Re: [syzbot] [nvme?] BUG: corrupted list in nvmet_fc_remove_port

[Hillf Danton]

> Date: Sun, 11 Oct 2026 10:32:37 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    a5ebb76233b7 Merge tag 'edac_urgent_for_v7.3_rc7' of git:/..
> git tree:       upstream
> console+strace: https://syzkaller.appspot.com/x/log.txt?x=1494923e580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=df4bbab1c2172b9f
> dashboard link: https://syzkaller.appspot.com/bug?extid=c98b21427617af7f547a
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=126a0f15580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=166a0f15580000

Test Nguyen's idea.

#syz test

--- x/drivers/nvme/target/fc.c
+++ y/drivers/nvme/target/fc.c
@@ -1319,12 +1319,13 @@ nvmet_fc_portentry_rebind_tgt(struct nvm
 
 	spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
 	list_for_each_entry(pe, &nvmet_fc_portentry_list, pe_list) {
+		if (pe->tgtport)
+			continue;
 		if (tgtport->fc_target_port.node_name == pe->node_name &&
 		    tgtport->fc_target_port.port_name == pe->port_name) {
 			if (!nvmet_fc_tgtport_get(tgtport))
-				continue;
+				break;
 
-			WARN_ON(pe->tgtport);
 			tgtport->pe = pe;
 			pe->tgtport = tgtport;
 			break;
--