[moderation] [block?] KCSAN: data-race in lo_ioctl / loop_queue_rq (5)

Hello,

syzbot found the following issue on:

HEAD commit: 900241a5cc15 Merge tag 'drm-fixes-2025-04-11-1' of https:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17bb0dac580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a84f9483dff14ac4
dashboard link: https://syzkaller.appspot.com/bug?extid=46b0a21c2d89ec4538c2
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [[email protected] [email protected] [email protected]]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5e8fa7753b1c/disk-900241a5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/f91ea303b5d1/vmlinux-900241a5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a93e0331f595/bzImage-900241a5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: [email protected]

loop7: detected capacity change from 0 to 16384
==================================================================
BUG: KCSAN: data-race in lo_ioctl / loop_queue_rq

write to 0xffff8881001f7280 of 4 bytes by task 10703 on cpu 1:
loop_clr_fd drivers/block/loop.c:1261 [inline]
lo_ioctl+0xa5c/0x1570 drivers/block/loop.c:1571
blkdev_ioctl+0x35b/0x450 block/ioctl.c:698
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xc9/0x140 fs/ioctl.c:892
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:892
x64_sys_call+0x168d/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff8881001f7280 of 4 bytes by task 10690 on cpu 0:
loop_queue_rq+0x50/0x670 drivers/block/loop.c:1881
__blk_mq_issue_directly block/blk-mq.c:2691 [inline]
blk_mq_request_issue_directly+0x1dc/0x390 block/blk-mq.c:2778
blk_mq_plug_issue_direct+0x1ad/0x570 block/blk-mq.c:2799
blk_mq_flush_plug_list+0x2bd/0xf10 block/blk-mq.c:2910
__blk_flush_plug+0x21f/0x2a0 block/blk-core.c:1220
blk_finish_plug+0x48/0x70 block/blk-core.c:1247
read_pages+0x3ee/0x470 mm/readahead.c:173
page_cache_ra_unbounded+0x30d/0x350 mm/readahead.c:297
do_page_cache_ra mm/readahead.c:327 [inline]
page_cache_ra_order mm/readahead.c:532 [inline]
page_cache_async_ra+0x41d/0x450 mm/readahead.c:687
filemap_readahead mm/filemap.c:2559 [inline]
filemap_get_pages+0x512/0x11b0 mm/filemap.c:2604
filemap_splice_read+0x35a/0x930 mm/filemap.c:2980
do_splice_read fs/splice.c:979 [inline]
splice_direct_to_actor+0x26c/0x680 fs/splice.c:1083
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0xd9/0x150 fs/splice.c:1227
do_sendfile+0x40a/0x690 fs/read_write.c:1368
__do_sys_sendfile64 fs/read_write.c:1429 [inline]
__se_sys_sendfile64 fs/read_write.c:1415 [inline]
__x64_sys_sendfile64+0x113/0x160 fs/read_write.c:1415
x64_sys_call+0xfc3/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000002

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 10690 Comm: syz.4.1722 Not tainted 6.15.0-rc1-syzkaller-00246-g900241a5cc15 #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================
blk_print_req_error: 54 callbacks suppressed
I/O error, dev loop7, sector 3584 op 0x0:(READ) flags 0x80700 phys_seg 32 prio class 0
I/O error, dev loop7, sector 3336 op 0x0:(READ) flags 0x80700 phys_seg 31 prio class 0
I/O error, dev loop7, sector 3336 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0
I/O error, dev loop7, sector 3336 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 0


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at [email protected].

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup