KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 111e91a6 Merge tag 's390-5.10-4' of git://git.kernel.org/p..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17843d41500000
kernel config: https://syzkaller.appspot.com/x/.config?x=e0bbcd06922dbd46
dashboard link: https://syzkaller.appspot.com/bug?extid=63d0cdba59e9dfeade1d
compiler: clang version 12.0.0 (https://github.com/llvm/llvm-project.git 913f6005669cfb590c99865a90bc51ed0983d09d)
CC: [jaso...@redhat.com linux-...@vger.kernel.org m...@redhat.com virtual...@lists.linux-foundation.org]

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+63d0cd...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in virtqueue_disable_cb / virtqueue_enable_cb_delayed

write to 0xffff888141f5c730 of 2 bytes by task 8457 on cpu 0:
virtqueue_enable_cb_delayed_split drivers/virtio/virtio_ring.c:795 [inline]
virtqueue_enable_cb_delayed+0x253/0x390 drivers/virtio/virtio_ring.c:2009
start_xmit+0xda/0xa80 drivers/net/virtio_net.c:1593
__netdev_start_xmit include/linux/netdevice.h:4718 [inline]
netdev_start_xmit include/linux/netdevice.h:4732 [inline]
xmit_one+0xf9/0x2e0 net/core/dev.c:3564
dev_hard_start_xmit+0x72/0x120 net/core/dev.c:3580
sch_direct_xmit+0x170/0x730 net/sched/sch_generic.c:313
qdisc_restart net/sched/sch_generic.c:376 [inline]
__qdisc_run+0x119/0x180 net/sched/sch_generic.c:384
qdisc_run include/net/pkt_sched.h:131 [inline]
__dev_xmit_skb net/core/dev.c:3755 [inline]
__dev_queue_xmit+0xa62/0x1510 net/core/dev.c:4108
dev_queue_xmit+0x13/0x20 net/core/dev.c:4173
neigh_hh_output include/net/neighbour.h:498 [inline]
neigh_output include/net/neighbour.h:507 [inline]
ip_finish_output2+0xb09/0xba0 net/ipv4/ip_output.c:230
__ip_finish_output+0x3d8/0x430 net/ipv4/ip_output.c:308
ip_finish_output+0x39/0x160 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:290 [inline]
ip_output+0xf6/0x1a0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:443 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0x9ca/0x9f0 net/ipv4/ip_output.c:532
ip_queue_xmit+0x34/0x40 net/ipv4/ip_output.c:546
__tcp_transmit_skb+0x1250/0x1860 net/ipv4/tcp_output.c:1404
__tcp_send_ack+0x1e9/0x2e0 net/ipv4/tcp_output.c:3967
tcp_send_ack+0x23/0x30 net/ipv4/tcp_output.c:3973
tcp_cleanup_rbuf+0x1c4/0x310 net/ipv4/tcp.c:1584
tcp_recvmsg+0x1119/0x1c10 net/ipv4/tcp.c:2251
inet_recvmsg+0xa3/0x210 net/ipv4/af_inet.c:848
sock_recvmsg_nosec net/socket.c:885 [inline]
sock_recvmsg net/socket.c:903 [inline]
sock_read_iter+0x19e/0x1e0 net/socket.c:976
call_read_iter include/linux/fs.h:1897 [inline]
new_sync_read fs/read_write.c:415 [inline]
vfs_read+0x552/0x5c0 fs/read_write.c:496
ksys_read+0xce/0x180 fs/read_write.c:634
__do_sys_read fs/read_write.c:644 [inline]
__se_sys_read fs/read_write.c:642 [inline]
__x64_sys_read+0x3e/0x50 fs/read_write.c:642
do_syscall_64+0x39/0x80 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9

read to 0xffff888141f5c730 of 2 bytes by interrupt on cpu 1:
virtqueue_disable_cb_split drivers/virtio/virtio_ring.c:740 [inline]
virtqueue_disable_cb+0x66/0x120 drivers/virtio/virtio_ring.c:1925
virtqueue_napi_schedule drivers/net/virtio_net.c:323 [inline]
skb_xmit_done+0xa5/0x110 drivers/net/virtio_net.c:351
vring_interrupt+0x11e/0x140 drivers/virtio/virtio_ring.c:2049
__handle_irq_event_percpu+0x93/0x450 kernel/irq/handle.c:156
handle_irq_event_percpu kernel/irq/handle.c:196 [inline]
handle_irq_event+0x81/0x120 kernel/irq/handle.c:213
handle_edge_irq+0x16e/0x590 kernel/irq/chip.c:819
asm_call_irq_on_stack+0xf/0x20
__run_irq_on_irqstack arch/x86/include/asm/irq_stack.h:48 [inline]
run_irq_on_irqstack_cond arch/x86/include/asm/irq_stack.h:101 [inline]
handle_irq arch/x86/kernel/irq.c:230 [inline]
__common_interrupt arch/x86/kernel/irq.c:249 [inline]
common_interrupt+0x8e/0x130 arch/x86/kernel/irq.c:239
asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:622
native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
acpi_idle_do_entry drivers/acpi/processor_idle.c:517 [inline]
acpi_idle_enter+0x25b/0x2e0 drivers/acpi/processor_idle.c:648
cpuidle_enter_state+0x2bd/0x750 drivers/cpuidle/cpuidle.c:237
cpuidle_enter+0x3c/0x60 drivers/cpuidle/cpuidle.c:351
call_cpuidle kernel/sched/idle.c:132 [inline]
cpuidle_idle_call kernel/sched/idle.c:213 [inline]
do_idle+0x193/0x230 kernel/sched/idle.c:273
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:369
secondary_startup_64_no_verify+0xb0/0xbb

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.10.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.