BUG: corrupted list in l2cap_chan

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.14	BUG: corrupted list in l2cap_chan_put	C			6	661d	1597d	0/1	upstream: reported C repro on 2020/08/06 18:58

linux-4.14

661d

1597d

0/1

upstream: reported C repro on 2020/08/06 18:58


Created	Duration	User	Repo	Result
2021/10/19 05:43	13m	bisect fix	linux-4.19.y	error job log
2021/09/19 05:06	37m	bisect fix	linux-4.19.y	OK (0) job log log
2021/08/20 04:29	37m	bisect fix	linux-4.19.y	OK (0) job log log
2021/07/21 03:50	38m	bisect fix	linux-4.19.y	OK (0) job log log
2021/06/21 03:14	36m	bisect fix	linux-4.19.y	OK (0) job log log
2021/05/21 07:05	37m	bisect fix	linux-4.19.y	OK (0) job log log
2021/04/21 06:04	34m	bisect fix	linux-4.19.y	OK (0) job log log
2021/03/22 05:28	35m	bisect fix	linux-4.19.y	OK (0) job log log
2021/02/20 04:25	35m	bisect fix	linux-4.19.y	OK (0) job log log
2021/02/17 17:57	19m	bisect fix	linux-4.19.y	error job log
2021/02/02 23:25	1m	bisect fix	linux-4.19.y	error job log
2021/01/03 22:48	30m	bisect fix	linux-4.19.y	OK (0) job log log
2020/12/04 22:07	34m	bisect fix	linux-4.19.y	OK (0) job log log
2020/11/04 18:22	39m	bisect fix	linux-4.19.y	OK (0) job log log
2020/10/05 17:47	35m	bisect fix	linux-4.19.y	OK (0) job log log
2020/09/05 16:43	36m	bisect fix	linux-4.19.y	OK (0) job log log

list_del corruption, ffff8880a8fb7908->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:45! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7833 Comm: kworker/u5:4 Not tainted 4.19.137-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci1 hci_rx_work RIP: 0010:__list_del_entry_valid.cold+0x23/0x55 lib/list_debug.c:45 Code: e8 56 27 f4 fd 0f 0b 48 89 ee 48 c7 c7 c0 08 cb 87 e8 45 27 f4 fd 0f 0b 4c 89 ea 48 89 ee 48 c7 c7 00 08 cb 87 e8 31 27 f4 fd <0f> 0b 4c 89 e2 48 89 ee 48 c7 c7 60 08 cb 87 e8 1d 27 f4 fd 0f 0b RSP: 0018:ffff8880a3807920 EFLAGS: 00010286 RAX: 000000000000004e RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8154cf41 RDI: ffffed1014700f16 RBP: ffff8880a8fb7908 R08: 000000000000004e R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: dead000000000200 R13: dead000000000100 R14: ffff8880a8fb74c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 0000000097084000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del include/linux/list.h:125 [inline] l2cap_chan_destroy net/bluetooth/l2cap_core.c:476 [inline] kref_put include/linux/kref.h:70 [inline] l2cap_chan_put+0x5e/0x1c0 net/bluetooth/l2cap_core.c:493 l2cap_conless_channel net/bluetooth/l2cap_core.c:6976 [inline] l2cap_recv_frame+0xd36/0xa550 net/bluetooth/l2cap_core.c:7023 l2cap_recv_acldata+0x80e/0x910 net/bluetooth/l2cap_core.c:7588 hci_acldata_packet net/bluetooth/hci_core.c:4178 [inline] hci_rx_work+0x455/0xa90 net/bluetooth/hci_core.c:4364 process_one_work+0x864/0x1570 kernel/workqueue.c:2155 worker_thread+0x64c/0x1130 kernel/workqueue.c:2298 kthread+0x30b/0x410 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Modules linked in: ---[ end trace 20005df8c42c05e9 ]--- RIP: 0010:__list_del_entry_valid.cold+0x23/0x55 lib/list_debug.c:45 Code: e8 56 27 f4 fd 0f 0b 48 89 ee 48 c7 c7 c0 08 cb 87 e8 45 27 f4 fd 0f 0b 4c 89 ea 48 89 ee 48 c7 c7 00 08 cb 87 e8 31 27 f4 fd <0f> 0b 4c 89 e2 48 89 ee 48 c7 c7 60 08 cb 87 e8 1d 27 f4 fd 0f 0b RSP: 0018:ffff8880a3807920 EFLAGS: 00010286 RAX: 000000000000004e RBX: 0000000000000001 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8154cf41 RDI: ffffed1014700f16 RBP: ffff8880a8fb7908 R08: 000000000000004e R09: 0000000000000000 R10: 0000000000000005 R11: 0000000000000000 R12: dead000000000200 R13: dead000000000100 R14: ffff8880a8fb74c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000180 CR3: 0000000097084000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Crashes (6):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Manager
2020/08/06 16:25	linux-4.19.y	c076c79e03c6	4ca1c0ea	.config	console log	report	syz	C	ci2-linux-4-19
2020/08/06 01:30	linux-4.19.y	c076c79e03c6	0487ea6f	.config	console log	report	syz	C	ci2-linux-4-19
2020/08/06 01:05	linux-4.19.y	c076c79e03c6	0487ea6f	.config	console log	report	syz	C	ci2-linux-4-19
2020/08/06 00:04	linux-4.19.y	c076c79e03c6	0487ea6f	.config	console log	report	syz	C	ci2-linux-4-19
2020/08/05 20:33	linux-4.19.y	c076c79e03c6	b7129355	.config	console log	report	syz	C	ci2-linux-4-19
2020/08/05 14:54	linux-4.19.y	c076c79e03c6	b7129355	.config	console log	report	syz	C	ci2-linux-4-19

Crashes (6):

Assets (help?)