[v6.1] BUG: unable to handle kernel paging request in blk_mq_complete_request_remote

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1a8763b93150 Linux 6.1.188
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16402405580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7e5b41322189806a
dashboard link: https://syzkaller.appspot.com/bug?extid=f7dc1c307e0649592270
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/79d582e9ec4f/disk-1a8763b9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/70e43b512b19/vmlinux-1a8763b9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7107d5b60093/Image-1a8763b9.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f7dc1c...@syzkaller.appspotmail.com

nvme 0000:00:02.0: enabling device (0000 -> 0002)
nvme nvme0: Removing after probe failure status: -19
Unable to handle kernel paging request at virtual address dfff800000000031
KASAN: null-ptr-deref in range [0x0000000000000188-0x000000000000018f]
Mem abort info:
ESR = 0x0000000096000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x06: level 2 translation fault
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
[dfff800000000031] address between user and kernel address ranges
Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 5362 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: nvme-reset-wq nvme_reset_work
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : blk_mq_complete_request_remote+0x78/0x61c block/blk-mq.c:1210
lr : blk_mq_complete_request_remote+0x2c/0x61c block/blk-mq.c:1202
sp : ffff8000216b7560
x29: ffff8000216b7560 x28: 1fffe00019f3a478 x27: 0000000000000002
x26: ffff0000d02aa480 x25: ffff0000cf9d23ea x24: dfff800000000000
x23: dfff800000000000 x22: ffff0000cf9f9728 x21: 1fffe0001a0554b6
x20: 000000000000018e x19: ffff0000d02aa480 x18: 1fffe00033e6db7e
x17: ffff8000153bd000 x16: ffff800011bb65f8 x15: ffff800018508000
x14: 0000000000000001 x13: 1fffe00019e17e49 x12: 0000000000000000
x11: ff0080000a7c749c x10: 0000000000000000 x9 : 1fffe0001a055492
x8 : 0000000000000031 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000020 x4 : 0000000000000008 x3 : 0000000000000000
x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000d02aa480
Call trace:
blk_mq_complete_request_remote+0x78/0x61c block/blk-mq.c:1210
nvme_try_complete_req drivers/nvme/host/nvme.h:708 [inline]
nvme_handle_cqe drivers/nvme/host/pci.c:1085 [inline]
nvme_poll_cq+0x518/0xf50 drivers/nvme/host/pci.c:1115
nvme_reap_pending_cqes drivers/nvme/host/pci.c:1562 [inline]
nvme_dev_disable+0x350/0x5ec drivers/nvme/host/pci.c:2769
nvme_remove_dead_ctrl drivers/nvme/host/pci.c:2864 [inline]
nvme_reset_work+0x3808/0x477c drivers/nvme/host/pci.c:3015
process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
kthread+0x254/0x2e0 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 9784bafd f9400288 91063914 d343fe88 (38f76908)
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
0: 9784bafd bl 0xfffffffffe12ebf4
4: f9400288 ldr x8, [x20]
8: 91063914 add x20, x8, #0x18e
c: d343fe88 lsr x8, x20, #3
* 10: 38f76908 ldrsb w8, [x8, x23] <-- trapping instruction


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup