Adding some background to the question, to make it understandable:
This is with respect to NVMe protocol - Along with an I/O command, if required, metadata too can be sent/received to/from the device. This metadata can be sent as part of an extended LBA ([data block + metadata]) OR it can be sent in a separate buffer ([data block, data block, ..], [metadata]).
We are working on NVMe driver in linux kernel 4.13.10. We want to test an NVMe I/O commands with separate metadata. We send the command using IOCTL, and along the command we send the buffer to be used by driver to be sent to controller for metadata. The driver uses blk_execute_rq to submit the command to the block layer.
This implementation works properly for normal commands, but when used with separate metadata, it crashes at blk_mq_start_request.