syzbot


KCSAN: data-race in calc_wb_limits.part.0 / wbt_track (2)

Status: closed as invalid on 2020/06/18 14:24
Subsystems: block
[Documentation on labels]
First crash: 1619d, last: 1435d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in calc_wb_limits.part.0 / wbt_track block 2 1647d 1651d 0/26 closed as invalid on 2019/11/19 13:54

Sample crash report:
==================================================================
BUG: KCSAN: data-race in calc_wb_limits.part.0 / wbt_track

write to 0xffff888128e22e04 of 4 bytes by interrupt on cpu 0:
 calc_wb_limits.part.0+0x70/0xa0 block/blk-wbt.c:304
 calc_wb_limits block/blk-wbt.c:298 [inline]
 scale_up block/blk-wbt.c:313 [inline]
 scale_up+0x7d/0x250 block/blk-wbt.c:309
 wb_timer_fn+0x2d6/0xad0 block/blk-wbt.c:382
 blk_stat_timer_fn+0x3af/0x3d0 block/blk-stat.c:99
 call_timer_fn+0x58/0x2e0 kernel/time/timer.c:1405
 expire_timers kernel/time/timer.c:1450 [inline]
 __run_timers kernel/time/timer.c:1774 [inline]
 __run_timers kernel/time/timer.c:1741 [inline]
 run_timer_softirq+0xb14/0xbd0 kernel/time/timer.c:1787
 __do_softirq+0x118/0x34a kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xb5/0xd0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe2/0x270 arch/x86/kernel/apic/apic.c:1140
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:759 [inline]
 kcsan_setup_watchpoint+0x25a/0x440 kernel/kcsan/core.c:542
 xa_head include/linux/xarray.h:1164 [inline]
 xas_start+0x95/0x220 lib/xarray.c:188
 xas_load+0x28/0xf0 lib/xarray.c:233
 find_get_entry+0xea/0x3b0 mm/filemap.c:1511
 pagecache_get_page+0x42/0x8c0 mm/filemap.c:1609
 find_get_page include/linux/pagemap.h:258 [inline]
 filemap_fault+0xdd/0x1410 mm/filemap.c:2481
 ext4_filemap_fault+0x5b/0x74 fs/ext4/inode.c:6033
 __do_fault+0xa8/0x1e0 mm/memory.c:3450
 do_shared_fault mm/memory.c:3901 [inline]
 do_fault mm/memory.c:3979 [inline]
 handle_pte_fault mm/memory.c:4215 [inline]
 __handle_mm_fault+0x27bc/0x2da0 mm/memory.c:4345
 handle_mm_fault+0x21c/0x540 mm/memory.c:4382
 do_user_addr_fault arch/x86/mm/fault.c:1464 [inline]
 do_page_fault+0x48a/0xa96 arch/x86/mm/fault.c:1535
 page_fault+0x34/0x40 arch/x86/entry/entry_64.S:1203

read to 0xffff888128e22e04 of 4 bytes by task 14318 on cpu 1:
 rwb_enabled block/blk-wbt.c:80 [inline]
 bio_to_wbt_flags block/blk-wbt.c:551 [inline]
 wbt_track+0x34/0x90 block/blk-wbt.c:600
 __rq_qos_track+0x4b/0x80 block/blk-rq-qos.c:81
 rq_qos_track block/blk-rq-qos.h:189 [inline]
 blk_mq_make_request+0x32c/0xf60 block/blk-mq.c:2011
 generic_make_request block/blk-core.c:1075 [inline]
 generic_make_request+0x196/0x700 block/blk-core.c:1017
 submit_bio+0x8f/0x3a0 block/blk-core.c:1200
 submit_bh_wbc+0x40d/0x460 fs/buffer.c:3063
 submit_bh fs/buffer.c:3069 [inline]
 __sync_dirty_buffer+0xd9/0x210 fs/buffer.c:3155
 sync_dirty_buffer+0x21/0x30 fs/buffer.c:3168
 ext4_write_inode+0x30a/0x320 fs/ext4/inode.c:5146
 write_inode fs/fs-writeback.c:1312 [inline]
 __writeback_single_inode+0x722/0x910 fs/fs-writeback.c:1511
 writeback_single_inode+0x219/0x2f0 fs/fs-writeback.c:1565
 sync_inode fs/fs-writeback.c:2602 [inline]
 sync_inode_metadata+0x75/0xa0 fs/fs-writeback.c:2622
 ext4_fsync_nojournal fs/ext4/fsync.c:94 [inline]
 ext4_sync_file+0x47a/0x8b0 fs/ext4/fsync.c:172
 vfs_fsync_range+0x7c/0x150 fs/sync.c:197
 generic_write_sync include/linux/fs.h:2872 [inline]
 ext4_buffered_write_iter+0x211/0x280 fs/ext4/file.c:277
 ext4_file_write_iter+0xf4/0xd30 fs/ext4/file.c:642
 call_write_iter include/linux/fs.h:1907 [inline]
 do_iter_readv_writev+0x4a7/0x5d0 fs/read_write.c:694
 do_iter_write fs/read_write.c:999 [inline]
 do_iter_write+0x137/0x3a0 fs/read_write.c:980
 vfs_iter_write+0x56/0x80 fs/read_write.c:1040
 iter_file_splice_write+0x530/0x830 fs/splice.c:760
 do_splice_from fs/splice.c:863 [inline]
 direct_splice_actor+0x97/0xb0 fs/splice.c:1037
 splice_direct_to_actor+0x22f/0x540 fs/splice.c:992
 do_splice_direct+0x152/0x1d0 fs/splice.c:1080
 do_sendfile+0x380/0x800 fs/read_write.c:1521
 __do_sys_sendfile64 fs/read_write.c:1576 [inline]
 __se_sys_sendfile64 fs/read_write.c:1568 [inline]
 __x64_sys_sendfile64+0xb8/0x140 fs/read_write.c:1568
 do_syscall_64+0xc7/0x3b0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 14318 Comm: syz-executor.1 Not tainted 5.7.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/05 12:38 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 2420d1bc .config console log report ci2-upstream-kcsan-gce
2020/04/25 14:38 https://github.com/google/ktsan.git kcsan 7c3cd68e5d38 a113ba38 .config console log report ci2-upstream-kcsan-gce
2020/03/04 05:50 https://github.com/google/ktsan.git kcsan 766d004d1b85 1f73b64b .config console log report ci2-upstream-kcsan-gce
2020/01/10 15:14 https://github.com/google/ktsan.git kcsan 245a43005292 532ec44e .config console log report ci2-upstream-kcsan-gce
2020/01/09 20:06 https://github.com/google/ktsan.git kcsan 245a43005292 4de4e9f0 .config console log report ci2-upstream-kcsan-gce
2019/12/04 20:38 https://github.com/google/ktsan.git kcsan ef798c30ba4e b2088328 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.