Re: [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert

[Bart Van Assche]

On 8/28/26 10:31 PM, syzbot wrote:
> kernel BUG at lib/list_debug.c:34!
> Call trace:
>   __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32 (P)
>   __list_add_valid include/linux/list.h:96 [inline]
>   __list_add include/linux/list.h:158 [inline]
>   list_add_tail include/linux/list.h:191 [inline]
>   blk_mq_request_bypass_insert+0x130/0x1cc block/blk-mq.c:2551
>   blk_mq_requeue_work+0x3a4/0x52c block/blk-mq.c:1560
>   process_one_work kernel/workqueue.c:3322 [inline]
>   process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
>   worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
>   kthread+0x304/0x3d4 kernel/kthread.c:436
>   ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838

If my AI assistant got it right the root cause of this issue is as
follows (I haven't tried to verify this):
* Concurrent calls of nvme_reset_work() and blk_mq_requeue_work().
* nvme_decide_disposition() does not check NVME_REQ_CANCELLED for
  non-multipath requests and returns RETRY instead of COMPLETE.

The same AI assistant proposes the following patch (again, I have not
verified whether this makes sense):

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 8e45a2789123..a1b2c3d4e5f6 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -425,7 +425,8 @@ static inline enum nvme_disposition 
nvme_decide_disposition(struct request *req)
 		if (nvme_is_path_error(nvme_req(req)->status) ||
 		    blk_queue_dying(req->q))
 			return FAILOVER;
 	} else {
-		if (blk_queue_dying(req->q))
+		if (blk_queue_dying(req->q) ||
+		    (nvme_req(req)->flags & NVME_REQ_CANCELLED))
 			return COMPLETE;
 	}

@@ -551,7 +552,7 @@ bool nvme_cancel_request(struct request *req, void 
*data)
 	if (blk_mq_rq_state(req) != MQ_RQ_IN_FLIGHT)
 		return true;

-	nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD;
+	nvme_req(req)->status = NVME_SC_HOST_ABORTED_CMD | NVME_STATUS_DNR;
 	nvme_req(req)->flags |= NVME_REQ_CANCELLED;
 	blk_mq_complete_request(req);
 	return true;

Bart.