syzbot


BUG: corrupted list in hci_register_dev

Status: auto-obsoleted due to no activity on 2023/02/13 02:38
Subsystems: kernel
[Documentation on labels]
Reported-by: syzbot+e32111a3390bdf27b0c9@syzkaller.appspotmail.com
First crash: 594d, last: 546d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] BUG: corrupted list in hci_register_dev 0 (1) 2022/09/05 09:20
Similar bugs (1)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in hci_register_dev kernel C unreliable done 4 212d 219d 25/26 fixed on 2023/12/21 03:45

Sample crash report:
list_add corruption. prev->next should be next (ffff888145f20188), but was ffff88807c3000c8. (prev=ffff88807cf2d8c8).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:30!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 18538 Comm: kworker/1:19 Not tainted 6.0.0-rc3-next-20220829-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Workqueue: events vhci_open_timeout
RIP: 0010:__list_add_valid.cold+0x56/0x58 lib/list_debug.c:30
Code: 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 00 31 49 8a e8 76 d5 f0 ff 0f 0b 48 89 f1 48 c7 c7 80 30 49 8a 4c 89 e6 e8 62 d5 f0 ff <0f> 0b 4c 89 e1 48 89 ee 48 c7 c7 e0 32 49 8a e8 4e d5 f0 ff 0f 0b
RSP: 0018:ffffc90005ed7af0 EFLAGS: 00010282
RAX: 0000000000000075 RBX: ffff88806558fcc0 RCX: 0000000000000000
RDX: ffff88807e7a8000 RSI: ffffffff816204f8 RDI: fffff52000bdaf50
RBP: ffff88806558fcc8 R08: 0000000000000075 R09: 0000000000000000
R10: 0000000000000001 R11: 6464615f7473696c R12: ffff888145f20188
R13: ffff88807cf2d8c8 R14: ffff888145f20190 R15: ffff888145f20188
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcdeb19cd0 CR3: 000000000bc8e000 CR4: 00000000003526e0
Call Trace:
 <TASK>
 __list_add include/linux/list.h:69 [inline]
 list_add_tail include/linux/list.h:102 [inline]
 add_tail lib/klist.c:104 [inline]
 klist_add_tail+0x158/0x2a0 lib/klist.c:137
 device_add+0xda7/0x1e90 drivers/base/core.c:3534
 hci_register_dev+0x2f6/0xbb0 net/bluetooth/hci_core.c:2593
 __vhci_create_device+0x393/0x7d0 drivers/bluetooth/hci_vhci.c:336
 vhci_create_device drivers/bluetooth/hci_vhci.c:374 [inline]
 vhci_open_timeout+0x38/0x50 drivers/bluetooth/hci_vhci.c:531
 process_one_work+0x991/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e4/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid.cold+0x56/0x58 lib/list_debug.c:30
Code: 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 00 31 49 8a e8 76 d5 f0 ff 0f 0b 48 89 f1 48 c7 c7 80 30 49 8a 4c 89 e6 e8 62 d5 f0 ff <0f> 0b 4c 89 e1 48 89 ee 48 c7 c7 e0 32 49 8a e8 4e d5 f0 ff 0f 0b
RSP: 0018:ffffc90005ed7af0 EFLAGS: 00010282
RAX: 0000000000000075 RBX: ffff88806558fcc0 RCX: 0000000000000000
RDX: ffff88807e7a8000 RSI: ffffffff816204f8 RDI: fffff52000bdaf50
RBP: ffff88806558fcc8 R08: 0000000000000075 R09: 0000000000000000
R10: 0000000000000001 R11: 6464615f7473696c R12: ffff888145f20188
R13: ffff88807cf2d8c8 R14: ffff888145f20190 R15: ffff888145f20188
FS:  0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcdeb19cd0 CR3: 000000000bc8e000 CR4: 00000000003526e0

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/08/29 10:31 linux-next b27a3ca08ba7 07177916 .config console log report info ci-upstream-linux-next-kasan-gce-root BUG: corrupted list in hci_register_dev
2022/10/16 02:37 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci bbed346d5a96 67cb024c .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: corrupted list in hci_register_dev
2022/09/23 02:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 16c9f284e746 0042f2b4 .config console log report info [disk image] [vmlinux] ci-upstream-gce-arm64 BUG: corrupted list in hci_register_dev
* Struck through repros no longer work on HEAD.