Before call queue_rq(), initialize rq->state to MQ_RQ_IDLE. Reported-and-tested-by: syzbot+fcc47ba2476570cbbeb0@xxxxxxxxxxxxxxxxxxxxxxxxx Signed-off-by: Edward Adam Davis <eadavis@xxxxxx> --- block/blk-mq.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-mq.c b/block/blk-mq.c index e2d11183f62e..26f2921cbc50 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2575,6 +2575,8 @@ static blk_status_t __blk_mq_issue_directly(struct blk_mq_hw_ctx *hctx, * Any other error (busy), just add it to our list as we * previously would have done. */ + if (READ_ONCE(rq->state)) + WRITE_ONCE(rq->state, MQ_RQ_IDLE); ret = q->mq_ops->queue_rq(hctx, &bd); switch (ret) { case BLK_STS_OK: -- 2.25.1