Re: [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert

[Bart Van Assche <bvanassche@acm.org>]

On 8/31/26 7:58 AM, Keith Busch wrote:
> We want to be able to retry eligible commands that were caught in the
> crossfire of a controller reset.

Got it. Is my understanding correct that the NVMe driver may trigger the
following call chain for a request that is already on the hctx dispatch
list?

nvme_cancel_tagset()
   blk_mq_tagset_busy_iter()
     nvme_cancel_request()
       nvme_pci_complete_rq()
         nvme_complete_rq()
           nvme_retry_req()
             blk_mq_requeue_request()
               spin_lock_irqsave(&q->requeue_lock, flags);
               list_add_tail(&rq->queuelist, &q->requeue_list);
               spin_unlock_irqrestore(&q->requeue_lock, flags);

Can this scenario trigger the list corruption reported by syzbot?

Thanks,

Bart.