BUG: corrupted list in nvmet_fc_remove_port

Status: upstream: reported C repro on 2026/10/05 02:04
Reported-by: syzbot+1fe89682ab1c5a66e190@syzkaller.appspotmail.com
First crash: 10d, last: 10d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: corrupted list in nvmet_fc_remove_port nvme prio:normal 8 syz, C error 2 4d04h 3d18h 0/29 upstream: reported C repro on 2026/10/11 17:32
linux-5.15 BUG: corrupted list in nvmet_fc_remove_port 8 syz, C 4 10d 10d 0/3 upstream: reported C repro on 2026/10/05 00:02

Sample crash report:
nvmet: Disable port '1' before changing attribute in nvmet_addr_trtype_store
list_del corruption. prev->next should be ffff0000ce492020, but was 0000000000000000. (prev=ffff80001c9cd760)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4538 Comm: syz.1.28 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 624000c5 (nZCv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x140/0x15c lib/list_debug.c:59
lr : __list_del_entry_valid+0x140/0x15c lib/list_debug.c:59
sp : ffff8000212e7a40
x29: ffff8000212e7a40 x28: 1fffe000194f2b57 x27: ffff0000d9096528
x26: ffff0000d9096520 x25: ffff0000ce492020 x24: dfff800000000000
x23: 1fffe00019c92400 x22: dfff800000000000 x21: ffff80001c9cd760
x20: ffff80000c4702e4 x19: ffff0000ce492020 x18: 1fffe00033e66f7e
x17: 20747562202c3032 x16: ffff800011bc8ec8 x15: 3030666666662065
x14: 0000000000000001 x13: 1fffe00033e66fa3 x12: 0000000000000000
x11: ff008000083170c8 x10: 0000000000000000 x9 : d0eea59702678100
x8 : d0eea59702678100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000212e7518 x4 : ffff8000154b4f40 x3 : ffff800008542f08
x2 : 0000000000000001 x1 : 0000000100000001 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid+0x140/0x15c lib/list_debug.c:59
 __list_del_entry include/linux/list.h:141 [inline]
 list_del include/linux/list.h:155 [inline]
 nvmet_fc_portentry_unbind drivers/nvme/target/fc.c:1288 [inline]
 nvmet_fc_remove_port+0xa8/0x1b0 drivers/nvme/target/fc.c:2895
 nvmet_disable_port+0x124/0x1d0 drivers/nvme/target/core.c:378
 nvmet_port_subsys_drop_link+0x1dc/0x210 drivers/nvme/target/configfs.c:916
 configfs_unlink+0x3f0/0x678 fs/configfs/symlink.c:250
 vfs_unlink+0x2e0/0x4f4 fs/namei.c:4373
 do_unlinkat+0x318/0x504 fs/namei.c:4441
 __do_sys_unlinkat fs/namei.c:4484 [inline]
 __se_sys_unlinkat fs/namei.c:4477 [inline]
 __arm64_sys_unlinkat+0xe0/0xfc fs/namei.c:4477
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 91050000 aa1303e1 aa1503e3 95c597f7 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/05 02:04 linux-6.1.y a500ba24937a 57bbd979 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: corrupted list in nvmet_fc_remove_port
* Struck through repros no longer work on HEAD.