KCSAN: data-race in wb_timer_fn / wbt

KCSAN: data-race in wb_timer_fn / wbt_track (2)
Status: moderation: reported on 2020/12/07 11:42
Reported-by: syzbot+28667d4821af204d1791@syzkaller.appspotmail.com
First crash: 100d, last: 18d

similar bugs (1):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in wb_timer_fn / wbt_track				3	147d	171d	0/17	auto-closed as invalid on 2020/10/05 04:48

Sample crash report:

==================================================================
BUG: KCSAN: data-race in wb_timer_fn / wbt_track

write to 0xffff888103a08b04 of 4 bytes by interrupt on cpu 1:
 calc_wb_limits block/blk-wbt.c:304 [inline]
 scale_up block/blk-wbt.c:313 [inline]
 wb_timer_fn+0x54a/0xa00 block/blk-wbt.c:374
 blk_stat_timer_fn+0x3f4/0x410 block/blk-stat.c:99
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1417
 expire_timers+0x116/0x260 kernel/time/timer.c:1462
 __run_timers+0x338/0x3d0 kernel/time/timer.c:1731
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1744
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 sysvec_apic_timer_interrupt+0x74/0x90 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
 native_restore_fl arch/x86/include/asm/irqflags.h:41 [inline]
 arch_local_irq_restore arch/x86/include/asm/irqflags.h:84 [inline]
 kcsan_setup_watchpoint+0x1fc/0x4e0 kernel/kcsan/core.c:591
 tomoyo_check_path_acl+0x1e/0xe0 security/tomoyo/file.c:258
 tomoyo_check_acl+0xcc/0x200 security/tomoyo/domain.c:175
 tomoyo_path_permission security/tomoyo/file.c:586 [inline]
 tomoyo_check_open_permission+0x17f/0x370 security/tomoyo/file.c:777
 tomoyo_file_open+0xd3/0xf0 security/tomoyo/tomoyo.c:313
 security_file_open+0x3f/0x90 security/security.c:1576
 do_dentry_open+0x22d/0x870 fs/open.c:804
 vfs_open+0x43/0x50 fs/open.c:931
 do_open fs/namei.c:3254 [inline]
 path_openat+0x1844/0x20a0 fs/namei.c:3371
 do_filp_open+0xbd/0x1d0 fs/namei.c:3398
 do_sys_openat2+0xa3/0x240 fs/open.c:1172
 do_sys_open fs/open.c:1188 [inline]
 __do_sys_open fs/open.c:1196 [inline]
 __se_sys_open fs/open.c:1192 [inline]
 __x64_sys_open+0xe2/0x110 fs/open.c:1192
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888103a08b04 of 4 bytes by task 8451 on cpu 0:
 rwb_enabled block/blk-wbt.c:80 [inline]
 bio_to_wbt_flags block/blk-wbt.c:543 [inline]
 wbt_track+0x23/0x130 block/blk-wbt.c:592
 __rq_qos_track+0x50/0x90 block/blk-rq-qos.c:81
 rq_qos_track block/blk-rq-qos.h:189 [inline]
 blk_mq_submit_bio+0x2bf/0x1000 block/blk-mq.c:2173
 __submit_bio_noacct_mq block/blk-core.c:1028 [inline]
 submit_bio_noacct+0x75d/0x910 block/blk-core.c:1061
 submit_bio+0x1f3/0x350 block/blk-core.c:1131
 ext4_mpage_readpages+0x1471/0x14c0 fs/ext4/readpage.c:412
 ext4_readahead+0x99/0xa0 fs/ext4/inode.c:3261
 read_pages+0xa0/0x6e0 mm/readahead.c:130
 page_cache_ra_unbounded+0x464/0x4c0 mm/readahead.c:238
 ondemand_readahead+0x560/0x780 mm/readahead.c:267
 page_cache_async_ra+0x1aa/0x1d0 mm/readahead.c:607
 page_cache_async_readahead include/linux/pagemap.h:862 [inline]
 generic_file_buffered_read_get_pages+0x42e/0xaf0 mm/filemap.c:2387
 generic_file_buffered_read+0x27f/0x9a0 mm/filemap.c:2481
 generic_file_read_iter+0x80/0x3d0 mm/filemap.c:2633
 ext4_file_read_iter+0x2d0/0x420 fs/ext4/file.c:74
 __kernel_read+0x307/0x560 fs/read_write.c:454
 integrity_kernel_read+0x4c/0x70 security/integrity/iint.c:191
 ima_calc_file_hash_tfm security/integrity/ima/ima_crypto.c:484 [inline]
 ima_calc_file_shash security/integrity/ima/ima_crypto.c:515 [inline]
 ima_calc_file_hash+0x956/0x1390 security/integrity/ima/ima_crypto.c:572
 ima_collect_measurement+0x168/0x300 security/integrity/ima/ima_api.c:250
 process_measurement+0x9f1/0x1050 security/integrity/ima/ima_main.c:330
 ima_file_check+0x72/0xa0 security/integrity/ima/ima_main.c:498
 do_open fs/namei.c:3256 [inline]
 path_openat+0x1887/0x20a0 fs/namei.c:3371
 do_filp_open+0xbd/0x1d0 fs/namei.c:3398
 do_sys_openat2+0xa3/0x240 fs/open.c:1172
 do_sys_open fs/open.c:1188 [inline]
 __do_sys_open fs/open.c:1196 [inline]
 __se_sys_open fs/open.c:1192 [inline]
 __x64_sys_open+0xe2/0x110 fs/open.c:1192
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8451 Comm: syz-executor.1 Not tainted 5.11.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (8):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Maintainers
ci2-upstream-kcsan-gce	2021/01/07 05:22	upstream	71c061d2	c104d4a3	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/12/05 23:25	upstream	32f741b0	50503117	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/11/23 13:43	upstream	418baf2c	0d27f508	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/11/18 08:18	upstream	111e91a6	09323409	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/10/27 13:45	upstream	4525c878	94942294	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/10/26 13:14	upstream	3650b228	a7aac492	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/10/25 21:17	upstream	986b9eac	a1839e81	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/10/17 01:15	upstream	54a4c789	6e262c73	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org