KCSAN: data-race in blk_stat_add / blk_stat_timer

KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (5)
Status: moderation: reported on 2020/12/07 11:54
Reported-by: syzbot+2b7b6e80a3df1635cd21@syzkaller.appspotmail.com
First crash: 78d, last: 3d00h

similar bugs (4):
Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (3)	2	206d	206d	0/17	auto-closed as invalid on 2020/08/07 01:06
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (4)	5	117d	142d	0/17	auto-closed as invalid on 2020/11/04 06:43
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn	10	442d	458d	0/17	closed as invalid on 2019/11/19 14:44
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (2)	22	292d	432d	0/17	auto-closed as invalid on 2020/06/16 18:43

Sample crash report:

==================================================================
BUG: KCSAN: data-race in blk_stat_add / blk_stat_timer_fn

write to 0xffffe8ffffc3d710 of 8 bytes by interrupt on cpu 1:
 blk_rq_stat_init block/blk-stat.c:23 [inline]
 blk_stat_timer_fn+0x313/0x410 block/blk-stat.c:95
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1417
 expire_timers+0x116/0x260 kernel/time/timer.c:1462
 __run_timers+0x338/0x3d0 kernel/time/timer.c:1731
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1744
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 sysvec_apic_timer_interrupt+0x74/0x90 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628
 __preempt_count_dec_and_test arch/x86/include/asm/preempt.h:94 [inline]
 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
 _raw_spin_unlock_irq+0x2c/0x40 kernel/locking/spinlock.c:199
 process_one_work+0x3ce/0x950 kernel/workqueue.c:2248
 worker_thread+0x635/0xb90 kernel/workqueue.c:2421
 kthread+0x1fd/0x220 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

read to 0xffffe8ffffc3d710 of 8 bytes by interrupt on cpu 0:
 blk_rq_stat_add block/blk-stat.c:45 [inline]
 blk_stat_add+0x10c/0x230 block/blk-stat.c:74
 __blk_mq_end_request+0x142/0x230 block/blk-mq.c:546
 scsi_end_request+0x2a6/0x470 drivers/scsi/scsi_lib.c:604
 scsi_io_completion+0x104/0xfb0 drivers/scsi/scsi_lib.c:969
 scsi_finish_command+0x263/0x2b0 drivers/scsi/scsi.c:214
 scsi_softirq_done+0xdf/0x440 drivers/scsi/scsi_lib.c:1449
 blk_done_softirq+0x145/0x190 block/blk-mq.c:588
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 sysvec_call_function_single+0x77/0x90 arch/x86/kernel/smp.c:243
 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:636
 clear_page_erms+0x7/0x10 arch/x86/lib/clear_page_64.S:48
 clear_page arch/x86/include/asm/page_64.h:49 [inline]
 clear_highpage include/linux/highmem.h:203 [inline]
 kernel_init_free_pages mm/page_alloc.c:1211 [inline]
 post_alloc_hook mm/page_alloc.c:2298 [inline]
 prep_new_page mm/page_alloc.c:2304 [inline]
 get_page_from_freelist+0x366/0x630 mm/page_alloc.c:3943
 __alloc_pages_nodemask+0x19e/0x350 mm/page_alloc.c:4993
 __alloc_pages include/linux/gfp.h:511 [inline]
 __alloc_pages_node include/linux/gfp.h:524 [inline]
 alloc_pages_vma+0x718/0x890 mm/mempolicy.c:2211
 do_huge_pmd_anonymous_page+0x643/0x940 mm/huge_memory.c:761
 create_huge_pmd mm/memory.c:4269 [inline]
 __handle_mm_fault mm/memory.c:4493 [inline]
 handle_mm_fault+0x11fb/0x17b0 mm/memory.c:4620
 do_user_addr_fault+0x433/0x830 arch/x86/mm/fault.c:1393
 handle_page_fault arch/x86/mm/fault.c:1450 [inline]
 exc_page_fault+0x94/0x2a0 arch/x86/mm/fault.c:1506
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:580

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 26094 Comm: syz-executor.5 Not tainted 5.11.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (11):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Maintainers
ci2-upstream-kcsan-gce	2021/01/22 07:16	upstream	83d09ad4	d4f4eca5	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/21 11:59	upstream	75439bc4	d4f4eca5	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/19 02:35	upstream	1e2a199f	63631df1	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/17 19:33	upstream	0da0a8a0	fd103621	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/04 19:12	upstream	e71ba945	79264ae3	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/03 00:13	upstream	3516bd72	79264ae3	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2021/01/01 05:23	upstream	f6e1ea19	79264ae3	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/12/23 17:22	upstream	614cb589	c2c1d1dd	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/12/07 15:28	upstream	0477e928	f80ce148	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/11/28 14:45	upstream	c84e1efa	3c7136c0	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org
ci2-upstream-kcsan-gce	2020/11/07 20:05	upstream	659caaf6	cba33199	.config	log	report	info	axboe@kernel.dk, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org