WARNING: ODEBUG bug in bt_host_release

Status: fixed on 2022/09/20 07:46
Subsystems: bluetooth
[Documentation on labels]
Reported-by: syzbot+0ce8a29c6c6469b16632@syzkaller.appspotmail.com
Fix commit: e2cb6b891ad2 bluetooth: eliminate the potential race condition when removing the HCI controller
First crash: 2185d, last: 1932d
Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config
  
Fix bisection: fixed by (bisect log) :
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
Author: Lin Ma <linma@zju.edu.cn>
Date: Mon Apr 12 11:17:57 2021 +0000

  bluetooth: eliminate the potential race condition when removing the HCI controller

  
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
WARNING: ODEBUG bug in bt_host_release 2 (4) 2021/05/14 07:50
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 WARNING: ODEBUG bug in bt_host_release -1 1 280d 280d 0/3 auto-obsoleted due to no activity on 2026/01/29 01:07
linux-4.19 WARNING: ODEBUG bug in bt_host_release -1 1 1993d 1993d 0/1 auto-closed as invalid on 2021/06/11 00:58
linux-6.6 WARNING: ODEBUG bug in bt_host_release -1 2 254d 257d 0/2 auto-obsoleted due to no activity on 2026/02/24 14:24
linux-4.14 WARNING: ODEBUG bug in bt_host_release -1 syz error 2 1610d 2166d 0/1 upstream: reported syz repro on 2020/08/22 10:22
▶ ▼ Fix bisection attempts (7)
Created Duration User Patch Repo Result
2021/05/14 01:56 4h35m bisect fix upstream OK (1) job log
2021/04/13 04:14 31m bisect fix upstream OK (0) job log log
2021/03/13 12:36 29m bisect fix upstream OK (0) job log log
2021/01/31 15:45 27m bisect fix upstream OK (0) job log log
2020/12/18 22:07 29m bisect fix upstream OK (0) job log log
2020/11/12 10:01 28m bisect fix upstream OK (0) job log log
2020/10/13 03:00 28m bisect fix upstream OK (0) job log log

Sample crash report:
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x80 arch/x86/include/asm/paravirt.h:770
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 debug_print_object lib/debugobjects.c:485 [inline]
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 __debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 debug_check_no_obj_freed+0x45c/0x640 lib/debugobjects.c:998
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 6865 Comm: syz-executor.2 Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1f0/0x31e lib/dump_stack.c:118
 panic+0x264/0x7a0 kernel/panic.c:231
 __warn+0x227/0x250 kernel/panic.c:600
 report_bug+0x1b1/0x2e0 lib/bug.c:198
 handle_bug+0x42/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:debug_print_object lib/debugobjects.c:485 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
RIP: 0010:debug_check_no_obj_freed+0x45c/0x640 lib/debugobjects.c:998
Code: 74 08 4c 89 f7 e8 e4 10 10 fe 4d 8b 06 48 c7 c7 63 99 15 89 48 c7 c6 86 72 13 89 48 89 da 89 e9 4d 89 f9 31 c0 e8 c4 dd a1 fd <0f> 0b 48 ba 00 00 00 00 00 fc ff df ff 05 1e 82 ea 05 48 8b 5c 24
RSP: 0018:ffffc9000555fbb0 EFLAGS: 00010046
RAX: 88c0ccdcaaf4e500 RBX: ffffffff8919a2ef RCX: ffff888091f56340
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff815e2109 R09: ffffed1015d241c3
R10: ffffed1015d241c3 R11: 0000000000000000 R12: ffff88809a0c3324
R13: ffffffff8b9dbcb0 R14: ffffffff89502bc0 R15: ffffffff814c7d60
 kfree+0xfc/0x220 mm/slab.c:3755
 bt_host_release+0x18/0x20 net/bluetooth/hci_sysfs.c:86
 device_release+0x70/0x1a0 drivers/base/core.c:1796
 kobject_cleanup lib/kobject.c:704 [inline]
 kobject_release lib/kobject.c:735 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1a0/0x2c0 lib/kobject.c:752
 vhci_release+0x7b/0xc0 drivers/bluetooth/hci_vhci.c:341
 __fput+0x34f/0x7b0 fs/file_table.c:281
 task_work_run+0x137/0x1c0 kernel/task_work.c:141
 exit_task_work include/linux/task_work.h:25 [inline]
 do_exit+0x5f3/0x1f20 kernel/exit.c:806
 do_group_exit+0x161/0x2d0 kernel/exit.c:903
 __do_sys_exit_group+0x13/0x20 kernel/exit.c:914
 __se_sys_exit_group+0x10/0x10 kernel/exit.c:912
 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:912
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45d4d9
Code: Bad RIP value.
RSP: 002b:00007ffc80a289c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045d4d9
RDX: 0000000000416d61 RSI: 00000000016a85f0 RDI: 0000000000000043
RBP: 00000000004c306d R08: 000000000000000b R09: 0000000000000000
R10: 0000000002b26940 R11: 0000000000000246 R12: 0000000000000007
R13: 00007ffc80a28b10 R14: 0000000000045d2a R15: 00007ffc80a28b20
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/22 12:03 upstream f873db9acd3c 6436ce4b .config console log report syz ci-upstream-kasan-gce-smack-root
2020/08/22 11:25 upstream f873db9acd3c 6436ce4b .config console log report syz ci-upstream-kasan-gce-selinux-root
2020/08/08 01:07 upstream d6efb3ac3e6c cb436c69 .config console log report syz ci-upstream-kasan-gce-smack-root
2020/08/02 20:44 upstream ac3a0c847296 63a73341 .config console log report syz ci-upstream-kasan-gce-smack-root
2021/02/06 23:05 upstream 1e0d27fce010 0655e081 .config console log report info ci-upstream-kasan-gce-root WARNING: ODEBUG bug in bt_host_release
2021/01/01 15:45 upstream f6e1ea196492 79264ae3 .config console log report info ci-upstream-kasan-gce-root
2020/08/13 05:00 net-next-old bfdd5aaa54b0 bc15f7db .config console log report ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.