KCSAN: data-race in wb_timer_fn / wbt_inflight

KCSAN: data-race in wb_timer_fn / wbt_inflight_cb (3)
Status: auto-closed as invalid on 2021/05/17 08:41
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 111d, last: 111d

similar bugs (2):
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in wb_timer_fn / wbt_inflight_cb (2)				11	187d	237d	0/22	auto-closed as invalid on 2021/03/02 02:09
upstream	KCSAN: data-race in wb_timer_fn / wbt_inflight_cb				5	376d	394d	0/22	auto-closed as invalid on 2020/08/25 18:17

Sample crash report:

==================================================================
BUG: KCSAN: data-race in wb_timer_fn / wbt_inflight_cb

write to 0xffff888103bdc904 of 4 bytes by interrupt on cpu 1:
 calc_wb_limits block/blk-wbt.c:304 [inline]
 scale_up block/blk-wbt.c:313 [inline]
 wb_timer_fn+0x42a/0xa00 block/blk-wbt.c:382
 blk_stat_timer_fn+0x3f4/0x410 block/blk-stat.c:99
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1431
 expire_timers+0x116/0x260 kernel/time/timer.c:1476
 __run_timers+0x358/0x3f0 kernel/time/timer.c:1745
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1758
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:422
 sysvec_apic_timer_interrupt+0x6e/0x80 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
 smap_restore arch/x86/include/asm/smap.h:70 [inline]
 kcsan_setup_watchpoint+0x436/0x470 kernel/kcsan/core.c:590
 native_save_fl arch/x86/include/asm/irqflags.h:35 [inline]
 arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
 check_irqs_on fs/buffer.c:1251 [inline]
 lookup_bh_lru fs/buffer.c:1292 [inline]
 __find_get_block+0x3a/0x640 fs/buffer.c:1324
 sb_find_get_block include/linux/buffer_head.h:338 [inline]
 recently_deleted fs/ext4/ialloc.c:686 [inline]
 find_inode_bit+0x1b8/0x3a0 fs/ext4/ialloc.c:728
 __ext4_new_inode+0xb6c/0x2fe0 fs/ext4/ialloc.c:1063
 ext4_symlink+0x2d1/0x780 fs/ext4/namei.c:3347
 vfs_symlink+0xbe/0x170 fs/namei.c:4178
 do_symlinkat+0x11e/0x2b0 fs/namei.c:4208
 __do_sys_symlink fs/namei.c:4229 [inline]
 __se_sys_symlink fs/namei.c:4227 [inline]
 __x64_sys_symlink+0x32/0x40 fs/namei.c:4227
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

read to 0xffff888103bdc904 of 4 bytes by task 8085 on cpu 0:
 rwb_enabled block/blk-wbt.c:80 [inline]
 get_limit block/blk-wbt.c:458 [inline]
 wbt_inflight_cb+0x3f/0x220 block/blk-wbt.c:495
 rq_qos_wait+0xac/0x220 block/blk-rq-qos.c:266
 __wbt_wait block/blk-wbt.c:518 [inline]
 wbt_wait+0x1bb/0x2b0 block/blk-wbt.c:583
 __rq_qos_throttle+0x39/0x70 block/blk-rq-qos.c:72
 rq_qos_throttle block/blk-rq-qos.h:182 [inline]
 blk_mq_submit_bio+0x253/0x1060 block/blk-mq.c:2185
 __submit_bio_noacct_mq block/blk-core.c:1014 [inline]
 submit_bio_noacct+0x7c2/0x9a0 block/blk-core.c:1047
 submit_bio+0x200/0x370 block/blk-core.c:1118
 submit_bh_wbc+0x36b/0x3b0 fs/buffer.c:3055
 submit_bh fs/buffer.c:3061 [inline]
 __sync_dirty_buffer+0x136/0x1e0 fs/buffer.c:3156
 sync_dirty_buffer+0x16/0x20 fs/buffer.c:3169
 ext4_write_inode+0x285/0x390 fs/ext4/inode.c:5238
 write_inode+0x8c/0x1f0 fs/fs-writeback.c:1320
 __writeback_single_inode+0x286/0x4d0 fs/fs-writeback.c:1525
 writeback_single_inode+0x122/0x580 fs/fs-writeback.c:1580
 sync_inode fs/fs-writeback.c:2624 [inline]
 sync_inode_metadata+0x52/0x70 fs/fs-writeback.c:2644
 ext4_fsync_nojournal fs/ext4/fsync.c:92 [inline]
 ext4_sync_file+0x359/0x6e0 fs/ext4/fsync.c:170
 vfs_fsync_range+0x107/0x120 fs/sync.c:200
 generic_write_sync include/linux/fs.h:2843 [inline]
 ext4_buffered_write_iter+0x38f/0x3e0 fs/ext4/file.c:277
 ext4_file_write_iter+0x48a/0x10b0 fs/ext4/file.c:502
 call_write_iter include/linux/fs.h:1977 [inline]
 new_sync_write fs/read_write.c:518 [inline]
 vfs_write+0x6f9/0x7e0 fs/read_write.c:605
 ksys_write+0xce/0x180 fs/read_write.c:658
 __do_sys_write fs/read_write.c:670 [inline]
 __se_sys_write fs/read_write.c:667 [inline]
 __x64_sys_write+0x3e/0x50 fs/read_write.c:667
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 8085 Comm: rs:main Q:Reg Not tainted 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (1):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-upstream-kcsan-gce	2021/04/12 07:58	upstream	7d900724913c	6a81331a	.config	log	report			info	KCSAN: data-race in wb_timer_fn / wbt_inflight_cb