syzbot


KCSAN: data-race in dd_has_work / deadline_remove_request (6)

Status: auto-closed as invalid on 2021/09/03 05:59
Reported-by: syzbot+@syzkaller.appspotmail.com
First crash: 524d, last: 492d
similar bugs (7):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in dd_has_work / deadline_remove_request 2 922d 925d 0/24 closed as invalid on 2020/06/18 14:13
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (8) 8 206d 264d 0/24 auto-closed as invalid on 2022/06/12 02:20
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (4) 1 663d 663d 0/24 auto-closed as invalid on 2021/03/12 01:36
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (7) 8 322d 401d 0/24 auto-closed as invalid on 2022/02/16 12:39
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (5) 2 587d 617d 0/24 auto-closed as invalid on 2021/05/27 11:41
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (2) 10 795d 882d 0/24 auto-closed as invalid on 2020/10/31 03:43
upstream KCSAN: data-race in dd_has_work / deadline_remove_request (3) 6 723d 723d 0/24 auto-closed as invalid on 2021/01/11 08:35

Sample crash report:
==================================================================
BUG: KCSAN: data-race in dd_has_work / deadline_remove_request

write to 0xffff888101a7ee90 of 8 bytes by task 1001 on cpu 0:
 __list_del include/linux/list.h:112 [inline]
 __list_del_entry include/linux/list.h:135 [inline]
 list_del_init include/linux/list.h:204 [inline]
 deadline_remove_request+0x58/0x180 block/mq-deadline-main.c:198
 deadline_move_request block/mq-deadline-main.c:274 [inline]
 __dd_dispatch_request+0x3d3/0x4b0 block/mq-deadline-main.c:472
 dd_dispatch_request+0x138/0x1e0 block/mq-deadline-main.c:518
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:149 [inline]
 blk_mq_do_dispatch_sched+0x1e4/0x640 block/blk-mq-sched.c:214
 __blk_mq_sched_dispatch_requests+0x1eb/0x290 block/blk-mq-sched.c:329
 blk_mq_sched_dispatch_requests+0x9f/0x110 block/blk-mq-sched.c:360
 __blk_mq_run_hw_queue+0xbc/0x140 block/blk-mq.c:1500
 blk_mq_run_work_fn+0x3d/0x50 block/blk-mq.c:1832
 process_one_work+0x3e9/0x8f0 kernel/workqueue.c:2276
 worker_thread+0x636/0xae0 kernel/workqueue.c:2422
 kthread+0x262/0x280 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

read to 0xffff888101a7ee90 of 8 bytes by task 23405 on cpu 1:
 list_empty_careful include/linux/list.h:319 [inline]
 dd_has_work_for_prio block/mq-deadline-main.c:841 [inline]
 dd_has_work+0x187/0x260 block/mq-deadline-main.c:850
 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:137 [inline]
 blk_mq_do_dispatch_sched+0x12a/0x640 block/blk-mq-sched.c:214
 __blk_mq_sched_dispatch_requests+0x1eb/0x290 block/blk-mq-sched.c:329
 blk_mq_sched_dispatch_requests+0x9f/0x110 block/blk-mq-sched.c:360
 __blk_mq_run_hw_queue+0xbc/0x140 block/blk-mq.c:1500
 __blk_mq_delay_run_hw_queue+0x163/0x2f0 block/blk-mq.c:1577
 blk_mq_run_hw_queue+0x22c/0x250 block/blk-mq.c:1630
 blk_mq_sched_insert_requests+0x12b/0x1f0 block/blk-mq-sched.c:513
 blk_mq_flush_plug_list+0x2f2/0x3c0 block/blk-mq.c:1955
 blk_flush_plug_list+0x235/0x260 block/blk-core.c:1731
 blk_finish_plug+0x44/0x60 block/blk-core.c:1748
 read_pages+0x2d9/0x530 mm/readahead.c:150
 page_cache_ra_unbounded+0x15a/0x410 mm/readahead.c:210
 do_page_cache_ra mm/readahead.c:267 [inline]
 force_page_cache_ra+0x246/0x280 mm/readahead.c:299
 page_cache_sync_ra+0xcc/0xe0 mm/readahead.c:573
 page_cache_sync_readahead include/linux/pagemap.h:884 [inline]
 filemap_get_pages mm/filemap.c:2467 [inline]
 filemap_read+0x388/0x1220 mm/filemap.c:2550
 generic_file_read_iter+0x75/0x2c0 mm/filemap.c:2701
 blkdev_read_iter+0xb9/0xf0 fs/block_dev.c:1669
 call_read_iter include/linux/fs.h:2108 [inline]
 new_sync_read fs/read_write.c:415 [inline]
 vfs_read+0x565/0x5d0 fs/read_write.c:496
 ksys_read+0xce/0x180 fs/read_write.c:634
 __do_sys_read fs/read_write.c:644 [inline]
 __se_sys_read fs/read_write.c:642 [inline]
 __x64_sys_read+0x3e/0x50 fs/read_write.c:642
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

value changed: 0xffff888101b40648 -> 0xffff888101a7ee88

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 23405 Comm: systemd-udevd Not tainted 5.14.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================

Crashes (7):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-upstream-kcsan-gce 2021/07/26 03:06 upstream ff1176468d36 4d1b57d4 .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/07/15 16:05 upstream 8096acd7442e f115ae98 .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/07/12 05:29 upstream e73f0f0ee754 a4869c92 .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/07/09 20:32 upstream 3dbdb38e2869 8f5a7b8c .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/07/09 08:30 upstream 3dbdb38e2869 281e815f .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/07/08 20:12 upstream 3dbdb38e2869 1b20171a .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
ci2-upstream-kcsan-gce 2021/06/24 20:49 upstream 4a09d388f2ab 0edbbe31 .config log report info KCSAN: data-race in dd_has_work / deadline_remove_request
* Struck through repros no longer work on HEAD.