syzbot

==================================================================
BUG: KCSAN: data-race in sg_fill_request_table / sg_rq_end_io

write to 0xffff88811588c111 of 1 bytes by interrupt on cpu 1:
 sg_rq_end_io+0x1a2/0x740 drivers/scsi/sg.c:1348
 __blk_mq_end_request+0x27e/0x380 block/blk-mq.c:1158
 scsi_end_request+0x29c/0x4c0 drivers/scsi/scsi_lib.c:670
 scsi_io_completion+0x7f/0x1d0 drivers/scsi/scsi_lib.c:1078
 scsi_finish_command+0x1c7/0x1e0 drivers/scsi/scsi.c:198
 scsi_complete+0xc3/0x1e0 drivers/scsi/scsi_lib.c:1547
 blk_complete_reqs block/blk-mq.c:1243 [inline]
 blk_done_softirq+0x77/0xb0 block/blk-mq.c:1248
 handle_softirqs+0xba/0x290 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x3a/0xc0 kernel/softirq.c:723
 common_interrupt+0x83/0x90 arch/x86/kernel/irq.c:319
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688
 __sanitizer_cov_trace_pc+0x8/0x70 kernel/kcov.c:213
 xas_load+0x413/0x430 lib/xarray.c:-1
 xas_find+0xf1/0x3e0 lib/xarray.c:1406
 xas_next_entry include/linux/xarray.h:-1 [inline]
 next_uptodate_folio+0x85f/0x890 mm/filemap.c:3684
 filemap_map_pages+0xca/0xe50 mm/filemap.c:3867
 do_fault_around mm/memory.c:5674 [inline]
 do_read_fault mm/memory.c:5707 [inline]
 do_fault mm/memory.c:5850 [inline]
 do_pte_missing mm/memory.c:4362 [inline]
 handle_pte_fault mm/memory.c:6234 [inline]
 __handle_mm_fault mm/memory.c:6366 [inline]
 handle_mm_fault+0x1355/0x2be0 mm/memory.c:6535
 faultin_page mm/gup.c:1126 [inline]
 __get_user_pages+0x102a/0x1ed0 mm/gup.c:1428
 populate_vma_page_range mm/gup.c:1860 [inline]
 __mm_populate+0x243/0x3a0 mm/gup.c:1963
 mm_populate include/linux/mm.h:3455 [inline]
 vm_mmap_pgoff+0x232/0x2e0 mm/util.c:586
 ksys_mmap_pgoff+0xc2/0x310 mm/mmap.c:604
 x64_sys_call+0x16bb/0x3000 arch/x86/include/generated/asm/syscalls_64.h:10
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff88811588c111 of 1 bytes by task 16419 on cpu 0:
 sg_fill_request_table+0x65/0x1e0 drivers/scsi/sg.c:865
 sg_ioctl_common drivers/scsi/sg.c:1082 [inline]
 sg_ioctl+0x6b1/0x1360 drivers/scsi/sg.c:1156
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583
 __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583
 x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd8/0x2a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x00 -> 0x01

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 UID: 0 PID: 16419 Comm: syz.7.4029 Tainted: G        W           syzkaller #0 PREEMPT(voluntary) 
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
==================================================================
SELinux:  policydb version 0 does not match my version range 15-35
SELinux: failed to load policy