syzbot


KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore (3)

Status: moderation: reported on 2026/05/02 10:41
Subsystems: block
[Documentation on labels]
Reported-by: syzbot+c392d7f25c4cb962cf09@syzkaller.appspotmail.com
First crash: 2h44m, last: 2h44m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
368ebbd0-c179-4e27-85e6-59e1d6bb9840 assessment-kcsan Benign: ✅  Confident: ✅  KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore (3) 2026/05/02 10:41 2026/05/02 10:41 2026/05/02 11:00 753c55b9fb3983f31c253085b34a2be4a0022d54
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore (2) block 6 5 135d 240d 0/29 auto-obsoleted due to no activity on 2026/02/12 04:39
upstream KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore block 6 1 391d 391d 0/29 auto-obsoleted due to no activity on 2025/06/01 08:09

Sample crash report:
==================================================================
BUG: KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore

read-write to 0xffff888101f34db4 of 4 bytes by task 4500 on cpu 1:
 __blk_mq_unfreeze_queue block/blk-mq.c:218 [inline]
 blk_mq_unfreeze_queue_nomemrestore+0x38/0xc0 block/blk-mq.c:232
 blk_mq_unfreeze_queue include/linux/blk-mq.h:962 [inline]
 loop_set_status+0x3a2/0x6a0 drivers/block/loop.c:1266
 loop_set_status_old drivers/block/loop.c:1362 [inline]
 lo_ioctl+0x799/0x13a0 drivers/block/loop.c:1551
 blkdev_ioctl+0x387/0x460 block/ioctl.c:797
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x1563/0x3020 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888101f34db4 of 4 bytes by task 4497 on cpu 0:
 __bio_queue_enter+0x279/0x5a0 block/blk-core.c:353
 bio_queue_enter block/blk.h:93 [inline]
 blk_mq_submit_bio+0x198/0x1130 block/blk-mq.c:3175
 __submit_bio+0x103/0x4f0 block/blk-core.c:635
 __submit_bio_noacct_mq block/blk-core.c:722 [inline]
 submit_bio_noacct_nocheck+0x153/0x620 block/blk-core.c:753
 submit_bio_noacct+0x746/0x980 block/blk-core.c:884
 submit_bio+0x2a4/0x2c0 block/blk-core.c:926
 mpage_bio_submit_read fs/mpage.c:74 [inline]
 mpage_readahead+0x295/0x2e0 fs/mpage.c:379
 blkdev_readahead+0x1c/0x30 block/fops.c:499
 read_pages+0xa3/0x480 mm/readahead.c:163
 page_cache_ra_unbounded+0x357/0x420 mm/readahead.c:304
 do_page_cache_ra mm/readahead.c:334 [inline]
 page_cache_ra_order+0x153/0x220 mm/readahead.c:538
 page_cache_async_ra+0x383/0x4b0 mm/readahead.c:700
 filemap_readahead mm/filemap.c:2664 [inline]
 filemap_get_pages+0x596/0x1250 mm/filemap.c:2710
 filemap_splice_read+0x3c6/0x780 mm/filemap.c:3085
 do_splice_read fs/splice.c:980 [inline]
 splice_direct_to_actor+0x26e/0x670 fs/splice.c:1084
 do_splice_direct_actor fs/splice.c:1202 [inline]
 do_splice_direct+0x119/0x1a0 fs/splice.c:1228
 do_sendfile+0x382/0x650 fs/read_write.c:1372
 __do_sys_sendfile64 fs/read_write.c:1433 [inline]
 __se_sys_sendfile64 fs/read_write.c:1419 [inline]
 __x64_sys_sendfile64+0x105/0x150 fs/read_write.c:1419
 x64_sys_call+0x2dc4/0x3020 arch/x86/include/generated/asm/syscalls_64.h:41
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4497 Comm: syz.5.241 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
==================================================================
syz.5.241 (4497) used greatest stack depth: 10008 bytes left

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/02 10:40 upstream f1a5e78a55eb a0d91488 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-kcsan-gce KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore
* Struck through repros no longer work on HEAD.