Re: [syzbot ci] Re: loop: improve loop aio perf by IOCB_NOWAIT

[Ming Lei <ming.lei@redhat.com>]

On Sun, Sep 28, 2025 at 11:42:20AM -0700, syzbot ci wrote:
> syzbot ci has tested the following series
> 
> [v1] loop: improve loop aio perf by IOCB_NOWAIT
> https://lore.kernel.org/all/20250928132927.3672537-1-ming.lei@redhat.com
> * [PATCH V4 1/6] loop: add helper lo_cmd_nr_bvec()
> * [PATCH V4 2/6] loop: add helper lo_rw_aio_prep()
> * [PATCH V4 3/6] loop: add lo_submit_rw_aio()
> * [PATCH V4 4/6] loop: move command blkcg/memcg initialization into loop_queue_work
> * [PATCH V4 5/6] loop: try to handle loop aio command via NOWAIT IO first
> * [PATCH V4 6/6] loop: add hint for handling aio via IOCB_NOWAIT
> 
> and found the following issue:
> WARNING in lo_submit_rw_aio
> 
> Full report is available here:
> https://ci.syzbot.org/series/0ffdb6b4-a5fe-48da-9473-d2a926e780bd
> 
> ***
> 
> WARNING in lo_submit_rw_aio
> 
> tree:      torvalds
> URL:       https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
> base:      07e27ad16399afcd693be20211b0dfae63e0615f
> arch:      amd64
> compiler:  Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> config:    https://ci.syzbot.org/builds/3aba003b-2400-4e88-9a31-c09ab4e41a84/config
> C repro:   https://ci.syzbot.org/findings/dc97454c-d87b-41f5-a44a-7182e666cfd5/c_repro
> syz repro: https://ci.syzbot.org/findings/dc97454c-d87b-41f5-a44a-7182e666cfd5/syz_repro
> 
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 5958 at drivers/block/loop.c:907 loop_inc_blocking_writes drivers/block/loop.c:907 [inline]

Thanks for your report!

Looks wrong lock is asserted, and the following change can fix it:

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 911262b648ce..f3372bf35fd5 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -904,7 +904,7 @@ static inline int queue_on_root_worker(struct cgroup_subsys_state *css)
 static inline void loop_inc_blocking_writes(struct loop_device *lo,
                struct loop_cmd *cmd)
 {
-       lockdep_assert_held(&lo->lo_mutex);
+       lockdep_assert_held(&lo->lo_work_lock);

        if (req_op(blk_mq_rq_from_pdu(cmd)) == REQ_OP_WRITE)
                lo->lo_nr_blocking_writes += 1;
@@ -913,7 +913,7 @@ static inline void loop_inc_blocking_writes(struct loop_device *lo,
 static inline void loop_dec_blocking_writes(struct loop_device *lo,
                struct loop_cmd *cmd)
 {
-       lockdep_assert_held(&lo->lo_mutex);
+       lockdep_assert_held(&lo->lo_work_lock);

        if (req_op(blk_mq_rq_from_pdu(cmd)) == REQ_OP_WRITE)
                lo->lo_nr_blocking_writes -= 1;




Thanks,
Ming