[PATCH RFC 0/3] virtio: silence KCSAN warnings

[PATCH RFC 0/3] virtio: silence KCSAN warnings

[Johannes Thumshirn]

When booting a Qemu VM whith KCSAN to debug filesystem races I
encountered a bunch of KCSAN splats in virtio.

I suspect them to be false positives.

I decided to send this as an RFC patchset, as I have no prior knowledge
of virtio.

Johannes Thumshirn (3):
  virtio: silence KCSAN warning in virtqueue_kick_prepare
  virtio: silence KCSAN warning in virtqueue_get_buf_ctx_split
  virtio: silence KCSAN warning in vring_interrupt

 drivers/virtio/virtio_ring.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

-- 
2.52.0

[PATCH RFC 1/3] virtio: silence KCSAN warning in virtqueue_kick_prepare

[Johannes Thumshirn]

When booting a Qemu VM with virtio-blk and KCSAN enabled, KCSAN emits
the following warning about a data-race in virtqueue_kick_prepare().

 ==================================================================
 BUG: KCSAN: data-race in virtqueue_kick_prepare+0x14d/0x200

 race at unknown origin, with read to 0xffff888101cd6d44 of 2 bytes by task 162 on cpu 0:
  virtqueue_kick_prepare+0x14d/0x200
  virtio_fs_enqueue_req+0x664/0x7d0
  virtio_fs_send_req+0xac/0x230
  __fuse_simple_request+0x1e1/0x580
  fuse_readlink_folio+0x1dc/0x2a0
  fuse_get_link+0xd6/0x190
  vfs_get_link+0x70/0x80
  ovl_get_link+0x4d/0x90
  pick_link+0x2c6/0x6a0
  step_into_slowpath+0x2ea/0x590
  path_openat+0x5bf/0x1b30
  do_filp_open+0x177/0x260
  do_sys_openat2+0x69/0xc0
  __x64_sys_openat+0x7a/0xc0
  x64_sys_call+0x10cf/0x1c30
  do_syscall_64+0x5d/0x240
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

 value changed: 0x0e63 -> 0x0e65

 Reported by Kernel Concurrency Sanitizer on:
 CPU: 0 UID: 0 PID: 162 Comm: systemctl Not tainted 6.19.0-rc7+ #220 PREEMPT(none)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025
 ==================================================================

This warning is likely a false positive as the change happens on the
virtio vring.

Annotate the return of vring_avail_event() with data_race() to silence
the warning.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 drivers/virtio/virtio_ring.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index ddab68959671..5f8c8254bb6c 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -736,9 +736,10 @@ static bool virtqueue_kick_prepare_split(struct virtqueue *_vq)
 	LAST_ADD_TIME_INVALID(vq);
 
 	if (vq->event) {
-		needs_kick = vring_need_event(virtio16_to_cpu(_vq->vdev,
-					vring_avail_event(&vq->split.vring)),
-					      new, old);
+		needs_kick = vring_need_event(
+			virtio16_to_cpu(_vq->vdev, data_race(vring_avail_event(
+							   &vq->split.vring))),
+			new, old);
 	} else {
 		needs_kick = !(vq->split.vring.used->flags &
 					cpu_to_virtio16(_vq->vdev,
-- 
2.52.0

[PATCH RFC 2/3] virtio: silence KCSAN warning in virtqueue_get_buf_ctx_split

[Johannes Thumshirn]

When booting a Qemu VM with virtio-blk and KCSAN enabled, KCSAN emits
the following warning about a data-race in virtqueue_get_buf_ctx_split().

 ==================================================================
 BUG: KCSAN: data-race in virtqueue_get_buf_ctx_split+0x6e/0x260

 race at unknown origin, with read to 0xffff8881020f1942 of 2 bytes by task 1 on cpu 7:
  virtqueue_get_buf_ctx_split+0x6e/0x260
  virtqueue_get_buf+0x4b/0x60
  __send_to_port+0x156/0x170
  put_chars+0xcb/0x110
  hvc_console_print+0x1d6/0x2a0
  console_flush_one_record+0x3dd/0x510
  console_unlock+0x8c/0x160
  vprintk_emit+0x2fe/0x380
  vprintk_default+0x1d/0x30
  vprintk+0xe/0x20
  _printk+0x4c/0x60
  btrfs_test_raid_stripe_tree+0x25/0x90
  btrfs_run_sanity_tests.cold+0xf1/0x13b
  init_btrfs_fs+0x73/0x110
  do_one_initcall+0x5b/0x2d0
  kernel_init_freeable+0x2a2/0x340
  kernel_init+0x1e/0x1b0
  ret_from_fork+0x137/0x1b0
  ret_from_fork_asm+0x1a/0x30

 value changed: 0x0160 -> 0x0161

 Reported by Kernel Concurrency Sanitizer on:
 CPU: 7 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0-rc7+ #219 PREEMPT(none)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025
 ==================================================================

This warning is likely a false positive as the change happens on the
virtio vring.

Annotate the return of more_used_split() with data_race() to silence
the warning.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 drivers/virtio/virtio_ring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 5f8c8254bb6c..d1033768b6cd 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -829,7 +829,7 @@ static void *virtqueue_get_buf_ctx_split(struct virtqueue *_vq,
 		return NULL;
 	}
 
-	if (!more_used_split(vq)) {
+	if (data_race(!more_used_split(vq))) {
 		pr_debug("No more buffers in queue\n");
 		END_USE(vq);
 		return NULL;
-- 
2.52.0

[PATCH RFC 3/3] virtio: silence KCSAN warning in vring_interrupt

[Johannes Thumshirn]

When booting a Qemu VM with virtio-blk and KCSAN enabled, KCSAN emits
the following warning about a data-race in vring_interrupt().

 ==================================================================
 BUG: KCSAN: data-race in vring_interrupt+0x125/0x1f0

 race at unknown origin, with read to 0xffff88810218d942 of 2 bytes by interrupt on cpu 7:
  vring_interrupt+0x125/0x1f0
  __handle_irq_event_percpu+0xaf/0x310
  handle_irq_event+0x76/0xf0
  handle_edge_irq+0x1fc/0x3e0
  __common_interrupt+0x79/0x160
  common_interrupt+0xa6/0xe0
  asm_common_interrupt+0x26/0x40
  pv_native_safe_halt+0x17/0x20
  default_idle+0x9/0x10
  default_idle_call+0x3c/0x110
  do_idle+0x166/0x190
  cpu_startup_entry+0x29/0x30
  start_secondary+0x114/0x140
  common_startup_64+0x129/0x138

 value changed: 0x3a3a -> 0x3a3b

 Reported by Kernel Concurrency Sanitizer on:
 CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.19.0-rc7+ #223 PREEMPT(none)
 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-9.fc43 06/10/2025
 ==================================================================

This warning is likely a false positive as the change happens on the
virtio vring.

Annotate the return of more_used() with data_race() to silence the
warning.

Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
---
 drivers/virtio/virtio_ring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index d1033768b6cd..7fa8f2ebe94e 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -2695,7 +2695,7 @@ irqreturn_t vring_interrupt(int irq, void *_vq)
 {
 	struct vring_virtqueue *vq = to_vvq(_vq);
 
-	if (!more_used(vq)) {
+	if (data_race(!more_used(vq))) {
 		pr_debug("virtqueue interrupt with no work for %p\n", vq);
 		return IRQ_NONE;
 	}
-- 
2.52.0

Re: [PATCH RFC 0/3] virtio: silence KCSAN warnings

[Alexander Graf]

On 27.01.26 09:39, Johannes Thumshirn wrote:
> When booting a Qemu VM whith KCSAN to debug filesystem races I
> encountered a bunch of KCSAN splats in virtio.
>
> I suspect them to be false positives.
>
> I decided to send this as an RFC patchset, as I have no prior knowledge
> of virtio.


All of these looks like KCSAN was just detecting the hypervisor writing 
data. Is there a more generic way we can capture that in the virtio 
helpers? So instead of patching the consumers of functions such as 
vring_interrupt(), can we annotate the whole vring struct as "ignore for 
KCSAN"?


Alex





Amazon Web Services Development Center Germany GmbH
Tamara-Danz-Str. 13
10243 Berlin
Geschaeftsfuehrung: Christof Hellmis, Andreas Stieger
Eingetragen am Amtsgericht Charlottenburg unter HRB 257764 B
Sitz: Berlin
Ust-ID: DE 365 538 597

Re: [PATCH RFC 0/3] virtio: silence KCSAN warnings

[Johannes Thumshirn]

On 1/27/26 9:48 AM, Alexander Graf wrote:
> On 27.01.26 09:39, Johannes Thumshirn wrote:
>> When booting a Qemu VM whith KCSAN to debug filesystem races I
>> encountered a bunch of KCSAN splats in virtio.
>>
>> I suspect them to be false positives.
>>
>> I decided to send this as an RFC patchset, as I have no prior knowledge
>> of virtio.
>
> All of these looks like KCSAN was just detecting the hypervisor writing
> data. Is there a more generic way we can capture that in the virtio
> helpers? So instead of patching the consumers of functions such as
> vring_interrupt(), can we annotate the whole vring struct as "ignore for
> KCSAN"?
>
Oh indeed, there is a __data_racy annotation. Let me try it!