[moderation] [block?] KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a8662bcd2ff1 Merge tag 'v6.15-p3' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1753ab4c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=feee5c3d8a6f5d3c
dashboard link: https://syzkaller.appspot.com/bug?extid=6e617aed664fc8199fd5
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
CC: [ax...@kernel.dk linux...@vger.kernel.org linux-...@vger.kernel.org]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b85c4cb3c238/disk-a8662bcd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/77328acab5c7/vmlinux-a8662bcd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5988de53c201/bzImage-a8662bcd.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6e617a...@syzkaller.appspotmail.com

loop7: detected capacity change from 0 to 16384
==================================================================
BUG: KCSAN: data-race in __bio_queue_enter / blk_mq_unfreeze_queue_nomemrestore

read-write to 0xffff888102215d64 of 4 bytes by task 4433 on cpu 1:
__blk_mq_unfreeze_queue block/blk-mq.c:227 [inline]
blk_mq_unfreeze_queue_nomemrestore+0x38/0xc0 block/blk-mq.c:241
blk_mq_unfreeze_queue include/linux/blk-mq.h:934 [inline]
loop_set_status+0x4a5/0x5d0 drivers/block/loop.c:1313
lo_ioctl+0x81a/0x1570 drivers/block/loop.c:-1
blkdev_ioctl+0x35b/0x450 block/ioctl.c:698
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:906 [inline]
__se_sys_ioctl+0xc9/0x140 fs/ioctl.c:892
__x64_sys_ioctl+0x43/0x50 fs/ioctl.c:892
x64_sys_call+0x168d/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff888102215d64 of 4 bytes by task 4429 on cpu 0:
__bio_queue_enter+0x1e1/0x5b0 block/blk-core.c:353
bio_queue_enter block/blk.h:82 [inline]
blk_mq_submit_bio+0x1a0/0xf50 block/blk-mq.c:3090
__submit_bio+0xf5/0x510 block/blk-core.c:635
__submit_bio_noacct_mq block/blk-core.c:722 [inline]
submit_bio_noacct_nocheck+0x290/0x6f0 block/blk-core.c:751
submit_bio_noacct+0x6e1/0x930 block/blk-core.c:874
submit_bio+0x218/0x230 block/blk-core.c:916
mpage_bio_submit_read fs/mpage.c:75 [inline]
mpage_readahead+0x28c/0x2d0 fs/mpage.c:374
blkdev_readahead+0x1c/0x30 block/fops.c:472
read_pages+0xa1/0x470 mm/readahead.c:160
page_cache_ra_unbounded+0x30d/0x350 mm/readahead.c:297
do_page_cache_ra mm/readahead.c:327 [inline]
page_cache_ra_order mm/readahead.c:532 [inline]
page_cache_async_ra+0x41d/0x450 mm/readahead.c:687
filemap_readahead mm/filemap.c:2559 [inline]
filemap_get_pages+0x512/0x11b0 mm/filemap.c:2604
filemap_splice_read+0x35a/0x930 mm/filemap.c:2980
do_splice_read fs/splice.c:979 [inline]
splice_direct_to_actor+0x26c/0x680 fs/splice.c:1083
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0xd9/0x150 fs/splice.c:1227
do_sendfile+0x40a/0x690 fs/read_write.c:1368
__do_sys_sendfile64 fs/read_write.c:1429 [inline]
__se_sys_sendfile64 fs/read_write.c:1415 [inline]
__x64_sys_sendfile64+0x113/0x160 fs/read_write.c:1415
x64_sys_call+0xfc3/0x2e10 arch/x86/include/generated/asm/syscalls_64.h:41
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0x1c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00000001 -> 0x00000000

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 4429 Comm: syz.4.355 Not tainted 6.14.0-syzkaller-13423-ga8662bcd2ff1 #0 PREEMPT(voluntary)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
==================================================================
syz.4.355 (4429) used greatest stack depth: 9928 bytes left


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.