Suppress warning by annotating these accesses using
READ_ONCE() / WRITE_ONCE().

Reported-by: syzbot+01affb1491750534256d@syzkaller.appspotmail.com
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
 kernel/workqueue.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index cf6203282737..d78640b5d188 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -3241,7 +3241,7 @@ __acquires(&pool->lock)
 	 * point will only record its address.
 	 */
 	trace_workqueue_execute_end(work, worker->current_func);
-	pwq->stats[PWQ_STAT_COMPLETED]++;
+	WRITE_ONCE(pwq->stats[PWQ_STAT_COMPLETED], READ_ONCE(pwq->stats[PWQ_STAT_COMPLETED]) + 1);
 	lock_map_release(&lockdep_map);
 	if (!bh_draining)
 		lock_map_release(pwq->wq->lockdep_map);
-- 
2.47.1

On Wed, Apr 23, 2025 at 08:53:41PM +0800, Jiayuan Chen wrote:
> Suppress warning by annotating these accesses using
> READ_ONCE() / WRITE_ONCE().
> 
> Reported-by: syzbot+01affb1491750534256d@syzkaller.appspotmail.com
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
>  kernel/workqueue.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> index cf6203282737..d78640b5d188 100644
> --- a/kernel/workqueue.c
> +++ b/kernel/workqueue.c
> @@ -3241,7 +3241,7 @@ __acquires(&pool->lock)
>  	 * point will only record its address.
>  	 */
>  	trace_workqueue_execute_end(work, worker->current_func);
> -	pwq->stats[PWQ_STAT_COMPLETED]++;
> +	WRITE_ONCE(pwq->stats[PWQ_STAT_COMPLETED], READ_ONCE(pwq->stats[PWQ_STAT_COMPLETED]) + 1);

The function acquires pool->lock down below. Can you move it down inside the
locked region instead of adding READ/WRITE_ONCE()?

Thanks.

-- 
tejun

April 23, 2025 at 23:30, "Tejun Heo" <tj@kernel.org> wrote:



> 
> On Wed, Apr 23, 2025 at 08:53:41PM +0800, Jiayuan Chen wrote:
> 
> > 
> > Suppress warning by annotating these accesses using
> > 
> >  READ_ONCE() / WRITE_ONCE().
> > 
> >  
> > 
> >  Reported-by: syzbot+01affb1491750534256d@syzkaller.appspotmail.com
> > 
> >  Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> > 
> >  ---
> > 
> >  kernel/workqueue.c | 2 +-
> > 
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> >  
> > 
> >  diff --git a/kernel/workqueue.c b/kernel/workqueue.c
> > 
> >  index cf6203282737..d78640b5d188 100644
> > 
> >  --- a/kernel/workqueue.c
> > 
> >  +++ b/kernel/workqueue.c
> > 
> >  @@ -3241,7 +3241,7 @@ __acquires(&pool->lock)
> > 
> >  * point will only record its address.
> > 
> >  */
> > 
> >  trace_workqueue_execute_end(work, worker->current_func);
> > 
> >  - pwq->stats[PWQ_STAT_COMPLETED]++;
> > 
> >  + WRITE_ONCE(pwq->stats[PWQ_STAT_COMPLETED], READ_ONCE(pwq->stats[PWQ_STAT_COMPLETED]) + 1);
> > 
> 
> The function acquires pool->lock down below. Can you move it down inside the
> 
> locked region instead of adding READ/WRITE_ONCE()?
> 
> Thanks.
> 
> -- 
> 
> tejun
>
Thanks, I can do that.
Previously, I thought it was for performance considerations that the
metrics calculation is out of the lock's scope...