Re: [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert

[Bart Van Assche]

On 8/31/26 7:58 AM, Keith Busch wrote:
> We want to be able to retry eligible commands that were caught in the
> crossfire of a controller reset.

Got it. Is my understanding correct that the NVMe driver may trigger the
following call chain for a request that is already on the hctx dispatch
list?

nvme_cancel_tagset()
  blk_mq_tagset_busy_iter()
    nvme_cancel_request()
      nvme_pci_complete_rq()
        nvme_complete_rq()
          nvme_retry_req()
            blk_mq_requeue_request()
              spin_lock_irqsave(&q->requeue_lock, flags);
              list_add_tail(&rq->queuelist, &q->requeue_list);
              spin_unlock_irqrestore(&q->requeue_lock, flags);

Can this scenario trigger the list corruption reported by syzbot?

Thanks,

Bart.