline]
 __x64_sys_clone+0x12b/0x160 kernel/fork.c:2502
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff88812a365604 of 4 bytes by task 17621 on cpu 1:
 rwb_enabled block/blk-wbt.c:80 [inline]
 bio_to_wbt_flags block/blk-wbt.c:551 [inline]
 wbt_wait+0x52/0x250 block/blk-wbt.c:584
 __rq_qos_throttle+0x47/0x70 block/blk-rq-qos.c:72
 rq_qos_throttle block/blk-rq-qos.h:182 [inline]
 blk_mq_make_request+0x29c/0xf60 block/blk-mq.c:1971
 generic_make_request block/blk-core.c:1064 [inline]
 generic_make_request+0x196/0x740 block/blk-core.c:1006
 submit_bio+0x96/0x3c0 block/blk-core.c:1190
 dio_bio_submit fs/direct-io.c:481 [inline]
 do_blockdev_direct_IO+0x64e1/0x78c0 fs/direct-io.c:1353
 __blockdev_direct_IO+0x86/0xa0 fs/direct-io.c:1412
 ext4_direct_IO_write fs/ext4/inode.c:3742 [inline]
 ext4_direct_IO+0x76c/0xfb0 fs/ext4/inode.c:3871
 generic_file_direct_write+0x14d/0x2e0 mm/filemap.c:3208
 __generic_file_write_iter+0x17e/0x380 mm/filemap.c:3391
 ext4_file_write_iter+0x1bd/0xa00 fs/ext4/file.c:268
 call_write_iter include/linux/fs.h:1895 [inline]
 do_iter_readv_writev+0x487/0x5b0 fs/read_write.c:693
 do_iter_write fs/read_write.c:970 [inline]
 do_iter_write+0x13b/0x3c0 fs/read_write.c:951
 vfs_iter_write+0x5c/0x80 fs/read_write.c:983
 iter_file_splice_write+0x4c0/0x7f0 fs/splice.c:746
 do_splice_from fs/splice.c:848 [inline]
 direct_splice_actor+0xa0/0xc0 fs/splice.c:1020
 splice_direct_to_actor+0x215/0x510 fs/splice.c:975
 do_splice_direct+0x161/0x1e0 fs/splice.c:1063
 do_sendfile+0x384/0x7f0 fs/read_write.c:1464
 __do_sys_sendfile64 fs/read_write.c:1525 [inline]
 __se_sys_sendfile64 fs/read_write.c:1511 [inline]
 __x64_sys_sendfile64+0x12a/0x140 fs/read_write.c:1511
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17621 Comm: syz-executor.2 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/11/11 18:22 https://github.com/google/ktsan.git kcsan 94c006602e13 377d77fa .config console log report ci2-upstream-kcsan-gce
2019/11/08 16:51 https://github.com/google/ktsan.git kcsan 94c006602e13 1e35461e .config console log report ci2-upstream-kcsan-gce
2019/11/05 13:56 https://github.com/google/ktsan.git kcsan 94c006602e13 0f3ec414 .config console log report ci2-upstream-kcsan-gce
2019/11/02 06:38 https://github.com/google/ktsan.git kcsan 05f2236801fe 997ccc67 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.