[bug report] WARNING: CPU: 3 PID: 522 at block/genhd.c:144 bdev_count_inflight_rw+0x26e/0x410

[Breno Leitao]

On Fri, Jun 06, 2025 at 11:31:06AM +0800, Yi Zhang wrote:
> Hello
> 
> The following WARNING was triggered by blktests nvme/fc nvme/012,
> please help check and let me know if you need any info/test, thanks.
> 
> commit: linux-block: 38f4878b9463 (HEAD, origin/for-next) Merge branch
> 'block-6.16' into for-next

I am seeing a similar issue on Linus' recent tree as e271ed52b344
("Merge tag 'pm-6.16-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm").
CCing Jens.

This is my stack, in case it is useful.

           WARNING: CPU: 33 PID: 1865 at block/genhd.c:146 bdev_count_inflight_rw+0x334/0x3b0
           Modules linked in: sch_fq(E) tls(E) act_gact(E) tcp_diag(E) inet_diag(E) cls_bpf(E) intel_uncore_frequency(E) intel_uncore_frequency_common(E) skx_edac(E) skx_edac_common(E) nfit(E) libnvdimm(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) kvm_intel(E) kvm(E) mlx5_ib(E) iTCO_wdt(E) iTCO_vendor_support(E) xhci_pci(E) evdev(E) irqbypass(E) acpi_cpufreq(E) ib_uverbs(E) ipmi_si(E) i2c_i801(E) xhci_hcd(E) i2c_smbus(E) ipmi_devintf(E) wmi(E) ipmi_msghandler(E) button(E) sch_fq_codel(E) vhost_net(E) tun(E) vhost(E) vhost_iotlb(E) tap(E) mpls_gso(E) mpls_iptunnel(E) mpls_router(E) fou(E) loop(E) drm(E) backlight(E) drm_panel_orientation_quirks(E) autofs4(E) efivarfs(E)
           CPU: 33 UID: 0 PID: 1865 Comm: kworker/u144:14 Kdump: loaded Tainted: G S          E    N  6.15.0-0_fbk701_debugnightly_rc0_upstream_12426_ge271ed52b344 #1 PREEMPT(undef) 
           Tainted: [S]=CPU_OUT_OF_SPEC, [E]=UNSIGNED_MODULE, [N]=TEST
           Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A23 12/08/2020
           Workqueue: writeback wb_workfn (flush-btrfs-1)
           RIP: 0010:bdev_count_inflight_rw+0x334/0x3b0
           Code: 75 5c 41 83 3f 00 78 22 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b 41 0f b6 06 84 c0 75 54 41 c7 07 00 00 00 00 eb bb <0f> 0b 48 b8 00 00 00 00 00 fc ff df 0f b6 04 03 84 c0 75 4e 41 c7
           RSP: 0018:ffff8882ed786f20 EFLAGS: 00010286
           RAX: 0000000000000000 RBX: 1ffff1105daf0df3 RCX: ffffffff829739f7
           RDX: 0000000000000024 RSI: 0000000000000024 RDI: ffffffff853f79f8
           RBP: 0000606f9ff42610 R08: ffffe8ffffd866a7 R09: 1ffffd1ffffb0cd4
           R10: dffffc0000000000 R11: fffff91ffffb0cd5 R12: 0000000000000024
           R13: 1ffffffff0dd0120 R14: ffffed105daf0df3 R15: ffff8882ed786f9c
           FS:  0000000000000000(0000) GS:ffff88905fd44000(0000) knlGS:0000000000000000
           CR2: 00007f904bc6d008 CR3: 0000001075c2b001 CR4: 00000000007726f0
           PKRU: 55555554
           Call Trace:
            <TASK>
            bdev_count_inflight+0x28/0x50
            update_io_ticks+0x10f/0x1b0
            blk_account_io_start+0x3a0/0x690
            blk_mq_submit_bio+0xc7e/0x1940
            __submit_bio+0x125/0x3c0
            ? lock_release+0x4a/0x3c0
            submit_bio_noacct_nocheck+0x3cf/0xa30
            btree_write_cache_pages+0x5eb/0x870
            do_writepages+0x307/0x4d0
            ? rcu_is_watching+0xf/0xa0
            __writeback_single_inode+0x106/0xd10
            writeback_sb_inodes+0x53d/0xd60
            wb_writeback+0x368/0x8d0
            wb_workfn+0x3aa/0xcf0
            ? rcu_is_watching+0xf/0xa0
            ? trace_irq_enable+0x64/0x190
            ? process_scheduled_works+0x959/0x1450
            process_scheduled_works+0x9fe/0x1450
            worker_thread+0x8fd/0xd10
            kthread+0x50c/0x630
            ? rcu_is_watching+0xf/0xa0
            </TASK>
           irq event stamp: 0
           hardirqs last disabled at (0): [<ffffffff81401f85>] copy_process+0x655/0x32d0
           softirqs last  enabled at (0): [<ffffffff81401f85>] copy_process+0x655/0x32d0