[moderation] [block?] KCSAN: data-race in __mod_timer / blk_add_timer (12)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5f33ebd2018c Merge tag 'drm-fixes-2025-07-26' of https://g..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14cb48a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c0dd0a92e88efc24
dashboard link: https://syzkaller.appspot.com/bug?extid=d148993d55f8ebb8959c
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
CC: [ax...@kernel.dk linux...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a2f347399c41/disk-5f33ebd2.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e12f7c5c1db1/vmlinux-5f33ebd2.xz
kernel image: https://storage.googleapis.com/syzbot-assets/46d55ad8ba40/bzImage-5f33ebd2.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d14899...@syzkaller.appspotmail.com

==================================================================
BUG: KCSAN: data-race in __mod_timer / blk_add_timer

write to 0xffff8881023f4558 of 8 bytes by task 4967 on cpu 0:
__mod_timer+0x5a1/0x840 kernel/time/timer.c:1126
mod_timer+0x1f/0x30 kernel/time/timer.c:1195
blk_add_timer+0x182/0x1a0 block/blk-timeout.c:164
blk_mq_start_request+0x15b/0x3b0 block/blk-mq.c:1355
scsi_queue_rq+0x1479/0x19a0 drivers/scsi/scsi_lib.c:1867
blk_mq_dispatch_rq_list+0x2a3/0xf80 block/blk-mq.c:2118
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
__blk_mq_sched_dispatch_requests+0x7e5/0xc60 block/blk-mq-sched.c:307
blk_mq_sched_dispatch_requests+0x86/0x120 block/blk-mq-sched.c:329
blk_mq_run_hw_queue+0x17e/0x220 block/blk-mq.c:2356
blk_mq_dispatch_list+0x840/0xa10 arch/x86/include/asm/bitops.h:-1
blk_mq_flush_plug_list+0x2d8/0x330 block/blk-mq.c:2965
__blk_flush_plug+0x222/0x2a0 block/blk-core.c:1220
blk_finish_plug block/blk-core.c:1247 [inline]
__submit_bio+0x2fc/0x4d0 block/blk-core.c:649
__submit_bio_noacct_mq block/blk-core.c:722 [inline]
submit_bio_noacct_nocheck+0x208/0x6a0 block/blk-core.c:751
submit_bio_noacct+0x6c8/0x8f0 block/blk-core.c:874
submit_bio+0x227/0x240 block/blk-core.c:916
swap_read_folio_bdev_async mm/page_io.c:611 [inline]
swap_read_folio+0x875/0xff0 mm/page_io.c:653
swap_cluster_readahead+0x3c0/0x3e0 mm/swap_state.c:635
swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
do_swap_page+0x301/0x2430 mm/memory.c:4603
handle_pte_fault mm/memory.c:6072 [inline]
__handle_mm_fault mm/memory.c:6212 [inline]
handle_mm_fault+0x9a5/0x2be0 mm/memory.c:6381
do_user_addr_fault+0x3fe/0x1090 arch/x86/mm/fault.c:1387
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
__get_user_8+0x14/0x30 arch/x86/lib/getuser.S:100
fetch_robust_entry kernel/futex/core.c:1138 [inline]
exit_robust_list+0x31/0x280 kernel/futex/core.c:1166
futex_cleanup kernel/futex/core.c:1410 [inline]
futex_exit_release+0xe0/0x130 kernel/futex/core.c:1511
exit_mm_release+0x1a/0x30 kernel/fork.c:1441
exit_mm+0x38/0x190 kernel/exit.c:554
do_exit+0x417/0x1590 kernel/exit.c:952
do_group_exit+0xff/0x140 kernel/exit.c:1105
get_signal+0xe59/0xf70 kernel/signal.c:3034
arch_do_signal_or_restart+0x96/0x480 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x7a/0x100 kernel/entry/common.c:111
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x1d6/0x200 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881023f4558 of 8 bytes by task 3319 on cpu 1:
blk_add_timer+0x115/0x1a0 block/blk-timeout.c:-1
blk_mq_start_request+0x15b/0x3b0 block/blk-mq.c:1355
scsi_queue_rq+0x1479/0x19a0 drivers/scsi/scsi_lib.c:1867
blk_mq_dispatch_rq_list+0x2a3/0xf80 block/blk-mq.c:2118
__blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
__blk_mq_sched_dispatch_requests+0x7e5/0xc60 block/blk-mq-sched.c:307
blk_mq_sched_dispatch_requests+0x86/0x120 block/blk-mq-sched.c:329
blk_mq_run_hw_queue+0x17e/0x220 block/blk-mq.c:2356
blk_mq_dispatch_list+0x840/0xa10 arch/x86/include/asm/bitops.h:-1
blk_mq_flush_plug_list+0x2d8/0x330 block/blk-mq.c:2965
__blk_flush_plug+0x222/0x2a0 block/blk-core.c:1220
blk_finish_plug block/blk-core.c:1247 [inline]
__submit_bio+0x2fc/0x4d0 block/blk-core.c:649
__submit_bio_noacct_mq block/blk-core.c:722 [inline]
submit_bio_noacct_nocheck+0x208/0x6a0 block/blk-core.c:751
submit_bio_noacct+0x6c8/0x8f0 block/blk-core.c:874
submit_bio+0x227/0x240 block/blk-core.c:916
swap_read_folio_bdev_async mm/page_io.c:611 [inline]
swap_read_folio+0x875/0xff0 mm/page_io.c:653
swap_cluster_readahead+0x3c0/0x3e0 mm/swap_state.c:635
swapin_readahead+0xde/0x6f0 mm/swap_state.c:811
do_swap_page+0x301/0x2430 mm/memory.c:4603
handle_pte_fault mm/memory.c:6072 [inline]
__handle_mm_fault mm/memory.c:6212 [inline]
handle_mm_fault+0x9a5/0x2be0 mm/memory.c:6381
do_user_addr_fault+0x636/0x1090 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x62/0xa0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623

value changed: 0x00000000ffffa778 -> 0x00000000ffffaa21

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 3319 Comm: syz-executor Not tainted 6.16.0-rc7-syzkaller-00120-g5f33ebd2018c #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.