Hello, repo: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git branch: for-next commit HEAD: c0055efa0a19a9f8c10140bf8ecf5829e4d5f903 hit this issue on recent upstream，reproduced with blktests scsi/002， dmesg log： [ 1738.624635] run blktests scsi/002 at 2024-04-03 14:26:14 [ 1738.648699] ------------[ cut here ]------------ [ 1738.653352] WARNING: CPU: 2 PID: 987 at drivers/scsi/sg.c:2236 sg_remove_sfp_usercontext+0x1bc/0x1d0 [sg] [ 1738.662954] Modules linked in: ext4 mbcache jbd2 tls rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace netfs rfkill sunrpc vfat fat dm_multipath ipmi_ssif intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm mgag200 rapl i2c_algo_bit intel_cstate drm_shmem_helper iTCO_wdt acpi_ipmi iTCO_vendor_support ipmi_si drm_kms_helper mei_me dcdbas dell_smbios intel_uncore i2c_i801 ipmi_devintf mei dell_wmi_descriptor wmi_bmof lpc_ich i2c_smbus intel_pch_thermal pcspkr ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sd_mod sg ahci crct10dif_pclmul nvme libahci crc32_pclmul bnxt_en crc32c_intel nvme_core libata ghash_clmulni_intel megaraid_sas tg3 t10_pi wmi dm_mirror dm_region_hash dm_log dm_mod [last unloaded: null_blk] [ 1738.739233] CPU: 2 PID: 987 Comm: kworker/2:3 Not tainted 6.9.0-rc2+ #1 [ 1738.745863] Hardware name: Dell Inc. PowerEdge R640/0X45NX, BIOS 2.19.1 06/04/2023 [ 1738.753439] Workqueue: events sg_remove_sfp_usercontext [sg] [ 1738.759122] RIP: 0010:sg_remove_sfp_usercontext+0x1bc/0x1d0 [sg] [ 1738.765155] Code: 5a e8 30 fd eb a1 4c 8b 04 24 49 8b 75 00 49 8d 55 6d 48 c7 c1 63 e5 60 c0 48 c7 c7 0b e2 60 c0 e8 69 83 56 fd e9 46 ff ff ff <0f> 0b e9 58 ff ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 [ 1738.783907] RSP: 0018:ffffab0f054bfe18 EFLAGS: 00010202 [ 1738.789145] RAX: 0000000000000002 RBX: ffff8a9b43796080 RCX: 0000000000186002 [ 1738.796287] RDX: 0000000000184002 RSI: 000000000003a1c0 RDI: 007079439b8affff [ 1738.803431] RBP: dead000000000122 R08: 0000000000000000 R09: ffffdcc7049d5b08 [ 1738.810576] R10: 0000000000000001 R11: 0000000000000007 R12: dead000000000100 [ 1738.817719] R13: ffff8a9ec1e32d80 R14: ffff8a9b43796098 R15: ffff8a9b43797328 [ 1738.824860] FS: 0000000000000000(0000) GS:ffff8a9eafa80000(0000) knlGS:0000000000000000 [ 1738.832953] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1738.838709] CR2: 00007f5f4fcd9200 CR3: 0000000650c20002 CR4: 00000000007706f0 [ 1738.845851] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1738.852990] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1738.860132] PKRU: 55555554 [ 1738.862856] Call Trace: [ 1738.865319] <TASK> [ 1738.867436] ? __warn+0x7f/0x130 [ 1738.870690] ? sg_remove_sfp_usercontext+0x1bc/0x1d0 [sg] [ 1738.876115] ? report_bug+0x18a/0x1a0 [ 1738.879800] ? handle_bug+0x3c/0x70 [ 1738.883307] ? exc_invalid_op+0x14/0x70 [ 1738.887156] ? asm_exc_invalid_op+0x16/0x20 [ 1738.891362] ? sg_remove_sfp_usercontext+0x1bc/0x1d0 [sg] [ 1738.896785] ? sg_remove_sfp_usercontext+0x10b/0x1d0 [sg] [ 1738.902212] process_one_work+0x193/0x3d0 [ 1738.906241] worker_thread+0x2fc/0x410 [ 1738.910012] ? __pfx_worker_thread+0x10/0x10 [ 1738.914300] kthread+0xdc/0x110 [ 1738.917464] ? __pfx_kthread+0x10/0x10 [ 1738.921225] ret_from_fork+0x2d/0x50 [ 1738.924823] ? __pfx_kthread+0x10/0x10 [ 1738.928581] ret_from_fork_asm+0x1a/0x30 [ 1738.932524] </TASK> [ 1738.934725] ---[ end trace 0000000000000000 ]--- Thanks，
