From: syzbot <syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com>
To: axboe@kernel.dk, bvanassche@acm.org, hch@lst.de,
kbusch@kernel.org, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [block?] BUG: corrupted list in blk_mq_request_bypass_insert
Date: Mon, 14 Sep 2026 18:33:33 -0700 [thread overview]
Message-ID: <6aa8a06d.4c28b7d0.c1bba.0027.GAE@google.com> (raw)
In-Reply-To: <6a926eaf.1d9ded08.62e62.0102.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: 5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=121f2115580000
kernel config: https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=f4353e96f7004ae5a09e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=161f2115580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=110a75f9580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com
non-slab/vmalloc memory
list_add corruption. prev->next should be next (ffff0000c7fc2840), but was ffff0000c83b0048. (prev=ffff0000c83b0048).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:34!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4354 Comm: kworker/0:1H Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: kblockd blk_mq_requeue_work
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
lr : __list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32
sp : ffff800094547a10
x29: ffff800094547a10 x28: ffff800094547ac8 x27: ffff800094547ac0
x26: 1fffe00018ff8509 x25: ffff0000c7fc2840 x24: ffff0000c7fc2848
x23: 1fffe00019076009 x22: dfff800000000000 x21: ffff0000c83b0048
x20: ffff0000c83b0048 x19: ffff0000c7fc2840 x18: 1fffe00035b9ec28
x17: 3034383263663763 x16: 3030303066666666 x15: 28207478656e2065
x14: 6220646c756f6873 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000002 x9 : 1fe110670cc49300
x8 : 1fe110670cc49300 x7 : ffff80008048e314 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080498f8c
x2 : 0000000100000001 x1 : ffff0000d6353b00 x0 : 0000000000000075
Call trace:
__list_add_valid_or_report+0x144/0x148 lib/list_debug.c:32 (P)
__list_add_valid include/linux/list.h:104 [inline]
__list_add include/linux/list.h:169 [inline]
list_add_tail include/linux/list.h:206 [inline]
blk_mq_request_bypass_insert+0x130/0x1cc block/blk-mq.c:2551
blk_mq_requeue_work+0x3a4/0x52c block/blk-mq.c:1560
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
worker_thread+0x798/0xbd0 kernel/workqueue.c:3551
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 91170000 aa1303e1 aa1403e3 979ab1d1 (d4210000)
---[ end trace 0000000000000000 ]---
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2026-09-15 1:33 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-29 5:31 syzbot
2026-08-30 0:16 ` Bart Van Assche
2026-08-31 14:58 ` Keith Busch
2026-08-31 20:55 ` Bart Van Assche
2026-09-01 14:49 ` Keith Busch
2026-09-15 1:33 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aa8a06d.4c28b7d0.c1bba.0027.GAE@google.com \
--to=syzbot+f4353e96f7004ae5a09e@syzkaller.appspotmail.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=hch@lst.de \
--cc=kbusch@kernel.org \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®