Message-ID: <ab7635d7-70e7-4906-bdcf-90006d7edf85@linux.ibm.com>
Date: Fri, 9 Jan 2026 19:26:01 +0530
From: Venkat Rao Bagalkote <venkat88@...ux.ibm.com>
To: Ming Lei <ming.lei@...hat.com>
Cc: Christoph Hellwig <hch@...radead.org>, linux-block@...r.kernel.org,
        linux-scsi@...r.kernel.org, Jens Axboe <axboe@...nel.dk>,
        James.Bottomley@...senpartnership.com, leonro@...dia.com,
        kch@...dia.com, LKML <linux-kernel@...r.kernel.org>,
        Madhavan Srinivasan <maddy@...ux.ibm.com>, riteshh@...ux.ibm.com,
        ojaswin@...ux.ibm.com
Subject: Re: [next-20260108]kernel BUG at drivers/scsi/scsi_lib.c:1173!


On 09/01/26 6:28 pm, Ming Lei wrote:
> On Fri, Jan 09, 2026 at 05:51:15PM +0530, Venkat Rao Bagalkote wrote:
>> On 09/01/26 5:25 pm, Ming Lei wrote:
>>> On Fri, Jan 09, 2026 at 05:14:36PM +0530, Venkat Rao Bagalkote wrote:
>>>> On 09/01/26 12:19 pm, Ming Lei wrote:
>>>>> On Thu, Jan 08, 2026 at 09:56:39PM -0800, Christoph Hellwig wrote:
>>>>>> I've seen the same when running xfstests on xfs, and bisected it to:
>>>>>>
>>>>>> commit ee623c892aa59003fca173de0041abc2ccc2c72d
>>>>>> Author: Ming Lei <ming.lei@...hat.com>
>>>>>> Date:   Wed Dec 31 11:00:55 2025 +0800
>>>>>>
>>>>>>        block: use bvec iterator helper for bio_may_need_split()
>>>>>>
>>>>> Hi Christoph and Venkat Rao Bagalkote,
>>>>>
>>>>> Unfortunately I can't duplicate the issue in my environment, can you test
>>>>> the following patch?
>>>>>
>>>>> diff --git a/block/blk.h b/block/blk.h
>>>>> index 98f4dfd4ec75..980eef1f5690 100644
>>>>> --- a/block/blk.h
>>>>> +++ b/block/blk.h
>>>>> @@ -380,7 +380,7 @@ static inline bool bio_may_need_split(struct bio *bio,
>>>>>                    return true;
>>>>>            bv = __bvec_iter_bvec(bio->bi_io_vec, bio->bi_iter);
>>>>> -       if (bio->bi_iter.bi_size > bv->bv_len)
>>>>> +       if (bio->bi_iter.bi_size > bv->bv_len - bio->bi_iter.bi_bvec_done)
>>>>>                    return true;
>>>>>            return bv->bv_len + bv->bv_offset > lim->max_fast_segment_size;
>>>>>     }
>>>> Hello Ming,
>>>>
>>>>
>>>> This is not helping. I am hitting this issue, during kernel build itself.
>>> Can you confirm if it can fix the blktests ext4/056 first?
>>>
>>> If kernel building is running over new patched kernel, please provide the
>>> dmesg log. And if it is reproduciable, can you confirm if it can be fixed
>>> by reverting ee623c892aa59003 (block: use bvec iterator helper for bio_may_need_split())?
>>
>> Unfortunately, even with revert, build fails.
>>
>>
>>
>> commit c64b2ee9cddcb31546c8622ef018d344544a9388 (HEAD)
>> Author: Super User <root@...-zzci-1.ltc.tadn.ibm.com>
>> Date:   Fri Jan 9 06:51:19 2026 -0600
>>
>>      Revert "block: use bvec iterator helper for bio_may_need_split()"
>>
>>      This reverts commit ee623c892aa59003fca173de0041abc2ccc2c72d.
> OK, then your issue isn't related with the above change.
>
> Can you reproduce & collect dmesg log with the bad sg/rq/bio/bvec info by
> applying the attached debug patch?
>
> Also if possible, please collect your scsi queue's limit info before
> reproducing the issue:
>
> 	(cd /sys/block/$SD/queue && find . -type f -exec grep -aH . {} \;)

Hello Ming,

After applying the patch shared via attachment also, I see build failure.

I have attached the kernel config file.


git diff
diff --git a/block/blk-mq-dma.c b/block/blk-mq-dma.c
index 752060d7261c..33c1b6a0a738 100644
--- a/block/blk-mq-dma.c
+++ b/block/blk-mq-dma.c
@@ -4,8 +4,75 @@
   */
  #include <linux/blk-integrity.h>
  #include <linux/blk-mq-dma.h>
+#include <linux/scatterlist.h>
  #include "blk.h"


Dmesg:


make -j 48 -s && make modules_install && make install
[ 5625.770436] ------------[ cut here ]------------
[ 5625.770476] WARNING: block/blk-mq-dma.c:309 at 
__blk_rq_map_sg+0x220/0x280, CPU#29: kworker/29:0H/167
[ 5625.770516] Modules linked in: bonding tls rfkill nft_fib_inet 
nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 
nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack 
nf_defrag_ipv6 nf_defrag_ipv4 nf_tables pseries_rng vmx_crypto sg fuse 
loop vsock_loopback vmw_vsock_virtio_transport_common vsock xfs nvme_tcp 
nvme_fabrics nvme_core sr_mod sd_mod cdrom nvme_keyring nvme_auth hkdf 
ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log 
dm_mod nfnetlink
[ 5625.770847] CPU: 29 UID: 0 PID: 167 Comm: kworker/29:0H Kdump: loaded 
Not tainted 6.19.0-rc4-next-20260108 #1 VOLUNTARY
[ 5625.770877] Hardware name: IBM,8375-42A POWER9 (architected) 0x4e0202 
0xf000005 of:IBM,FW950.80 (VL950_131) hv:phyp pSeries
[ 5625.770905] Workqueue: kblockd blk_mq_run_work_fn
[ 5625.770936] NIP:  c000000000d05840 LR: c000000000d05828 CTR: 
0000000000000000
[ 5625.770958] REGS: c00000000b067520 TRAP: 0700   Not tainted 
(6.19.0-rc4-next-20260108)
[ 5625.770980] MSR:  800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  
CR: 44002202  XER: 20040001
[ 5625.771072] CFAR: c0000000008f2b50 IRQMASK: 0
[ 5625.771072] GPR00: c000000000d05798 c00000000b0677c0 c0000000024ea800 
c0000000126693fc
[ 5625.771072] GPR04: c00000000b0677f8 c00000000b0677e8 c000000000d0490c 
0000000000000000
[ 5625.771072] GPR08: 0000000001139638 0000000000000001 0000000000000000 
c0080000072518e8
[ 5625.771072] GPR12: c0000000011cf6a0 c00000001185c700 c0000000002d4c08 
c000000007ce4980
[ 5625.771072] GPR16: c0000000c2775890 0000000000100001 c00000000ace2310 
c000000012669398
[ 5625.771072] GPR20: 0000000001139638 0000000000000000 c0000000126693ac 
0000000000007000
[ 5625.771072] GPR24: c0000000126695a8 fffffffffffffffd c000000012669380 
0000000000000002
[ 5625.771072] GPR28: c00000000b0678a0 0000000000000000 c00c0000010dda80 
c0000000b01dbb80
[ 5625.771413] NIP [c000000000d05840] __blk_rq_map_sg+0x220/0x280
[ 5625.771443] LR [c000000000d05828] __blk_rq_map_sg+0x208/0x280
[ 5625.771470] Call Trace:
[ 5625.771483] [c00000000b0677c0] [c000000000d05798] 
__blk_rq_map_sg+0x178/0x280 (unreliable)
[ 5625.771523] [c00000000b067880] [c0000000011cf7bc] 
scsi_alloc_sgtables+0x11c/0x700
[ 5625.771557] [c00000000b067920] [c008000007247c08] 
sd_setup_read_write_cmnd+0xf0/0xcd0 [sd_mod]
[ 5625.771606] [c00000000b067a20] [c0000000011d1ce4] 
scsi_prepare_cmd+0x324/0x440
[ 5625.771641] [c00000000b067a90] [c0000000011d2128] 
scsi_queue_rq+0x328/0xb00
[ 5625.771672] [c00000000b067b50] [c000000000cfad00] 
blk_mq_dispatch_rq_list+0x270/0x9b0
[ 5625.771703] [c00000000b067c00] [c000000000d09100] 
__blk_mq_do_dispatch_sched+0x580/0x5a0
[ 5625.771737] [c00000000b067cb0] [c000000000d09844] 
__blk_mq_sched_dispatch_requests+0x2b4/0x360
[ 5625.771771] [c00000000b067d20] [c000000000d099e4] 
blk_mq_sched_dispatch_requests+0x74/0x110
[ 5625.771807] [c00000000b067d60] [c000000000cef4e8] 
blk_mq_run_work_fn+0xe8/0x120
[ 5625.771841] [c00000000b067da0] [c0000000002c0cac] 
process_one_work+0x41c/0x8b0
[ 5625.771879] [c00000000b067eb0] [c0000000002c149c] 
worker_thread+0x35c/0x780
[ 5625.771911] [c00000000b067f80] [c0000000002d4e14] kthread+0x214/0x230
[ 5625.771942] [c00000000b067fe0] [c00000000000ded8] 
start_kernel_thread+0x14/0x18
[ 5625.771975] Code: 813a001c 39400001 71291000 40820014 387a007c 
4bbed2d5 60000000 a15a007c 7c1b5000 39200001 39400000 7d29505e 
<0b090000> e9410068 e92d0c78 7d4a4a79
[ 5625.772107] ---[ end trace 0000000000000000 ]---
[ 5625.772187] ------------[ cut here ]------------
[ 5625.772203] kernel BUG at drivers/scsi/scsi_lib.c:1173!
[ 5625.772225] Oops: Exception in kernel mode, sig: 5 [#1]
[ 5625.772243] LE PAGE_SIZE=64K MMU=Hash  SMP NR_CPUS=8192 NUMA pSeries
[ 5625.772265] Modules linked in: bonding tls rfkill nft_fib_inet 
nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 
nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack 
nf_defrag_ipv6 nf_defrag_ipv4 nf_tables pseries_rng vmx_crypto sg fuse 
loop vsock_loopback vmw_vsock_virtio_transport_common vsock xfs nvme_tcp 
nvme_fabrics nvme_core sr_mod sd_mod cdrom nvme_keyring nvme_auth hkdf 
ibmvscsi ibmveth scsi_transport_srp dm_mirror dm_region_hash dm_log 
dm_mod nfnetlink
[ 5625.772583] CPU: 29 UID: 0 PID: 167 Comm: kworker/29:0H Kdump: loaded 
Tainted: G        W           6.19.0-rc4-next-20260108 #1 VOLUNTARY
[ 5625.772613] Tainted: [W]=WARN
[ 5625.772627] Hardware name: IBM,8375-42A POWER9 (architected) 0x4e0202 
0xf000005 of:IBM,FW950.80 (VL950_131) hv:phyp pSeries
[ 5625.772648] Workqueue: kblockd blk_mq_run_work_fn
[ 5625.772677] NIP:  c0000000011cf9a0 LR: c0000000011cf988 CTR: 
0000000000000000
[ 5625.772699] REGS: c00000000b0675e0 TRAP: 0700   Tainted: G   W        
     (6.19.0-rc4-next-20260108)
[ 5625.772721] MSR:  800000000282b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE>  
CR: 84002202  XER: 20040001
[ 5625.772809] CFAR: c0000000008f2cf0 IRQMASK: 0
[ 5625.772809] GPR00: c0000000011cf7bc c00000000b067880 c0000000024ea800 
c000000012669550
[ 5625.772809] GPR04: c00000000b0677f8 c00000000b0677e8 c000000000d0490c 
0000000000000000
[ 5625.772809] GPR08: 0000000000000001 0000000000000001 0000000000000000 
c0080000072518e8
[ 5625.772809] GPR12: c0000000011cf6a0 c00000001185c700 c0000000002d4c08 
c000000007ce4980
[ 5625.772809] GPR16: c0000000c2775890 0000000000100001 c00000000ace2310 
c000000012669398
[ 5625.772809] GPR20: 0000000000010000 0000000000000000 c0000000126693ac 
0000000000000002
[ 5625.772809] GPR24: c000000012669548 0000000000000002 c0000000c21a0828 
c00000001266939c
[ 5625.772809] GPR28: c000000012669380 c000000012669550 c0000000d9f1ac80 
c000000012669480
[ 5625.773133] NIP [c0000000011cf9a0] scsi_alloc_sgtables+0x300/0x700
[ 5625.773160] LR [c0000000011cf988] scsi_alloc_sgtables+0x2e8/0x700
[ 5625.773189] Call Trace:
[ 5625.773203] [c00000000b067880] [c0000000011cf7bc] 
scsi_alloc_sgtables+0x11c/0x700 (unreliable)
[ 5625.773242] [c00000000b067920] [c008000007247c08] 
sd_setup_read_write_cmnd+0xf0/0xcd0 [sd_mod]
[ 5625.773289] [c00000000b067a20] [c0000000011d1ce4] 
scsi_prepare_cmd+0x324/0x440
[ 5625.773326] [c00000000b067a90] [c0000000011d2128] 
scsi_queue_rq+0x328/0xb00
[ 5625.773357] [c00000000b067b50] [c000000000cfad00] 
blk_mq_dispatch_rq_list+0x270/0x9b0
[ 5625.773386] [c00000000b067c00] [c000000000d09100] 
__blk_mq_do_dispatch_sched+0x580/0x5a0
[ 5625.773417] [c00000000b067cb0] [c000000000d09844] 
__blk_mq_sched_dispatch_requests+0x2b4/0x360
[ 5625.773451] [c00000000b067d20] [c000000000d099e4] 
blk_mq_sched_dispatch_requests+0x74/0x110
[ 5625.773484] [c00000000b067d60] [c000000000cef4e8] 
blk_mq_run_work_fn+0xe8/0x120
[ 5625.773519] [c00000000b067da0] [c0000000002c0cac] 
process_one_work+0x41c/0x8b0
[ 5625.773552] [c00000000b067eb0] [c0000000002c149c] 
worker_thread+0x35c/0x780
[ 5625.773585] [c00000000b067f80] [c0000000002d4e14] kthread+0x214/0x230
[ 5625.773615] [c00000000b067fe0] [c00000000000ded8] 
start_kernel_thread+0x14/0x18
[ 5625.773646] Code: 813f0110 7d295214 913f0110 3bbf00d0 7fa3eb78 
4b723315 60000000 811f00d0 39400000 39200001 7c08b840 7d29501e 
<0b090000> 7f63db78 92ff00d0 4b7232ed
[ 5625.773771] ---[ end trace 0000000000000000 ]---
[ 5625.795361] pstore: backend (nvram) writing error (-1)
[ 5625.795394]

Regards,

Venkat.

>
>
>
> Thanks,
> Ming
View attachment "scsi_alloc.config" of type "text/plain" (187388 bytes)

Powered by blists - more mailing lists