[moderation] [rtc?] KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5d12ed4bea43 Merge tag 'i2c-for-6.9-rc6' of git://git.kern..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=170e80a7180000
kernel config: https://syzkaller.appspot.com/x/.config?x=566553eb991172d
dashboard link: https://syzkaller.appspot.com/bug?extid=c28e88b867407184ed12
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [alexandr...@bootlin.com linux-...@vger.kernel.org linu...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3aedbb9f245a/disk-5d12ed4b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/25fd9f016651/vmlinux-5d12ed4b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/088ee07a221e/bzImage-5d12ed4b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c28e88...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in rtc_dev_poll / rtc_pie_update_irq

read-write to 0xffff8881029f3b88 of 8 bytes by interrupt on cpu 1:
rtc_handle_legacy_irq drivers/rtc/interface.c:623 [inline]
rtc_pie_update_irq+0x95/0xf0 drivers/rtc/interface.c:671
__run_hrtimer kernel/time/hrtimer.c:1692 [inline]
__hrtimer_run_queues+0x214/0x5e0 kernel/time/hrtimer.c:1756
hrtimer_interrupt+0x210/0x7b0 kernel/time/hrtimer.c:1818
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
__sysvec_apic_timer_interrupt+0x5c/0x1a0 arch/x86/kernel/apic/apic.c:1049
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0x32/0x80 arch/x86/kernel/apic/apic.c:1043
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
blk_account_io_done+0x270/0x350 block/blk-mq.c:1002
__blk_mq_end_request_acct block/blk-mq.c:1032 [inline]
__blk_mq_end_request+0x1de/0x390 block/blk-mq.c:1038
scsi_end_request+0x299/0x4d0 drivers/scsi/scsi_lib.c:665
scsi_io_completion+0x9f/0x200 drivers/scsi/scsi_lib.c:1068
scsi_finish_command+0x1be/0x1d0 drivers/scsi/scsi.c:198
scsi_complete+0x19a/0x1d0 drivers/scsi/scsi_lib.c:1530
blk_complete_reqs block/blk-mq.c:1129 [inline]
blk_done_softirq+0x74/0xb0 block/blk-mq.c:1134
__do_softirq+0xc8/0x285 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:633 [inline]
irq_exit_rcu+0x3c/0x90 kernel/softirq.c:645
common_interrupt+0x81/0x90 arch/x86/kernel/irq.c:247
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
kcsan_setup_watchpoint+0x404/0x410 kernel/kcsan/core.c:705
crc32_body lib/crc32.c:110 [inline]
crc32_le_generic lib/crc32.c:179 [inline]
__crc32c_le_base+0x10e/0x520 lib/crc32.c:201
chksum_update+0x32/0x50 crypto/crc32c_generic.c:88
crypto_shash_update+0x4a/0x60 crypto/shash.c:70
ext4_chksum fs/ext4/ext4.h:2476 [inline]
ext4_dirblock_csum fs/ext4/namei.c:382 [inline]
ext4_dirblock_csum_set fs/ext4/namei.c:430 [inline]
ext4_handle_dirty_dirblock+0x271/0x350 fs/ext4/namei.c:438
add_dirent_to_buf+0x342/0x440 fs/ext4/namei.c:2214
ext4_add_entry+0x3a6/0x1ec0 fs/ext4/namei.c:2444
ext4_mkdir+0x36f/0x740 fs/ext4/namei.c:3028
vfs_mkdir+0x1f7/0x300 fs/namei.c:4123
do_mkdirat+0x12f/0x2a0 fs/namei.c:4146
__do_sys_mkdir fs/namei.c:4166 [inline]
__se_sys_mkdir fs/namei.c:4164 [inline]
__x64_sys_mkdir+0x44/0x50 fs/namei.c:4164
x64_sys_call+0x10aa/0x2d30 arch/x86/include/generated/asm/syscalls_64.h:84
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x1d0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881029f3b88 of 8 bytes by task 21068 on cpu 0:
rtc_dev_poll+0x7c/0xb0 drivers/rtc/dev.c:198
vfs_poll include/linux/poll.h:84 [inline]
__io_arm_poll_handler+0x229/0xf30 io_uring/poll.c:622
io_poll_add+0xb9/0x140 io_uring/poll.c:983
io_issue_sqe+0x153/0x600 io_uring/io_uring.c:1897
io_queue_sqe io_uring/io_uring.c:2111 [inline]
io_req_task_submit+0xb0/0x110 io_uring/io_uring.c:1510
io_poll_task_func+0x760/0x910
io_handle_tw_list+0x114/0x240 io_uring/io_uring.c:1198
tctx_task_work_run+0x6c/0x1b0 io_uring/io_uring.c:1270
tctx_task_work+0x40/0x80 io_uring/io_uring.c:1288
task_work_run+0x13a/0x1a0 kernel/task_work.c:180
get_signal+0xeee/0x1080 kernel/signal.c:2683
arch_do_signal_or_restart+0x95/0x4b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x59/0x130 kernel/entry/common.c:218
do_syscall_64+0xda/0x1d0 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x000000000005fbc0 -> 0x000000000005fcc0

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 21068 Comm: syz-executor.2 Not tainted 6.9.0-rc5-syzkaller-00329-g5d12ed4bea43 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.