[PATCH] workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection

[PATCH] workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection

[Breno Leitao]

The automatic CPU-intensive work item detection reads the worker task's
se.sum_exec_runtime without a lock in wq_worker_running(),
wq_worker_tick() and process_one_work(). The scheduler updates that
field under the rq lock (from the tick via update_curr(), or cross-CPU
via task_sched_runtime()), raising:

  BUG: KCSAN: data-race in wq_worker_running+0xa8/0xe8

  race at unknown origin, with read to 0xffff0009a11d1df8 of 8 bytes by task 238535 on cpu 68:
   wq_worker_running
   schedule
   schedule_preempt_disabled
   __mutex_lock
   mutex_lock_nested
   cgroup_bpf_release
   process_one_work
   worker_thread
   kthread
   ret_from_fork

  value changed: 0x0000000088482ba0 -> 0x00000000884893c0

The value only feeds a heuristic, so the race is benign-ish. Unlike
commit ecf5aad9a441 ("workqueue: annotate racy PWQ_STAT_CPU_TIME update
in wq_worker_tick()") that only needs data_race(), these are plain reads
whose result drives a subtraction and comparison, so use READ_ONCE() for
a single, non-torn load, which also silences KCSAN.

Signed-off-by: Breno Leitao <leitao@debian.org>
---
 kernel/workqueue.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index 0ffe104fe213d..c85a158696acf 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1468,7 +1468,7 @@ void wq_worker_running(struct task_struct *task)
 	 * CPU intensive auto-detection cares about how long a work item hogged
 	 * CPU without sleeping. Reset the starting timestamp on wakeup.
 	 */
-	worker->current_at = worker->task->se.sum_exec_runtime;
+	worker->current_at = READ_ONCE(worker->task->se.sum_exec_runtime);
 
 	WRITE_ONCE(worker->sleeping, 0);
 }
@@ -1553,7 +1553,7 @@ void wq_worker_tick(struct task_struct *task)
 	 * We probably want to make this prettier in the future.
 	 */
 	if ((worker->flags & WORKER_NOT_RUNNING) || READ_ONCE(worker->sleeping) ||
-	    worker->task->se.sum_exec_runtime - worker->current_at <
+	    READ_ONCE(worker->task->se.sum_exec_runtime) - worker->current_at <
 	    wq_cpu_intensive_thresh_us * NSEC_PER_USEC)
 		return;
 
@@ -3294,7 +3294,7 @@ __acquires(&pool->lock)
 	worker->current_func = work->func;
 	worker->current_pwq = pwq;
 	if (worker->task)
-		worker->current_at = worker->task->se.sum_exec_runtime;
+		worker->current_at = READ_ONCE(worker->task->se.sum_exec_runtime);
 	worker->current_start = jiffies;
 	work_data = *work_data_bits(work);
 	worker->current_color = get_work_color(work_data);

---
base-commit: 6eb8711ece2ce27e52e327a5b7a628ed39b97f45
change-id: 20260703-wq-sum-exec-runtime-ace5c65339ec

Best regards,
--  
Breno Leitao <leitao@debian.org>

Re: [PATCH] workqueue: annotate racy sum_exec_runtime reads for CPU-intensive detection

[Tejun Heo]

Applied to wq/for-7.3.

Thanks.