Re: [syzbot] [nvme?] BUG: corrupted list in nvmet_fc_remove_port

[Nhật Anh Nguyễn Duy]

On Sat, Oct 17, 2026 at 9:09 AM Hillf Danton <hdanton@xxxxxxxx> wrote:
>
> > Date: Sun, 11 Oct 2026 10:32:37 -0700 [thread overview]
> > Hello,
> >
> > syzbot found the following issue on:
> >
> > HEAD commit:    a5ebb76233b7 Merge tag 'edac_urgent_for_v7.3_rc7' of git:/..
> > git tree:       upstream
> > console+strace: https://syzkaller.appspot.com/x/log.txt?x=1494923e580000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=df4bbab1c2172b9f
> > dashboard link: https://syzkaller.appspot.com/bug?extid=c98b21427617af7f547a
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=126a0f15580000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=166a0f15580000
>
> Test Nguyen's idea.
>
> #syz test
>
> --- x/drivers/nvme/target/fc.c
> +++ y/drivers/nvme/target/fc.c
> @@ -1319,12 +1319,13 @@ nvmet_fc_portentry_rebind_tgt(struct nvm
>
>         spin_lock_irqsave(&nvmet_fc_tgtlock, flags);
>         list_for_each_entry(pe, &nvmet_fc_portentry_list, pe_list) {
> +               if (pe->tgtport)
> +                       continue;
>                 if (tgtport->fc_target_port.node_name == pe->node_name &&
>                     tgtport->fc_target_port.port_name == pe->port_name) {
>                         if (!nvmet_fc_tgtport_get(tgtport))
> -                               continue;
> +                               break;
>
> -                       WARN_ON(pe->tgtport);
>                         tgtport->pe = pe;
>                         pe->tgtport = tgtport;
>                         break;
> --

[Resending to list + CCs — accidentally dropped them in my previous
reply, apologies]

You may need to recheck the commit you're testing
on because #syz test or #syz test: upstream master runs on the latest
commit of the repository. Something like #syz test: upstream [commit]
would let the bot test it on the specific commit the bug was
discovered in.

Best regards,
Nhat Anh