==================================================================
BUG: KCSAN: data-race in __xa_clear_mark / xas_find_marked

read-write to 0xffff888104e68908 of 8 bytes by interrupt on cpu 0:
 instrument_read_write include/linux/instrumented.h:55 [inline]
 __instrument_read_write_bitop include/asm-generic/bitops/instrumented-non-atomic.h:84 [inline]
 ___test_and_clear_bit include/asm-generic/bitops/instrumented-non-atomic.h:114 [inline]
 node_clear_mark lib/xarray.c:102 [inline]
 xas_clear_mark lib/xarray.c:922 [inline]
 __xa_clear_mark+0xf5/0x1e0 lib/xarray.c:2094
 __folio_end_writeback+0x177/0x470 mm/page-writeback.c:3047
 folio_end_writeback+0xb6/0x3a0 mm/filemap.c:1648
 mpage_write_end_io+0x274/0x390 fs/mpage.c:65
 bio_endio+0x34f/0x3f0 block/bio.c:1551
 blk_update_request+0x339/0x730 block/blk-mq.c:983
 blk_mq_end_request+0x26/0x50 block/blk-mq.c:1145
 lo_complete_rq+0x98/0x140 drivers/block/loop.c:304
 blk_complete_reqs block/blk-mq.c:1220 [inline]
 blk_done_softirq+0x74/0xb0 block/blk-mq.c:1225
 handle_softirqs+0xb7/0x290 kernel/softirq.c:579
 do_softirq+0x5d/0x90 kernel/softirq.c:480
 __local_bh_enable_ip+0x70/0x80 kernel/softirq.c:407
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]
 _raw_spin_unlock_bh+0x36/0x40 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 bond_3ad_state_machine_handler+0x2b0d/0x2ce0 drivers/net/bonding/bond_3ad.c:2521
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x4cb/0x9d0 kernel/workqueue.c:3319
 worker_thread+0x582/0x770 kernel/workqueue.c:3400
 kthread+0x486/0x510 kernel/kthread.c:464
 ret_from_fork+0x4b/0x60 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

read to 0xffff888104e68908 of 8 bytes by task 6634 on cpu 1:
 xas_find_chunk include/linux/xarray.h:1746 [inline]
 xas_find_marked+0x218/0x620 lib/xarray.c:1510
 find_get_entry+0x5d/0x380 mm/filemap.c:2027
 filemap_get_folios_tag+0x13b/0x210 mm/filemap.c:2295
 __filemap_fdatawait_range mm/filemap.c:530 [inline]
 filemap_write_and_wait_range+0x1d3/0x340 mm/filemap.c:700
 filemap_invalidate_pages+0xa4/0x1a0 mm/filemap.c:2806
 kiocb_invalidate_pages mm/filemap.c:2825 [inline]
 generic_file_direct_write+0x9d/0x240 mm/filemap.c:4030
 __generic_file_write_iter+0xab/0x120 mm/filemap.c:4206
 generic_file_write_iter+0x8d/0x2f0 mm/filemap.c:4246
 aio_write+0x2e2/0x410 fs/aio.c:1633
 __io_submit_one fs/aio.c:-1 [inline]
 io_submit_one+0xac8/0x11b0 fs/aio.c:2052
 __do_sys_io_submit fs/aio.c:2111 [inline]
 __se_sys_io_submit+0xfb/0x280 fs/aio.c:2081
 __x64_sys_io_submit+0x43/0x50 fs/aio.c:2081
 x64_sys_call+0xfc4/0x2fb0 arch/x86/include/generated/asm/syscalls_64.h:210
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xd0/0x1a0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

value changed: 0x001fffffffffffff -> 0x001fffffffffc000

Reported by Kernel Concurrency Sanitizer on:
CPU: 1 UID: 0 PID: 6634 Comm: syz.5.1214 Not tainted 6.15.0-rc5-syzkaller #0 PREEMPT(voluntary) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
==================================================================
syz.5.1214: attempt to access beyond end of device
loop5: rw=0, sector=128, nr_sectors = 1 limit=128