syzbot


KCSAN: data-race in rq_depth_scale_up / wbt_inflight_cb (3)

Status: auto-closed as invalid on 2021/05/17 10:34
Subsystems: block
[Documentation on labels]
First crash: 1110d, last: 1110d
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rq_depth_scale_up / wbt_inflight_cb (2) block 4 1170d 1235d 0/26 auto-closed as invalid on 2021/03/17 18:32
upstream KCSAN: data-race in rq_depth_scale_up / wbt_inflight_cb block 3 1362d 1406d 0/26 auto-closed as invalid on 2020/09/06 13:38

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rq_depth_scale_up / wbt_inflight_cb

write to 0xffff88810397f2e0 of 4 bytes by interrupt on cpu 0:
 rq_depth_calc_max_depth block/blk-rq-qos.c:157 [inline]
 rq_depth_scale_up+0x169/0x190 block/blk-rq-qos.c:174
 scale_up block/blk-wbt.c:311 [inline]
 wb_timer_fn+0x158/0xa00 block/blk-wbt.c:382
 blk_stat_timer_fn+0x3f4/0x410 block/blk-stat.c:99
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1431
 expire_timers+0x116/0x260 kernel/time/timer.c:1476
 __run_timers+0x358/0x3f0 kernel/time/timer.c:1745
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1758
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:422
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
 smap_restore arch/x86/include/asm/smap.h:70 [inline]
 kcsan_setup_watchpoint+0x436/0x470 kernel/kcsan/core.c:590
 tomoyo_domain_quota_is_ok+0x79/0x2f0 security/tomoyo/util.c:1059
 tomoyo_supervisor+0x1f4/0xb40 security/tomoyo/common.c:2089
 tomoyo_audit_path_number_log security/tomoyo/file.c:235 [inline]
 tomoyo_path_number_perm+0x227/0x2d0 security/tomoyo/file.c:734
 tomoyo_file_ioctl+0x1c/0x20 security/tomoyo/tomoyo.c:329
 security_file_ioctl+0x45/0x90 security/security.c:1495
 __do_sys_ioctl fs/ioctl.c:747 [inline]
 __se_sys_ioctl+0x48/0x140 fs/ioctl.c:739
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:739
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff88810397f2e0 of 4 bytes by task 23044 on cpu 1:
 get_limit block/blk-wbt.c:473 [inline]
 wbt_inflight_cb+0xc6/0x220 block/blk-wbt.c:495
 rq_qos_wait+0xac/0x220 block/blk-rq-qos.c:266
 __wbt_wait block/blk-wbt.c:518 [inline]
 wbt_wait+0x1bb/0x2b0 block/blk-wbt.c:583
 __rq_qos_throttle+0x39/0x70 block/blk-rq-qos.c:72
 rq_qos_throttle block/blk-rq-qos.h:182 [inline]
 blk_mq_submit_bio+0x253/0x1060 block/blk-mq.c:2185
 __submit_bio_noacct_mq block/blk-core.c:1014 [inline]
 submit_bio_noacct+0x7c2/0x9a0 block/blk-core.c:1047
 submit_bio+0x200/0x370 block/blk-core.c:1118
 submit_bh_wbc+0x36b/0x3b0 fs/buffer.c:3055
 submit_bh fs/buffer.c:3061 [inline]
 __sync_dirty_buffer+0x136/0x1e0 fs/buffer.c:3156
 sync_dirty_buffer+0x16/0x20 fs/buffer.c:3169
 __ext4_handle_dirty_metadata+0x1d3/0x590 fs/ext4/ext4_jbd2.c:364
 ext4_getblk+0x2cc/0x3d0 fs/ext4/inode.c:883
 ext4_bread+0x28/0x130 fs/ext4/inode.c:900
 ext4_append+0xd1/0x1c0 fs/ext4/namei.c:67
 ext4_init_new_dir+0x177/0x500 fs/ext4/namei.c:2768
 ext4_mkdir+0x329/0x760 fs/ext4/namei.c:2814
 vfs_mkdir+0x135/0x1f0 fs/namei.c:3819
 do_mkdirat+0x147/0x230 fs/namei.c:3844
 __do_sys_mkdir fs/namei.c:3862 [inline]
 __se_sys_mkdir fs/namei.c:3860 [inline]
 __x64_sys_mkdir+0x32/0x40 fs/namei.c:3860
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 23044 Comm: syz-executor.4 Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/04/12 10:25 upstream d434405aaab7 6a81331a .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in rq_depth_scale_up / wbt_inflight_cb
* Struck through repros no longer work on HEAD.