WARNING: ODEBUG bug in bt_host_release

Status: fixed on 2022/09/20 07:46
Fix commit: e2cb6b891ad2 bluetooth: eliminate the potential race condition when removing the HCI controller
First crash: 913d, last: 660d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config

Fix bisection: fixed by (bisect log) :
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
Author: Lin Ma <>
Date: Mon Apr 12 11:17:57 2021 +0000

  bluetooth: eliminate the potential race condition when removing the HCI controller

similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 WARNING: ODEBUG bug in bt_host_release 1 721d 721d 0/1 auto-closed as invalid on 2021/06/11 00:58
linux-4.14 WARNING: ODEBUG bug in bt_host_release syz error 2 338d 894d 0/1 upstream: reported syz repro on 2020/08/22 10:22

Sample crash report:
------------[ cut here ]------------
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x80 arch/x86/include/asm/paravirt.h:770
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 debug_print_object lib/debugobjects.c:485 [inline]
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 __debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
WARNING: CPU: 1 PID: 6865 at lib/debugobjects.c:488 debug_check_no_obj_freed+0x45c/0x640 lib/debugobjects.c:998
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 6865 Comm: syz-executor.2 Not tainted 5.9.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1f0/0x31e lib/dump_stack.c:118
 panic+0x264/0x7a0 kernel/panic.c:231
 __warn+0x227/0x250 kernel/panic.c:600
 report_bug+0x1b1/0x2e0 lib/bug.c:198
 handle_bug+0x42/0x80 arch/x86/kernel/traps.c:234
 exc_invalid_op+0x16/0x40 arch/x86/kernel/traps.c:254
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:debug_print_object lib/debugobjects.c:485 [inline]
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:967 [inline]
RIP: 0010:debug_check_no_obj_freed+0x45c/0x640 lib/debugobjects.c:998
Code: 74 08 4c 89 f7 e8 e4 10 10 fe 4d 8b 06 48 c7 c7 63 99 15 89 48 c7 c6 86 72 13 89 48 89 da 89 e9 4d 89 f9 31 c0 e8 c4 dd a1 fd <0f> 0b 48 ba 00 00 00 00 00 fc ff df ff 05 1e 82 ea 05 48 8b 5c 24
RSP: 0018:ffffc9000555fbb0 EFLAGS: 00010046
RAX: 88c0ccdcaaf4e500 RBX: ffffffff8919a2ef RCX: ffff888091f56340
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff815e2109 R09: ffffed1015d241c3
R10: ffffed1015d241c3 R11: 0000000000000000 R12: ffff88809a0c3324
R13: ffffffff8b9dbcb0 R14: ffffffff89502bc0 R15: ffffffff814c7d60
 kfree+0xfc/0x220 mm/slab.c:3755
 bt_host_release+0x18/0x20 net/bluetooth/hci_sysfs.c:86
 device_release+0x70/0x1a0 drivers/base/core.c:1796
 kobject_cleanup lib/kobject.c:704 [inline]
 kobject_release lib/kobject.c:735 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1a0/0x2c0 lib/kobject.c:752
 vhci_release+0x7b/0xc0 drivers/bluetooth/hci_vhci.c:341
 __fput+0x34f/0x7b0 fs/file_table.c:281
 task_work_run+0x137/0x1c0 kernel/task_work.c:141
 exit_task_work include/linux/task_work.h:25 [inline]
 do_exit+0x5f3/0x1f20 kernel/exit.c:806
 do_group_exit+0x161/0x2d0 kernel/exit.c:903
 __do_sys_exit_group+0x13/0x20 kernel/exit.c:914
 __se_sys_exit_group+0x10/0x10 kernel/exit.c:912
 __x64_sys_exit_group+0x37/0x40 kernel/exit.c:912
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
RIP: 0033:0x45d4d9
Code: Bad RIP value.
RSP: 002b:00007ffc80a289c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045d4d9
RDX: 0000000000416d61 RSI: 00000000016a85f0 RDI: 0000000000000043
RBP: 00000000004c306d R08: 000000000000000b R09: 0000000000000000
R10: 0000000002b26940 R11: 0000000000000246 R12: 0000000000000007
R13: 00007ffc80a28b10 R14: 0000000000045d2a R15: 00007ffc80a28b20
Kernel Offset: disabled
Rebooting in 86400 seconds..

Crashes (7):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-kasan-gce-smack-root 2020/08/22 12:03 upstream f873db9acd3c 6436ce4b .config console log report syz
ci-upstream-kasan-gce-selinux-root 2020/08/22 11:25 upstream f873db9acd3c 6436ce4b .config console log report syz
ci-upstream-kasan-gce-smack-root 2020/08/08 01:07 upstream d6efb3ac3e6c cb436c69 .config console log report syz
ci-upstream-kasan-gce-smack-root 2020/08/02 20:44 upstream ac3a0c847296 63a73341 .config console log report syz
ci-upstream-kasan-gce-root 2021/02/06 23:05 upstream 1e0d27fce010 0655e081 .config console log report info WARNING: ODEBUG bug in bt_host_release
ci-upstream-kasan-gce-root 2021/01/01 15:45 upstream f6e1ea196492 79264ae3 .config console log report info
ci-upstream-net-kasan-gce 2020/08/13 05:00 net-next bfdd5aaa54b0 bc15f7db .config console log report
* Struck through repros no longer work on HEAD.