From: syzbot ci <syzbot+ci472e62ec00dbd79b@syzkaller.appspotmail.com>
To: axboe@kernel.dk, bvanassche@acm.org, eadavis@qq.com, hch@lst.de,
jfs-discussion@lists.sourceforge.net,
linux-block@vger.kernel.org, nilay@linux.ibm.com,
penguin-kernel@i-love.sakura.ne.jp, shaggy@kernel.org
Cc: syzbot@lists.linux.dev, syzkaller-bugs@googlegroups.com
Subject: [syzbot ci] Re: loop: Detect write requests that failed to wait for completion.
Date: Sun, 11 Oct 2026 12:24:24 -0700 [thread overview]
Message-ID: <6acbe268.8cdf6287.1eb53.00ed.GAE@google.com> (raw)
In-Reply-To: <cc2910d3-3113-44d4-94ef-0c8d365fac9c@I-love.SAKURA.ne.jp>
syzbot ci has tested the following series
[v3] loop: Detect write requests that failed to wait for completion.
https://lore.kernel.org/all/cc2910d3-3113-44d4-94ef-0c8d365fac9c@I-love.SAKURA.ne.jp
* [PATCH v3] loop: Detect write requests that failed to wait for completion.
and found the following issues:
* BUG: found I/O issued by syz.NUM.NUM/NUM but loop0 is no longer bound.
* BUG: found I/O issued by syz.NUM.NUM/NUM but loop2 is no longer bound.
Full report is available here:
https://ci.syzbot.org/series/d3a0b036-fd1e-44c6-8869-386ea1642385
***
BUG: found I/O issued by syz.NUM.NUM/NUM but loop0 is no longer bound.
tree: axboe
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/axboe/linux.git
base: 4da93acb4f2ed06640255ad98801d0f0c734ff07
arch: amd64
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config: https://ci.syzbot.org/builds/a23afb97-88bb-4fba-8885-d3062b5890e2/config
syz repro: https://ci.syzbot.org/findings/c9ad5ff9-784f-4528-805f-7971e0359600/syz_repro
BUG: found I/O issued by syz.0.760/7647 but loop0 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.0.760/7647 but loop0 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
***
BUG: found I/O issued by syz.NUM.NUM/NUM but loop2 is no longer bound.
tree: axboe
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/axboe/linux.git
base: 4da93acb4f2ed06640255ad98801d0f0c734ff07
arch: amd64
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
config: https://ci.syzbot.org/builds/a23afb97-88bb-4fba-8885-d3062b5890e2/config
syz repro: https://ci.syzbot.org/findings/bad9ae98-7887-4209-8226-7e84bb070faa/syz_repro
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: found I/O issued by syz.2.866/7955 but loop2 is no longer bound.
Call Trace:
loop_queue_rq+0x232/0xc90 drivers/block/loop.c:1922
__blk_mq_issue_directly block/blk-mq.c:2708 [inline]
blk_mq_try_issue_directly+0x3f4/0x880 block/blk-mq.c:2768
blk_mq_submit_bio+0x21de/0x2bb0 block/blk-mq.c:3220
__submit_bio_noacct_mq block/blk-core.c:756 [inline]
submit_bio_noacct_nocheck+0x2f4/0xa40 block/blk-core.c:790
bh_submit fs/buffer.c:1146 [inline]
__bh_read fs/buffer.c:2943 [inline]
bh_readahead include/linux/buffer_head.h:437 [inline]
__breadahead+0x15c/0x1f0 fs/buffer.c:1359
nilfs_search_super_root+0x2be/0x1530 fs/nilfs2/recovery.c:891
load_nilfs+0x363/0xfb0 fs/nilfs2/the_nilfs.c:259
nilfs_fill_super+0x1a0/0x4e0 fs/nilfs2/super.c:1073
nilfs_get_tree+0x491/0x850 fs/nilfs2/super.c:1226
vfs_get_tree+0x92/0x2a0 fs/super.c:1932
fc_mount fs/namespace.c:1198 [inline]
do_new_mount_fc fs/namespace.c:3772 [inline]
do_new_mount+0x319/0xdc0 fs/namespace.c:3848
do_mount fs/namespace.c:4181 [inline]
__do_sys_mount fs/namespace.c:4397 [inline]
__se_sys_mount+0x31d/0x420 fs/namespace.c:4374
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a fix for this bug, please reply with `#syz test`
(on a separate line) and attach the patch to the email.
Notes:
- The patch will be applied on top of the tested series (as an
incremental fix).
- To test a new version of the whole series, please send it directly
to syzbot@lists.linux.dev.
- Arguments like custom git repos and branches are not supported.
next prev parent reply other threads:[~2026-10-11 19:24 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-05 21:06 [PATCH v6] loop: Wait for I/O completion in __loop_clr_fd() Bart Van Assche
2026-10-06 12:01 ` Tetsuo Handa
2026-10-06 17:15 ` Bart Van Assche
2026-10-07 13:08 ` Christoph Hellwig
2026-10-07 13:35 ` Tetsuo Handa
2026-10-11 10:37 ` [PATCH] loop: Detect write requests that failed to wait for completion Tetsuo Handa
2026-10-11 11:29 ` [PATCH v2] " Tetsuo Handa
2026-10-11 13:26 ` [PATCH v3] " Tetsuo Handa
2026-10-11 19:24 ` syzbot ci [this message]
2026-10-12 8:26 ` [PATCH] block: Wait for inflight requests in bdev_release() Tetsuo Handa
2026-10-12 11:39 ` Tetsuo Handa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6acbe268.8cdf6287.1eb53.00ed.GAE@google.com \
--to=syzbot+ci472e62ec00dbd79b@syzkaller.appspotmail.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=eadavis@qq.com \
--cc=hch@lst.de \
--cc=jfs-discussion@lists.sourceforge.net \
--cc=linux-block@vger.kernel.org \
--cc=nilay@linux.ibm.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=shaggy@kernel.org \
--cc=syzbot@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.