BUG: sleeping function called from invalid context in lock_sock

BUG: sleeping function called from invalid context in lock_sock_nested (2)
Status: upstream: reported C repro on 2020/02/22 15:08
Reported-by: syzbot+a5df189917e79d5e59c9@syzkaller.appspotmail.com
First crash: 487d, last: now

Cause bisection: introduced by (bisect log) :
commit 5ac6badc5aa057ceb1d50c93326a81db6e89ad2f
Author: Daniel Mack <daniel@zonque.org>
Date: Thu Jul 11 12:45:03 2019 +0000

device-tree: bindinds: add NXP PCT2075 as compatible device to LM75

Crash: KASAN: use-after-free Read in sk_psock_unlink (log)
Repro: syz .config

Fix bisection: failed (bisect log)

similar bugs (6):
Kernel	Title	Repro	Fix bisect	Count	Last	Reported	Patched	Status
linux-4.19	BUG: sleeping function called from invalid context in lock_sock_nested (2)	C		653	now	9d13h	0/1	upstream: reported C repro on 2021/06/10 12:12
linux-4.14	BUG: sleeping function called from invalid context in lock_sock_nested			1	718d	718d	0/1	auto-closed as invalid on 2019/10/30 11:24
linux-4.14	BUG: sleeping function called from invalid context in lock_sock_nested (2)	syz	done	1	502d	563d	1/1	fixed on 2020/03/04 10:17
linux-4.19	BUG: sleeping function called from invalid context in lock_sock_nested	syz	done	1	532d	562d	1/1	fixed on 2020/02/05 13:33
upstream	BUG: sleeping function called from invalid context in lock_sock_nested	C		1232	487d	562d	16/22	fixed on 2020/02/18 14:31
linux-4.14	BUG: sleeping function called from invalid context in lock_sock_nested (3)	syz		29	now	9d05h	0/1	upstream: reported syz repro on 2021/06/10 20:33

Sample crash report:

BUG: sleeping function called from invalid context at net/core/sock.c:3064
in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 8454, name: syz-executor417
1 lock held by syz-executor417/8454:
 #0: ffffffff8d8c4240 (hci_sk_list.lock){++++}-{2:2}, at: hci_sock_dev_event+0x3db/0x660 net/bluetooth/hci_sock.c:763
Preemption disabled at:
[<0000000000000000>] 0x0
CPU: 0 PID: 8454 Comm: syz-executor417 Not tainted 5.13.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 ___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:8337
 lock_sock_nested+0x25/0x120 net/core/sock.c:3064
 lock_sock include/net/sock.h:1610 [inline]
 hci_sock_dev_event+0x465/0x660 net/bluetooth/hci_sock.c:765
 hci_unregister_dev+0x2fd/0x1130 net/bluetooth/hci_core.c:4013
 vhci_release+0x70/0xe0 drivers/bluetooth/hci_vhci.c:340
 __fput+0x288/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x1a0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0xbfc/0x2a60 kernel/exit.c:826
 do_group_exit+0x125/0x310 kernel/exit.c:923
 __do_sys_exit_group kernel/exit.c:934 [inline]
 __se_sys_exit_group kernel/exit.c:932 [inline]
 __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:932
 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x452039
Code: Unable to access opcode bytes at RIP 0x45200f.
RSP: 002b:00007ffeff5aa7c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004d81d0 RCX: 0000000000452039
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffbc R09: 00007ffeff5aa290
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004d81d0
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001

======================================================

Crashes (5547):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-kasan-gce	2021/06/20 00:38	upstream	9ed13a17	aba2b2fb	.config	log	report	syz	C		BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 23:12	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz	C		BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2020/02/19 08:27	upstream	0a44cac8	135c18aa	.config	log	report	syz	C
ci-upstream-kasan-gce	2021/06/19 17:27	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/19 12:00	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 10:25	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/19 09:09	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/19 08:50	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 07:03	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 00:45	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 23:59	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 23:33	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 21:51	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 21:07	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 20:03	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 18:39	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 14:31	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 13:39	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 12:33	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 11:24	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 08:10	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 07:59	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 05:58	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 01:52	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 01:14	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/17 23:31	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/17 23:06	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/17 22:17	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/17 20:40	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/17 19:43	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/17 19:17	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/17 19:13	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/17 10:15	upstream	6b00bc63	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/17 08:02	upstream	6b00bc63	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/19 22:47	upstream	9ed13a17	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/19 15:22	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/19 11:39	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/19 06:30	upstream	b1edae0d	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/18 23:50	upstream	fd0aa1a4	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/18 02:06	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/17 17:22	upstream	70585216	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-this-kasan-gce	2021/06/18 20:02	net	1c200f83	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2021/06/18 15:10	net-next	8fe088bd	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2021/06/17 17:49	net-next	0c337952	aba2b2fb	.config	log	report	syz			BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2020/02/18 16:42	net-next	b182a667	012fbc32	.config	log	report	syz
ci-qemu-upstream	2021/06/20 01:24	upstream	913ec3c2	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/20 00:14	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream	2021/06/19 22:06	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 20:32	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/19 19:30	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/19 18:56	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/19 18:34	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream	2021/06/19 13:54	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream	2021/06/19 10:55	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream	2021/06/19 08:12	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 04:47	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 04:47	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 03:46	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 03:06	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/19 02:32	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/19 02:09	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/19 01:40	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream	2021/06/18 19:58	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 19:54	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 17:27	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 16:26	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 16:12	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 12:33	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-smack-root	2021/06/18 09:37	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 07:07	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 04:49	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce	2021/06/18 04:42	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 03:32	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-selinux-root	2021/06/18 03:08	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-root	2021/06/18 02:38	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/19 23:59	upstream	913ec3c2	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-kasan-gce-386	2021/06/19 16:30	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/19 15:00	upstream	9ed13a17	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/19 09:41	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/19 06:04	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/19 05:51	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/18 23:29	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/18 21:29	upstream	b1edae0d	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/18 18:30	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/18 11:07	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-qemu-upstream-386	2021/06/18 08:35	upstream	fd0aa1a4	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-bpf-kasan-gce	2021/06/19 20:32	bpf	61e8aeda	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-this-kasan-gce	2021/06/19 16:38	net	35036d69	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-bpf-kasan-gce	2021/06/18 05:51	bpf	da5ac772	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2021/06/19 21:38	net-next	adc2e56e	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-bpf-next-kasan-gce	2021/06/19 17:59	bpf-next	f42cfb46	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-bpf-next-kasan-gce	2021/06/19 12:39	bpf-next	f540a7d2	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-bpf-next-kasan-gce	2021/06/19 01:02	bpf-next	f540a7d2	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2021/06/18 10:39	net-next	8fe088bd	aba2b2fb	.config	log	report			info	BUG: sleeping function called from invalid context in lock_sock_nested
ci-upstream-net-kasan-gce	2020/02/18 15:03	net-next	b182a667	012fbc32	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/04/03 11:57	linux-next	770fbb32	5ed396e6	.config	log	report
ci-upstream-linux-next-kasan-gce-root	2020/04/02 15:58	linux-next	770fbb32	a34e2c33	.config	log	report