KCSAN: data-race in blk_stat_add / blk_stat_timer

KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (3)
Status: auto-closed as invalid on 2020/08/07 01:06
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 447d, last: 446d

similar bugs (5):
Kernel	Title	Count	Last	Reported	Patched	Status
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (5)	12	237d	228d	0/22	auto-closed as invalid on 2021/03/03 15:50
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (4)	5	357d	383d	0/22	auto-closed as invalid on 2020/11/04 06:43
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (6)	2	181d	191d	0/22	auto-closed as invalid on 2021/05/17 11:06
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn	10	682d	698d	0/22	closed as invalid on 2019/11/19 14:44
upstream	KCSAN: data-race in blk_stat_add / blk_stat_timer_fn (2)	22	532d	672d	0/22	auto-closed as invalid on 2020/06/16 18:43

Sample crash report:

==================================================================
BUG: KCSAN: data-race in blk_stat_add / blk_stat_timer_fn

write to 0xffffe8ffffd30620 of 8 bytes by interrupt on cpu 0:
 blk_rq_stat_init block/blk-stat.c:24 [inline]
 blk_stat_timer_fn+0x349/0x410 block/blk-stat.c:95
 call_timer_fn+0x30/0x2a0 kernel/time/timer.c:1404
 expire_timers+0x116/0x290 kernel/time/timer.c:1449
 __run_timers+0x443/0x500 kernel/time/timer.c:1773
 run_timer_softirq+0x2e/0x60 kernel/time/timer.c:1786
 __do_softirq+0x198/0x360 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x5d/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:417
 sysvec_apic_timer_interrupt+0xba/0xd0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596

read to 0xffffe8ffffd30620 of 8 bytes by interrupt on cpu 1:
 blk_rq_stat_add block/blk-stat.c:46 [inline]
 blk_stat_add+0x13d/0x240 block/blk-stat.c:74
 __blk_mq_end_request+0x142/0x260 block/blk-mq.c:552
 scsi_end_request+0x29c/0x3e0 drivers/scsi/scsi_lib.c:592
 scsi_io_completion+0x105/0xf40 drivers/scsi/scsi_lib.c:934
 scsi_finish_command+0x277/0x2c0 drivers/scsi/scsi.c:214
 scsi_softirq_done+0x271/0x400 drivers/scsi/scsi_lib.c:1460
 blk_done_softirq+0x1a5/0x200 block/blk-softirq.c:37
 __do_softirq+0x198/0x360 kernel/softirq.c:292
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 do_softirq_own_stack+0x5d/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:387 [inline]
 __irq_exit_rcu+0x115/0x120 kernel/softirq.c:417
 sysvec_apic_timer_interrupt+0xba/0xd0 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
 arch_local_irq_enable arch/x86/include/asm/paravirt.h:775 [inline]
 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
 _raw_spin_unlock_irq+0x41/0x70 kernel/locking/spinlock.c:199
 spin_unlock_irq include/linux/spinlock.h:403 [inline]
 isolate_lru_page+0x3a0/0x430 mm/vmscan.c:1785
 mlock_vma_page+0x11c/0x180 mm/mlock.c:100
 follow_page_pte+0xaf9/0xd20 mm/gup.c:538
 follow_pmd_mask+0x53b/0x1130 mm/gup.c:609
 follow_pud_mask mm/gup.c:704 [inline]
 follow_p4d_mask mm/gup.c:730 [inline]
 follow_page_mask+0x3ca/0x590 mm/gup.c:789
 __get_user_pages+0xa7d/0x1150 mm/gup.c:1111
 populate_vma_page_range mm/gup.c:1452 [inline]
 __mm_populate+0x256/0x340 mm/gup.c:1500
 mm_populate include/linux/mm.h:2605 [inline]
 __do_sys_mlockall mm/mlock.c:823 [inline]
 __se_sys_mlockall+0x256/0x280 mm/mlock.c:799
 __x64_sys_mlockall+0x1b/0x20 mm/mlock.c:799
 do_syscall_64+0x51/0xb0 arch/x86/entry/common.c:359
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 12945 Comm: syz-executor.0 Not tainted 5.8.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci2-upstream-kcsan-gce	2020/07/03 01:00	upstream	7cc2a8ea1048	f30c14bf	.config	log	report
ci2-upstream-kcsan-gce	2020/07/02 11:59	upstream	cd77006e01b3	f30c14bf	.config	log	report