[syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    940de590b839 Merge tag 'hardening-v7.3-rc2' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=150e2125580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30
dashboard link: https://syzkaller.appspot.com/bug?extid=4a1d521d19d6321f5aad
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/465f56673f03/disk-940de590.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b8f5904c8659/vmlinux-940de590.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b2c5a5b98759/bzImage-940de590.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4a1d521d19d6321f5aad@syzkaller.appspotmail.com

------------[ cut here ]------------
1
WARNING: drivers/nvme/target/loop.c:455 at nvme_loop_reset_ctrl_work+0x423/0x810 drivers/nvme/target/loop.c:455, CPU#0: kworker/u8:16/1478
Modules linked in:
CPU: 0 UID: 0 PID: 1478 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work
RIP: 0010:nvme_loop_reset_ctrl_work+0x423/0x810 drivers/nvme/target/loop.c:455
Code: 00 00 48 8b 44 24 18 8b 18 83 e3 fe bf 04 00 00 00 89 de e8 ef 30 d4 fb 83 fb 04 75 07 e8 d5 2b d4 fb eb 09 e8 ce 2b d4 fb 90 <0f> 0b 90 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d7 fa 66 05
RSP: 0018:ffffc90007127a80 EFLAGS: 00010293
RAX: ffffffff85f24df2 RBX: 0000000000000002 RCX: ffff888025970000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f63bb0 R12: ffff888024bc4c18
R13: 1ffff11004978879 R14: dffffc0000000000 R15: ffff888024bc4000
FS:  0000000000000000(0000) GS:ffff888125bd5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f899ad0b840 CR3: 00000000390e0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    2f0c1cf72f46 Merge tag 's390-7.3-3' of git://git.kernel.or..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=159b19f9580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
dashboard link: https://syzkaller.appspot.com/bug?extid=4a1d521d19d6321f5aad
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1074f615580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4a1d521d19d6321f5aad@syzkaller.appspotmail.com

------------[ cut here ]------------
1
WARNING: drivers/nvme/target/loop.c:455 at nvme_loop_reset_ctrl_work+0x1ad/0x5d0 drivers/nvme/target/loop.c:455, CPU#2: kworker/u33:1/38
Modules linked in:
CPU: 2 UID: 0 PID: 38 Comm: kworker/u33:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvme-reset-wq nvme_loop_reset_ctrl_work
RIP: 0010:nvme_loop_reset_ctrl_work+0x1ad/0x5d0 drivers/nvme/target/loop.c:455
Code: 7c 08 84 d2 0f 85 85 03 00 00 8b 9d dc f8 ff ff bf 01 00 00 00 83 eb 04 89 de e8 5e 1e 58 fb 83 fb 01 76 09 e8 e4 23 58 fb 90 <0f> 0b 90 e8 db 23 58 fb 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc90000727bd8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 00000000fffffffd RCX: 0000000000000000
RDX: ffff88801c78cb00 RSI: ffffffff86b3f22c RDI: ffff88801c78cb00
RBP: ffff888028d84b10 R08: 0000000000000005 R09: 0000000000000001
R10: 00000000fffffffd R11: 0000000000000000 R12: ffff888028d843e8
R13: ffff888028d843ec R14: 0000000000000000 R15: ffff888027346800
FS:  0000000000000000(0000) GS:ffff8880d5d59000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fde19ca5e9c CR3: 000000002206a000 CR4: 0000000000352ef0
Call Trace:
 <TASK>
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[Maurizio Lombardi]

On Sun Sep 13, 2026 at 5:34 PM CEST, syzbot wrote:
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit:    2f0c1cf72f46 Merge tag 's390-7.3-3' of git://git.kernel.or..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> console output: https://syzkaller.appspot.com/x/log.txt?x=159b19f9580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
> dashboard link: https://syzkaller.appspot.com/bug?extid=4a1d521d19d6321f5aad
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1074f615580000


It seems that a reset operation is enqueued before the controller
initialization is completed.

when the nvme_loop_reset_ctrl_work() finally runs, it will find the
controller in LIVE state, thus hitting the WARN_ON().

Maurizio

Re: [syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[Maurizio Lombardi]

On Mon Sep 14, 2026 at 11:21 AM CEST, Maurizio Lombardi wrote:
> On Sun Sep 13, 2026 at 5:34 PM CEST, syzbot wrote:
>> syzbot has found a reproducer for the following issue on:
>>
>> HEAD commit:    2f0c1cf72f46 Merge tag 's390-7.3-3' of git://git.kernel.or..
>> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
>> console output: https://syzkaller.appspot.com/x/log.txt?x=159b19f9580000
>> kernel config:  https://syzkaller.appspot.com/x/.config?x=8c5c3949d762a91f
>> dashboard link: https://syzkaller.appspot.com/bug?extid=4a1d521d19d6321f5aad
>> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1074f615580000
>
>
> It seems that a reset operation is enqueued before the controller
> initialization is completed.
>
> when the nvme_loop_reset_ctrl_work() finally runs, it will find the
> controller in LIVE state, thus hitting the WARN_ON().
>

Maybe moving the controller to CONNECTING state before exposing it to
sysfs will prevent the warning:

@@ -570,13 +575,13 @@ static struct nvme_ctrl *nvme_loop_create_ctrl(struct device *dev,
                goto out;
        }

+       if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
+                WARN_ON_ONCE(1);
+
        ret = nvme_add_ctrl(&ctrl->ctrl);
        if (ret)
                goto out_put_ctrl;

-       if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
-               WARN_ON_ONCE(1);
-
        ret = -ENOMEM;

        ctrl->ctrl.kato = opts->kato;

Maurizio

Re: [syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[Keith Busch]

On Mon, Sep 14, 2026 at 12:16:53PM +0200, Maurizio Lombardi wrote:
> Maybe moving the controller to CONNECTING state before exposing it to
> sysfs will prevent the warning:

I think all the transports set CONNECTING after adding the controller,
so this would have to be duplicated for all of them, right? But why do
we allow going from NEW to RESETTING? I don't think any of the
transports do that anymore, so we can remove that transition instead.

Re: [syzbot] [nvme?] WARNING in nvme_loop_reset_ctrl_work

[Maurizio Lombardi]

On Mon Sep 14, 2026 at 5:20 PM CEST, Keith Busch wrote:
> On Mon, Sep 14, 2026 at 12:16:53PM +0200, Maurizio Lombardi wrote:
>> Maybe moving the controller to CONNECTING state before exposing it to
>> sysfs will prevent the warning:
>
> I think all the transports set CONNECTING after adding the controller,
> so this would have to be duplicated for all of them, right? But why do
> we allow going from NEW to RESETTING? I don't think any of the
> transports do that anymore, so we can remove that transition instead.

Yeah, this is indeed what I was preparing to submit.
The diff I sent earlier today was just a bad idea.

Maurizio