syzbot


KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (5)

Status: auto-closed as invalid on 2021/03/03 15:50
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+2b6452167d85a022bc6f@syzkaller.appspotmail.com
First crash: 1227d, last: 1146d
Discussions (1)
Title Replies (including bot) Last reply
KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (5) 1 (2) 2021/02/05 17:06
Similar bugs (5)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (3) block 2 1355d 1355d 0/26 auto-closed as invalid on 2020/08/07 01:06
upstream KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (4) block 5 1266d 1291d 0/26 auto-closed as invalid on 2020/11/04 06:43
upstream KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (6) block 2 1090d 1100d 0/26 auto-closed as invalid on 2021/05/17 11:06
upstream KCSAN: data-race in blk_stat_add / blk_stat_timer_fn block 10 1591d 1607d 0/26 closed as invalid on 2019/11/19 14:44
upstream KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (2) block 22 1441d 1581d 0/26 auto-closed as invalid on 2020/06/16 18:43

Sample crash report:
==================================================================
BUG: KCSAN: data-race in blk_stat_add / blk_stat_timer_fn

write to 0xffffe8ffffd35c80 of 8 bytes by interrupt on cpu 0:
 blk_rq_stat_init block/blk-stat.c:24 [inline]
 blk_stat_timer_fn+0x349/0x410 block/blk-stat.c:95
 call_timer_fn+0x2e/0x240 kernel/time/timer.c:1417
 expire_timers+0x116/0x260 kernel/time/timer.c:1462
 __run_timers+0x338/0x3d0 kernel/time/timer.c:1731
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1744
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 sysvec_apic_timer_interrupt+0x74/0x90 arch/x86/kernel/apic/apic.c:1096
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628

read to 0xffffe8ffffd35c80 of 8 bytes by interrupt on cpu 1:
 blk_rq_stat_add block/blk-stat.c:46 [inline]
 blk_stat_add+0x13d/0x230 block/blk-stat.c:74
 __blk_mq_end_request+0x142/0x230 block/blk-mq.c:546
 scsi_end_request+0x2a6/0x470 drivers/scsi/scsi_lib.c:604
 scsi_io_completion+0x104/0xfb0 drivers/scsi/scsi_lib.c:969
 scsi_finish_command+0x263/0x2b0 drivers/scsi/scsi.c:214
 scsi_softirq_done+0xdf/0x440 drivers/scsi/scsi_lib.c:1449
 blk_done_softirq+0x145/0x190 block/blk-mq.c:588
 __do_softirq+0x13c/0x2c3 kernel/softirq.c:343
 asm_call_irq_on_stack+0xf/0x20
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:226 [inline]
 __irq_exit_rcu+0xb4/0xc0 kernel/softirq.c:420
 common_interrupt+0xb5/0x130 arch/x86/kernel/irq.c:239
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:619
 check_access kernel/kcsan/core.c:633 [inline]
 __tsan_read1+0x156/0x180 kernel/kcsan/core.c:839
 tomoyo_get_mode security/tomoyo/util.c:1003 [inline]
 tomoyo_init_request_info+0xfc/0x160 security/tomoyo/util.c:1031
 tomoyo_path_perm+0x8b/0x330 security/tomoyo/file.c:815
 tomoyo_inode_getattr+0x18/0x20 security/tomoyo/tomoyo.c:123
 security_inode_getattr+0x7f/0xd0 security/security.c:1280
 vfs_getattr fs/stat.c:121 [inline]
 vfs_fstat+0x45/0x390 fs/stat.c:146
 __do_sys_newfstat fs/stat.c:386 [inline]
 __se_sys_newfstat+0x35/0x240 fs/stat.c:383
 __x64_sys_newfstat+0x2d/0x40 fs/stat.c:383
 do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 18199 Comm: modprobe Not tainted 5.11.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/27 15:49 upstream 2ab38c17aac1 a0ebf917 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in blk_stat_add / blk_stat_timer_fn
2021/01/22 07:16 upstream 83d09ad4b950 d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in blk_stat_add / blk_stat_timer_fn
2021/01/21 11:59 upstream 75439bc439e0 d4f4eca5 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in blk_stat_add / blk_stat_timer_fn
2021/01/19 02:35 upstream 1e2a199f6ccd 63631df1 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in blk_stat_add / blk_stat_timer_fn
2021/01/17 19:33 upstream 0da0a8a0a0e1 fd103621 .config console log report info ci2-upstream-kcsan-gce KCSAN: data-race in blk_stat_add / blk_stat_timer_fn
2021/01/04 19:12 upstream e71ba9452f0b 79264ae3 .config console log report info ci2-upstream-kcsan-gce
2021/01/03 00:13 upstream 3516bd729358 79264ae3 .config console log report info ci2-upstream-kcsan-gce
2021/01/01 05:23 upstream f6e1ea196492 79264ae3 .config console log report info ci2-upstream-kcsan-gce
2020/12/23 17:22 upstream 614cb5894306 c2c1d1dd .config console log report info ci2-upstream-kcsan-gce
2020/12/07 15:28 upstream 0477e9288185 f80ce148 .config console log report info ci2-upstream-kcsan-gce
2020/11/28 14:45 upstream c84e1efae022 3c7136c0 .config console log report info ci2-upstream-kcsan-gce
2020/11/07 20:05 upstream 659caaf65dc9 cba33199 .config console log report info ci2-upstream-kcsan-gce
* Struck through repros no longer work on HEAD.