list_del corruption, ffff0000c79de948->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:55! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 3614 Comm: syz-executor.3 Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53 lr : __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53 sp : ffff800021c7b950 x29: ffff800021c7b950 x28: 0000000000000001 x27: ffff000129420000 x26: 0000000000000001 x25: ffff80000cf7efc7 x24: 0000000000000001 x23: 0000000000000000 x22: 0000000000000001 x21: ffff000128f55c00 x20: ffff0000c79de898 x19: ffff000126abdc30 x18: 00000000000000c0 x17: 6165642820314e4f x16: ffff80000dc18158 x15: ffff000129420000 x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000129420000 x11: ff808000081c6510 x10: 0000000000000000 x9 : 239007caff2af100 x8 : 239007caff2af100 x7 : ffff80000c0b2b74 x6 : 0000000000000000 x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000 x2 : ffff0001fefbecc8 x1 : 0000000100000001 x0 : 000000000000004e Call trace: __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53 __list_del_entry include/linux/list.h:134 [inline] list_del include/linux/list.h:148 [inline] p9_fd_cancel+0x50/0xc4 net/9p/trans_fd.c:703 p9_client_rpc+0x4a8/0x548 net/9p/client.c:723 p9_client_create+0x4d8/0x758 net/9p/client.c:1015 v9fs_session_init+0xa4/0x9f0 fs/9p/v9fs.c:408 v9fs_mount+0x6c/0x568 fs/9p/vfs_super.c:126 legacy_get_tree+0x30/0x74 fs/fs_context.c:610 vfs_get_tree+0x40/0x140 fs/super.c:1531 do_new_mount+0x1dc/0x4e4 fs/namespace.c:3040 path_mount+0x358/0x890 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __arm64_sys_mount+0x2c4/0x3c4 fs/namespace.c:3568 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall arch/arm64/kernel/syscall.c:52 [inline] el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x48/0x164 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:584 Code: d2802002 912b2000 f2fbd5a2 94aa8778 (d4210000) ---[ end trace 0000000000000000 ]---