syzbot

==================================================================
BUG: KCSAN: data-race in blk_stat_add / blk_stat_timer_fn

read to 0xffffe8ffffd2c160 of 8 bytes by interrupt on cpu 0:
 blk_rq_stat_sum block/blk-stat.c:35 [inline]
 blk_rq_stat_sum block/blk-stat.c:29 [inline]
 blk_stat_timer_fn+0x222/0x3d0 block/blk-stat.c:93
 call_timer_fn+0x5f/0x2f0 kernel/time/timer.c:1404
 expire_timers kernel/time/timer.c:1449 [inline]
 __run_timers kernel/time/timer.c:1773 [inline]
 __run_timers kernel/time/timer.c:1740 [inline]
 run_timer_softirq+0xc0c/0xcd0 kernel/time/timer.c:1786
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0xe6/0x280 arch/x86/kernel/apic/apic.c:1137
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830
 find_watchpoint kernel/kcsan/core.c:67 [inline]
 check_access kernel/kcsan/core.c:388 [inline]
 __tsan_read8+0x16/0x1f0 kernel/kcsan/core.c:530
 compound_head include/linux/page-flags.h:174 [inline]
 PageAnon include/linux/page-flags.h:463 [inline]
 page_remove_rmap+0x56/0x770 mm/rmap.c:1304
 zap_pte_range mm/memory.c:1062 [inline]
 zap_pmd_range mm/memory.c:1166 [inline]
 zap_pud_range mm/memory.c:1195 [inline]
 zap_p4d_range mm/memory.c:1216 [inline]
 unmap_page_range+0xbab/0x18d0 mm/memory.c:1237
 unmap_single_vma+0x144/0x200 mm/memory.c:1282
 unmap_vmas+0xda/0x1a0 mm/memory.c:1314
 exit_mmap+0x13e/0x300 mm/mmap.c:3161
 __mmput kernel/fork.c:1079 [inline]
 mmput+0xea/0x280 kernel/fork.c:1100
 exit_mm kernel/exit.c:485 [inline]
 do_exit+0x4c9/0x18f0 kernel/exit.c:804
 do_group_exit+0xb4/0x1c0 kernel/exit.c:921
 get_signal+0x2a2/0x1320 kernel/signal.c:2734
 do_signal+0x3b/0xbf0 arch/x86/kernel/signal.c:815
 exit_to_usermode_loop+0x250/0x2c0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x353/0x370 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to 0xffffe8ffffd2c160 of 8 bytes by interrupt on cpu 1:
 blk_rq_stat_add block/blk-stat.c:46 [inline]
 blk_stat_add+0x1a6/0x290 block/blk-stat.c:73
 __blk_mq_end_request+0x22d/0x270 block/blk-mq.c:549
 scsi_end_request+0x20e/0x3e0 drivers/scsi/scsi_lib.c:613
 scsi_io_completion+0x11d/0xc80 drivers/scsi/scsi_lib.c:963
 scsi_finish_command+0x280/0x380 drivers/scsi/scsi.c:228
 scsi_softirq_done+0x259/0x280 drivers/scsi/scsi_lib.c:1477
 blk_done_softirq+0x1eb/0x250 block/blk-softirq.c:37
 __do_softirq+0x115/0x33f kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0xbb/0xe0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 do_IRQ+0xa6/0x180 arch/x86/kernel/irq.c:263
 ret_from_intr+0x0/0x19
 arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline]
 kcsan_setup_watchpoint+0x205/0x410 kernel/kcsan/core.c:369
 check_access kernel/kcsan/core.c:409 [inline]
 __tsan_unaligned_write8+0x143/0x1f0 kernel/kcsan/core.c:530
 ext4_es_lookup_extent+0x3d6/0x580 fs/ext4/extents_status.c:948
 ext4_map_blocks+0xbd/0xfa0 fs/ext4/inode.c:530
 ext4_getblk+0x30b/0x380 fs/ext4/inode.c:974
 ext4_bread_batch+0x8a/0x370 fs/ext4/inode.c:1044
 __ext4_find_entry+0x32f/0x970 fs/ext4/namei.c:1518
 ext4_find_entry+0xc5/0x140 fs/ext4/namei.c:1596
 ext4_rmdir fs/ext4/namei.c:3074 [inline]
 ext4_rmdir+0x112/0x6e0 fs/ext4/namei.c:3053
 vfs_rmdir fs/namei.c:3870 [inline]
 vfs_rmdir+0x119/0x300 fs/namei.c:3849
 do_rmdir+0x2cb/0x300 fs/namei.c:3932
 __do_sys_rmdir fs/namei.c:3950 [inline]
 __se_sys_rmdir fs/namei.c:3948 [inline]
 __x64_sys_rmdir+0x2f/0x40 fs/namei.c:3948
 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 8024 Comm: syz-executor.5 Not tainted 5.4.0-rc6+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================