WARNING: ODEBUG bug in rfcomm_dlc_free

Status: fixed on 2020/04/16 05:11
Reported-by: syzbot+1be52530c1802cd1b2cb@syzkaller.appspotmail.com
Fix commit: 71811cac8532 Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl
First crash: 2579d, last: 2346d
Fix bisection: fixed by (bisect log) :
commit 0da9c032adbb6f83cc7f548c5155d26c64f44d63
Author: Qiujun Huang <hqjagain@gmail.com>
Date: Sun Mar 8 09:45:27 2020 +0000

  Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl

  
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING: ODEBUG bug in rfcomm_dlc_free -1 syz, C done 21 2347d 2578d 1/1 fixed on 2020/04/14 11:07
upstream WARNING: ODEBUG bug in rfcomm_dlc_free -1 syz, C done error 146 2363d 2940d 0/29 auto-obsoleted due to no activity on 2023/04/13 01:17
▶ ▼ Fix bisection attempts (4)
Created Duration User Patch Repo Result
2020/04/15 09:51 2h42m bisect fix linux-4.14.y OK (1) job log
2020/03/16 09:25 25m bisect fix linux-4.14.y OK (0) job log log
2020/02/08 02:02 23m bisect fix linux-4.14.y OK (0) job log log
2019/12/14 08:27 23m bisect fix linux-4.14.y OK (0) job log log

Sample crash report:
audit: type=1400 audit(1581758318.604:36): avc:  denied  { map } for  pid=7380 comm="syz-executor999" path="/root/syz-executor999292382" dev="sda1" ino=16483 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
ODEBUG: free active (active state 0) object type: timer_list hint: rfcomm_dlc_timeout+0x0/0x60 include/linux/compiler.h:210
------------[ cut here ]------------
WARNING: CPU: 1 PID: 7383 at lib/debugobjects.c:287 debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
Kernel panic - not syncing: panic_on_warn set ...

CPU: 1 PID: 7383 Comm: syz-executor999 Not tainted 4.14.171-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x142/0x197 lib/dump_stack.c:58
 panic+0x1f9/0x42d kernel/panic.c:183
 __warn.cold+0x2f/0x2f kernel/panic.c:547
 report_bug+0x216/0x254 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:177 [inline]
 fixup_bug arch/x86/kernel/traps.c:172 [inline]
 do_error_trap+0x1bb/0x310 arch/x86/kernel/traps.c:295
 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:314
 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:963
RIP: 0010:debug_print_object.cold+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8880971e7aa8 EFLAGS: 00010086
RAX: 000000000000005e RBX: 0000000000000003 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff86cc0a60 RDI: ffffed1012e3cf4b
RBP: ffff8880971e7ad0 R08: 000000000000005e R09: 0000000000000000
R10: 0000000000000000 R11: ffff888091d4e280 R12: ffffffff86cbbce0
R13: ffffffff85ccab00 R14: 0000000000000000 R15: ffff8880925fc328
 __debug_check_no_obj_freed lib/debugobjects.c:747 [inline]
 debug_check_no_obj_freed+0x3f5/0x7b7 lib/debugobjects.c:776
 kfree+0xbd/0x270 mm/slab.c:3814
 rfcomm_dlc_free+0x20/0x30 net/bluetooth/rfcomm/core.c:328
 rfcomm_dlc_put include/net/bluetooth/rfcomm.h:258 [inline]
 __rfcomm_create_dev net/bluetooth/rfcomm/tty.c:417 [inline]
 rfcomm_create_dev net/bluetooth/rfcomm/tty.c:486 [inline]
 rfcomm_dev_ioctl+0x1637/0x1920 net/bluetooth/rfcomm/tty.c:588
 rfcomm_sock_ioctl+0x82/0xa0 net/bluetooth/rfcomm/sock.c:902
 sock_do_ioctl+0x64/0xb0 net/socket.c:974
 sock_ioctl+0x2a6/0x470 net/socket.c:1071
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x7ae/0x1060 fs/ioctl.c:684
 SYSC_ioctl fs/ioctl.c:701 [inline]
 SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
 do_syscall_64+0x1e8/0x640 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x4412c9
RSP: 002b:00007ffefa9936d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004412c9
RDX: 0000000020000100 RSI: 00000000400452c8 RDI: 0000000000000005
RBP: 000000000000c2c1 R08: 00000000004002c8 R09: 00000000004002c8
R10: 00000000004002c8 R11: 0000000000000246 R12: 00000000004020f0
R13: 0000000000402180 R14: 0000000000000000 R15: 0000000000000000

======================================================

Crashes (16):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/15 09:21 linux-4.14.y 98db2bf27b9e 5d7b90f1 .config console log report syz C ci2-linux-4-14
2020/01/09 02:02 linux-4.14.y 84f5ad468100 ddc3e859 .config console log report syz C ci2-linux-4-14
2020/01/06 12:18 linux-4.14.y 84f5ad468100 438e1227 .config console log report syz C ci2-linux-4-14
2019/12/28 04:33 linux-4.14.y e1f7d50ae3a3 be5c2c81 .config console log report syz C ci2-linux-4-14
2019/12/26 18:46 linux-4.14.y e1f7d50ae3a3 be5c2c81 .config console log report syz C ci2-linux-4-14
2019/11/03 13:53 linux-4.14.y ddef1e8e3f6e c9610487 .config console log report syz C ci2-linux-4-14
2019/11/01 16:33 linux-4.14.y ddef1e8e3f6e a41ca8fa .config console log report syz C ci2-linux-4-14
2019/10/24 19:44 linux-4.14.y b98aebd29824 d01bb02a .config console log report syz C ci2-linux-4-14
2019/10/18 21:52 linux-4.14.y b98aebd29824 8c88c9c1 .config console log report syz C ci2-linux-4-14
2019/09/21 12:03 linux-4.14.y f6e27dbb1afa d96e88f3 .config console log report syz C ci2-linux-4-14
2019/08/27 04:14 linux-4.14.y b5260801526c d21c5d9d .config console log report syz C ci2-linux-4-14
2019/08/15 22:00 linux-4.14.y 3ffe1e79c174 faeffb00 .config console log report syz C ci2-linux-4-14
2019/08/14 17:24 linux-4.14.y 3ffe1e79c174 5576551b .config console log report syz C ci2-linux-4-14
2019/07/28 15:57 linux-4.14.y ff33472c282e c85e1c5b .config console log report syz C ci2-linux-4-14
2019/07/27 16:50 linux-4.14.y ff33472c282e c85e1c5b .config console log report syz C ci2-linux-4-14
2019/08/18 01:38 linux-4.14.y 45f092f9e9cb 55bf8926 .config console log report ci2-linux-4-14
* Struck through repros no longer work on HEAD.