From: Tao Cui <cui.tao@linux.dev>
To: tj@kernel.org, axboe@kernel.dk
Cc: josef@toxicpanda.com, cgroups@vger.kernel.org,
linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
cui.tao@linux.dev, Tao Cui <cuitao@kylinos.cn>
Subject: [PATCH] block/blk-iocost: fix KCSAN data-race on iocg->cursor
Date: Fri, 31 Jul 2026 21:40:00 +0800 [thread overview]
Message-ID: <20260731134000.70069-1-cui.tao@linux.dev> (raw)
From: Tao Cui <cuitao@kylinos.cn>
iocg->cursor is read in calc_vtime_cost_builtin() and written per-bio
in ioc_rqos_throttle()/ioc_rqos_merge() without a lock, which trips
KCSAN:
BUG: KCSAN: data-race in calc_vtime_cost_builtin / ioc_rqos_throttle
Found via KCSAN (null_blk + sustained IO under CONFIG_KCSAN).
The races are intentional: cursor is a best-effort randio detector, so
stale values only add minor cost-estimate noise. Mark the accesses with
READ_ONCE()/WRITE_ONCE(), consistent with other racy iocost fields
(active, inuse, abs_vdebt).
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
block/blk-iocost.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
diff --git a/block/blk-iocost.c b/block/blk-iocost.c
index 8b2aeba2e1e3..ae0d34609144 100644
--- a/block/blk-iocost.c
+++ b/block/blk-iocost.c
@@ -2552,9 +2552,13 @@ static void calc_vtime_cost_builtin(struct bio *bio, struct ioc_gq *iocg,
goto out;
}
- if (iocg->cursor) {
- seek_pages = abs(bio->bi_iter.bi_sector - iocg->cursor);
- seek_pages >>= IOC_SECT_TO_PAGE_SHIFT;
+ {
+ sector_t cursor = READ_ONCE(iocg->cursor);
+
+ if (cursor) {
+ seek_pages = abs(bio->bi_iter.bi_sector - cursor);
+ seek_pages >>= IOC_SECT_TO_PAGE_SHIFT;
+ }
}
if (!is_merge) {
@@ -2708,7 +2712,7 @@ static void ioc_rqos_throttle(struct rq_qos *rqos, struct bio *bio)
if (!iocg_activate(iocg, &now))
return;
- iocg->cursor = bio_end_sector(bio);
+ WRITE_ONCE(iocg->cursor, bio_end_sector(bio));
vtime = atomic64_read(&iocg->vtime);
cost = adjust_inuse_and_calc_cost(iocg, vtime, abs_cost, &now);
@@ -2797,8 +2801,8 @@ static void ioc_rqos_merge(struct rq_qos *rqos, struct request *rq,
/* update cursor if backmerging into the request at the cursor */
if (blk_rq_pos(rq) < bio_end &&
- blk_rq_pos(rq) + blk_rq_sectors(rq) == iocg->cursor)
- iocg->cursor = bio_end;
+ blk_rq_pos(rq) + blk_rq_sectors(rq) == READ_ONCE(iocg->cursor))
+ WRITE_ONCE(iocg->cursor, bio_end);
/*
* Charge if there's enough vtime budget and the existing request has
--
2.43.0
reply other threads:[~2026-07-31 13:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731134000.70069-1-cui.tao@linux.dev \
--to=cui.tao@linux.dev \
--cc=axboe@kernel.dk \
--cc=cgroups@vger.kernel.org \
--cc=cuitao@kylinos.cn \
--cc=josef@toxicpanda.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=tj@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox