From: syzbot <syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com>
To: axboe@kernel.dk, bvanassche@acm.org, hch@lst.de,
kbusch@kernel.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert
Date: Mon, 14 Sep 2026 18:33:33 -0700 [thread overview]
Message-ID: <6aa8a06d.4c28b7d0.c1bba.0027.GAE@google.com> (raw)
In-Reply-To: <6a926eaf.1d9ded08.62e62.0102.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=121f2115580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=f4353e96f7004ae5a09e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=161f2115580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110a75f9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com
non-slab/vmalloc memory
list_add corruption. prev->next should be next (ffff0000c7fc2840), but was ffff0000c83b0048. (prev=ffff0000c83b0048).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:34!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4354 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: kblockd blk_mq_requeue_work
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
lr : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
sp : ffff800094547a10
x29: ffff800094547a10 x28: ffff800094547ac8 x27: ffff800094547ac0
x26: 1fffe00018ff8509 x25: ffff0000c7fc2840 x24: ffff0000c7fc2848
x23: 1fffe00019076009 x22: dfff800000000000 x21: ffff0000c83b0048
x20: ffff0000c83b0048 x19: ffff0000c7fc2840 x18: 1fffe00035b9ec28
x17: 3034383263663763 x16: 3030303066666666 x15: 28207478656e2065
x14: 6220646c756f6873 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000002 x9 : 1fe110670cc49300
x8 : 1fe110670cc49300 x7 : ffff80008048e314 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080498f8c
x2 : 0000000100000001 x1 : ffff0000d6353b00 x0 : 0000000000000075
Call trace:
__list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32 (P)
__list_add_valid include/linux/list.h:104 [inline]
__list_add include/linux/list.h:169 [inline]
list_add_tail include/linux/list.h:206 [inline]
blk_mq_request_bypass_insert+0x130/0x1cc block/blk-mq.c:2551
blk_mq_requeue_work+0x3a4/0x52c block/blk-mq.c:1560
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 91170000 aa1303e1 aa1403e3 979ab1d1 (d4210000)
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-09-15 1:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-29 5:31 [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert syzbot
2026-08-30 0:16 ` Bart Van Assche
2026-08-31 14:58 ` Keith Busch
2026-08-31 20:55 ` Bart Van Assche
2026-09-01 14:49 ` Keith Busch
2026-09-15 1:33 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aa8a06d.4c28b7d0.c1bba.0027.GAE@google.com \
--to=syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=hch@lst.de \
--cc=kbusch@kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.