syzbot


KCSAN: data-race in rq_depth_calc_max_depth / wbt_inflight_cb (2)

Status: auto-closed as invalid on 2020/05/06 11:55
Subsystems: block
[Documentation on labels]
First crash: 1591d, last: 1518d
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in rq_depth_calc_max_depth / wbt_inflight_cb block 1 1627d 1627d 0/26 closed as invalid on 2019/11/19 14:44

Sample crash report:
==================================================================
BUG: KCSAN: data-race in rq_depth_calc_max_depth / wbt_inflight_cb

write to 0xffff8881290a6de0 of 4 bytes by interrupt on cpu 1:
 rq_depth_calc_max_depth+0xa5/0x160 block/blk-rq-qos.c:157
 rq_depth_scale_up+0x71/0xa0 block/blk-rq-qos.c:174
 scale_up+0x40/0x250 block/blk-wbt.c:311
 wb_timer_fn+0x2cd/0xad0 block/blk-wbt.c:393
 blk_stat_timer_fn+0x3b0/0x3d0 block/blk-stat.c:99
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1405
 expire_timers kernel/time/timer.c:1450 [inline]
 __run_timers kernel/time/timer.c:1774 [inline]
 __run_timers kernel/time/timer.c:1741 [inline]
 run_timer_softirq+0xbe3/0xcb0 kernel/time/timer.c:1787
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:546 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1146
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:752 [inline]
 kcsan_setup_watchpoint+0x2d6/0x400 kernel/kcsan/core.c:513
 check_access kernel/kcsan/core.c:550 [inline]
 __tsan_read8+0xc6/0x100 kernel/kcsan/core.c:686
 tomoyo_domain_quota_is_ok+0xce/0x2b0 security/tomoyo/util.c:1032
 tomoyo_supervisor+0x1d9/0xc90 security/tomoyo/common.c:2089
 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline]
 tomoyo_path_permission security/tomoyo/file.c:587 [inline]
 tomoyo_path_permission+0x121/0x160 security/tomoyo/file.c:573
 tomoyo_path_perm+0x23e/0x390 security/tomoyo/file.c:838
 tomoyo_inode_getattr+0x26/0x40 security/tomoyo/tomoyo.c:129
 security_inode_getattr+0x9b/0xd0 security/security.c:1254
 vfs_getattr+0x2e/0x70 fs/stat.c:117
 vfs_statx+0x108/0x190 fs/stat.c:201
 vfs_lstat include/linux/fs.h:3276 [inline]
 __do_sys_newlstat+0x51/0xb0 fs/stat.c:364
 __se_sys_newlstat fs/stat.c:358 [inline]
 __x64_sys_newlstat+0x3a/0x50 fs/stat.c:358
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff8881290a6de0 of 4 bytes by task 9084 on cpu 0:
 get_limit block/blk-wbt.c:481 [inline]
 wbt_inflight_cb+0xc0/0x230 block/blk-wbt.c:503
 rq_qos_wait+0x283/0x320 block/blk-rq-qos.c:266
 __wbt_wait block/blk-wbt.c:526 [inline]
 wbt_wait+0x161/0x260 block/blk-wbt.c:591
 __rq_qos_throttle+0x47/0x70 block/blk-rq-qos.c:72
 rq_qos_throttle block/blk-rq-qos.h:182 [inline]
 blk_mq_make_request+0x29c/0xf60 block/blk-mq.c:1984
 generic_make_request block/blk-core.c:1069 [inline]
 generic_make_request+0x196/0x700 block/blk-core.c:1011
 submit_bio+0x96/0x3b0 block/blk-core.c:1195
 submit_bh_wbc+0x418/0x470 fs/buffer.c:3112
 submit_bh fs/buffer.c:3118 [inline]
 __sync_dirty_buffer+0xd3/0x210 fs/buffer.c:3204
 sync_dirty_buffer+0x24/0x40 fs/buffer.c:3217
 ext4_write_inode+0x329/0x340 fs/ext4/inode.c:5120
 write_inode fs/fs-writeback.c:1312 [inline]
 __writeback_single_inode+0x6f7/0x8e0 fs/fs-writeback.c:1511
 writeback_single_inode+0x232/0x310 fs/fs-writeback.c:1565
 sync_inode fs/fs-writeback.c:2602 [inline]
 sync_inode_metadata+0x74/0xa0 fs/fs-writeback.c:2622
 ext4_sync_parent fs/ext4/fsync.c:75 [inline]
 ext4_fsync_nojournal fs/ext4/fsync.c:99 [inline]
 ext4_sync_file+0x59d/0x8c0 fs/ext4/fsync.c:172
 vfs_fsync_range+0x82/0x150 fs/sync.c:197
 generic_write_sync include/linux/fs.h:2867 [inline]
 ext4_buffered_write_iter+0x222/0x290 fs/ext4/file.c:277
 ext4_file_write_iter+0xfa/0xd70 fs/ext4/file.c:642
 call_write_iter include/linux/fs.h:1901 [inline]
 new_sync_write+0x388/0x4a0 fs/read_write.c:483
 __vfs_write+0xb1/0xc0 fs/read_write.c:496
 vfs_write fs/read_write.c:558 [inline]
 vfs_write+0x18a/0x390 fs/read_write.c:542
 ksys_write+0xd5/0x1b0 fs/read_write.c:611
 __do_sys_write fs/read_write.c:623 [inline]
 __se_sys_write fs/read_write.c:620 [inline]
 __x64_sys_write+0x4c/0x60 fs/read_write.c:620
 do_syscall_64+0xcc/0x3a0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 9084 Comm: syz-executor.0 Not tainted 5.6.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/26 11:49 https://github.com/google/ktsan.git kcsan 766d004d1b85 4f588111 .config console log report ci2-upstream-kcsan-gce
2020/02/12 14:26 https://github.com/google/ktsan.git kcsan f60f0f543333 a75b198c .config console log report ci2-upstream-kcsan-gce
2020/01/18 20:38 https://github.com/google/ktsan.git kcsan 245a43005292 3de7aabb .config console log report ci2-upstream-kcsan-gce
2019/12/17 17:30 https://github.com/google/ktsan.git kcsan 245a43005292 1af3875f .config console log report ci2-upstream-kcsan-gce
2019/12/15 04:06 https://github.com/google/ktsan.git kcsan 245a43005292 eef6e580 .config console log report ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.