syzbot


KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (4)

Status: auto-closed as invalid on 2022/09/24 02:55
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 258d, last: 105d
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (2) 3 754d 726d 0/24 auto-closed as invalid on 2020/12/21 11:49
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf (3) 6 306d 394d 0/24 auto-closed as invalid on 2022/03/06 18:39
upstream KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf 17 1034d 1130d 0/24 auto-closed as invalid on 2020/04/13 07:50

Sample crash report:
==================================================================
BUG: KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf

write to 0xffff888137baa438 of 8 bytes by task 19649 on cpu 0:
 relay_switch_subbuf+0x39d/0x3b0 kernel/relay.c:711
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x6a7/0x700 kernel/trace/blktrace.c:276
 blk_add_trace_split+0x17e/0x1b0 kernel/trace/blktrace.c:987
 trace_block_split include/trace/events/block.h:441 [inline]
 __bio_split_to_limits+0xa16/0xa60 block/blk-merge.c:360
 blk_mq_submit_bio+0x190/0xe90 block/blk-mq.c:2820
 __submit_bio block/blk-core.c:595 [inline]
 __submit_bio_noacct_mq block/blk-core.c:672 [inline]
 submit_bio_noacct_nocheck+0x83d/0xaa0 block/blk-core.c:689
 submit_bio_noacct+0x696/0x800 block/blk-core.c:796
 submit_bio+0xfb/0x110
 ext4_io_submit fs/ext4/page-io.c:378 [inline]
 io_submit_add_bh fs/ext4/page-io.c:420 [inline]
 ext4_bio_write_page+0x59d/0xb30 fs/ext4/page-io.c:546
 mpage_submit_page fs/ext4/inode.c:2114 [inline]
 mpage_map_and_submit_buffers fs/ext4/inode.c:2359 [inline]
 mpage_map_and_submit_extent fs/ext4/inode.c:2498 [inline]
 ext4_writepages+0x1020/0x1cf0 fs/ext4/inode.c:2827
 do_writepages+0x1db/0x350 mm/page-writeback.c:2468
 filemap_fdatawrite_wbc+0xd6/0xf0 mm/filemap.c:388
 __filemap_fdatawrite_range mm/filemap.c:421 [inline]
 filemap_write_and_wait_range+0xc2/0x1d0 mm/filemap.c:673
 filemap_write_and_wait include/linux/pagemap.h:60 [inline]
 ext4_bmap+0x12d/0x240 fs/ext4/inode.c:3171
 bmap+0x5c/0x80 fs/inode.c:1799
 ioctl_fibmap fs/ioctl.c:77 [inline]
 file_ioctl fs/ioctl.c:327 [inline]
 do_vfs_ioctl+0x1240/0x1390 fs/ioctl.c:849
 __do_sys_ioctl fs/ioctl.c:868 [inline]
 __se_sys_ioctl+0x83/0x140 fs/ioctl.c:856
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to 0xffff888137baa438 of 8 bytes by task 19655 on cpu 1:
 relay_switch_subbuf+0x39d/0x3b0 kernel/relay.c:711
 relay_reserve include/linux/relay.h:248 [inline]
 __blk_add_trace+0x6a7/0x700 kernel/trace/blktrace.c:276
 blk_add_trace_plug+0x48/0x60 kernel/trace/blktrace.c:952
 trace_block_plug include/trace/events/block.h:379 [inline]
 blk_add_rq_to_plug+0x2d1/0x390 block/blk-mq.c:1186
 blk_mq_submit_bio+0x90b/0xe90 block/blk-mq.c:2856
 __submit_bio block/blk-core.c:595 [inline]
 __submit_bio_noacct_mq block/blk-core.c:672 [inline]
 submit_bio_noacct_nocheck+0x83d/0xaa0 block/blk-core.c:689
 submit_bio_noacct+0x696/0x800 block/blk-core.c:796
 submit_bio+0xfb/0x110
 ext4_io_submit+0x86/0xa0 fs/ext4/page-io.c:378
 ext4_writepages+0xaca/0x1cf0 fs/ext4/inode.c:2847
 do_writepages+0x1db/0x350 mm/page-writeback.c:2468
 filemap_fdatawrite_wbc+0xd6/0xf0 mm/filemap.c:388
 __filemap_fdatawrite_range mm/filemap.c:421 [inline]
 filemap_write_and_wait_range+0xc2/0x1d0 mm/filemap.c:673
 filemap_write_and_wait include/linux/pagemap.h:60 [inline]
 ext4_bmap+0x12d/0x240 fs/ext4/inode.c:3171
 bmap+0x5c/0x80 fs/inode.c:1799
 ioctl_fibmap fs/ioctl.c:77 [inline]
 file_ioctl fs/ioctl.c:327 [inline]
 do_vfs_ioctl+0x1240/0x1390 fs/ioctl.c:849
 __do_sys_ioctl fs/ioctl.c:868 [inline]
 __se_sys_ioctl+0x83/0x140 fs/ioctl.c:856
 __x64_sys_ioctl+0x3f/0x50 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

value changed: 0x0000000000000030 -> 0x0000000000000038

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 19655 Comm: syz-executor.4 Not tainted 6.0.0-rc1-syzkaller-00340-g50cd95ac4654-dirty #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
==================================================================

Crashes (11):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2022/08/20 02:51 upstream 50cd95ac4654 26a13b38 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/07/17 01:23 upstream c658cabbfd32 95cb00d1 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/06/20 01:05 upstream 05c6ca8512f2 8f633d84 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/05/28 14:57 upstream 9d004b2f4fea a46af346 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/05/27 13:10 upstream 7e284070abe5 116e7a7b .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/05/22 04:29 upstream 6c3f5bec9b40 7268fa62 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/05/05 06:28 upstream a7391ad35724 dc9e5259 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/04/25 16:55 upstream af2d861d4cd2 152baedd .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/04/25 01:06 upstream 42740a2ff5d3 131df97d .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/03/23 14:17 upstream 3bf03b9a0839 5ff41e94 .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
ci2-upstream-kcsan-gce 2022/03/20 04:45 upstream 97e9c8eb4bb1 e2d91b1d .config log report info KCSAN: data-race in relay_switch_subbuf / relay_switch_subbuf
* Struck through repros no longer work on HEAD.