syzbot
WARNING in blk_mq_dispatch_rq_list
Status:
upstream: reported on 2026/08/22 00:10
Subsystems:
block
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+49b69d460fb5134ee1d7@syzkaller.appspotmail.com
First crash: 9d20h, last: 23h39m
Sample crash report:
------------[ cut here ]------------
WARNING: block/blk-mq.c:2107 at blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2107, CPU#1: kworker/1:0H/25
Modules linked in:
CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0H Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: kblockd blk_mq_run_work_fn
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2107
lr : blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2107
sp : ffff80008ed777e0
x29: ffff80008ed778c0 x28: 0000000000000000 x27: 0000000000000000
x26: 1fffe000191b4182 x25: ffff0000c8da0c48 x24: ffff0000c5cfb800
x23: dfff800000000000 x22: ffff0000c8da0c10 x21: ffff80008ed77a48
x20: ffff80008ed77a40 x19: ffff0000c5cfb948 x18: 00000000ffffffff
x17: ffff80008a7d6000 x16: 0000000000000004 x15: ffff80008a35fda0
x14: ffff80008a5d5e28 x13: 0000000000000002 x12: 0000000000000000
x11: 0000000000000000 x10: ffff700011daef12 x9 : 0000000000000000
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff80008ab31f58 x4 : 0000000000000000 x3 : 0000000000000010
x2 : 0000000000000000 x1 : ffff0000c1b2ba80 x0 : 0000000000000000
Call trace:
blk_mq_dispatch_rq_list+0x960/0x13a8 block/blk-mq.c:2107 (P)
__blk_mq_sched_dispatch_requests+0x250/0x10e8 block/blk-mq-sched.c:299
blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329
blk_mq_run_work_fn+0x214/0x2e4 block/blk-mq.c:2532
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
irq event stamp: 6952
hardirqs last enabled at (6951): [<ffff800086932104>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:187 [inline]
hardirqs last enabled at (6951): [<ffff800086932104>] _raw_spin_unlock_irq+0x30/0x80 kernel/locking/spinlock.c:206
hardirqs last disabled at (6952): [<ffff80008690cc28>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last enabled at (5422): [<ffff80008030e6e4>] softirq_handle_end kernel/softirq.c:468 [inline]
softirqs last enabled at (5422): [<ffff80008030e6e4>] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650
softirqs last disabled at (4083): [<ffff8000800204c0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---
non-slab/vmalloc memory
list_del corruption. next->prev should be ffff0000c8da0c48, but was ffff80008ed77a40. (next=ffff0000c8da0c48)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:67!
Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
Modules linked in:
CPU: 1 UID: 0 PID: 25 Comm: kworker/1:0H Tainted: G W L syzkaller #0 PREEMPT
Tainted: [W]=WARN, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Workqueue: kblockd blk_mq_run_work_fn
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65
lr : __list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65
sp : ffff80008ed777a0
x29: ffff80008ed777a0 x28: ffff700011daef0c x27: ffff0000c8da0c00
x26: 1ffff00011daef48 x25: ffff0000c8da0c48 x24: ffff0000c5cfb800
x23: ffff0000c8da0c50 x22: dfff800000000000 x21: 1fffe000191b418a
x20: ffff0000c8da0c48 x19: ffff0000c8da0c48 x18: 00000000ffffffff
x17: 20747562202c3834 x16: 6330616438633030 x15: 3030666666662065
x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff0000c1b2ba80
x11: 0000000000000000 x10: 0000000000000001 x9 : 1163f47a1e1e6400
x8 : 1163f47a1e1e6400 x7 : ffff80008048c60c x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008049731c
x2 : 0000000100000000 x1 : ffff0000c1b2ba80 x0 : 000000000000006d
Call trace:
__list_del_entry_valid_or_report+0x1b4/0x1b8 lib/list_debug.c:65 (P)
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:246 [inline]
list_del_init include/linux/list.h:318 [inline]
blk_mq_dispatch_rq_list+0x2bc/0x13a8 block/blk-mq.c:2112
__blk_mq_sched_dispatch_requests+0x250/0x10e8 block/blk-mq-sched.c:299
blk_mq_sched_dispatch_requests+0xa8/0x158 block/blk-mq-sched.c:329
blk_mq_run_work_fn+0x214/0x2e4 block/blk-mq.c:2532
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405
worker_thread+0x798/0xbd0 kernel/workqueue.c:3486
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Code: 91328000 aa1303e1 aa1403e3 979c2c05 (d4210000)
---[ end trace 0000000000000000 ]---
* Struck through repros no longer work on HEAD.