bisecting cause commit starting from 5a30a78924ecd97b0335d2e1d3e01a5023c1a3d8 building syzkaller on 196277c4035b5442b7a259953677543566c9b9a9 testing commit 5a30a78924ecd97b0335d2e1d3e01a5023c1a3d8 with gcc (GCC) 8.1.0 kernel signature: 63598da1f765e8723d7451a6c8087a3b9dd39dd5e46370ab600fb5114272c980 run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobject_add_internal run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobject_add_internal run #5: crashed: BUG: corrupted list in kobject_add_internal run #6: crashed: BUG: corrupted list in kobject_add_internal run #7: crashed: BUG: corrupted list in kobject_add_internal run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: BUG: corrupted list in kobj_kset_leave testing release v5.7 testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.1.0 kernel signature: 49b8e059f691d6aaa25681028443b094a12600397f9d9865fa84033cd374e1ef run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobject_add_internal run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobject_add_internal run #5: crashed: BUG: corrupted list in kobject_add_internal run #6: crashed: BUG: corrupted list in kobject_add_internal run #7: crashed: BUG: corrupted list in kobject_add_internal run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: BUG: corrupted list in kobject_add_internal testing release v5.6 testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.1.0 kernel signature: 80af0c83666b2787cbcc66268666480fd378d9e470ca343bbb1dd65413ff88a5 all runs: OK # git bisect start 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 7111951b8d4973bda27ff663f2cf18b663d15b48 Bisecting: 7542 revisions left to test after this (roughly 13 steps) [50a5de895dbe5df947b3a695777db5b2c313e065] Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma testing commit 50a5de895dbe5df947b3a695777db5b2c313e065 with gcc (GCC) 8.1.0 kernel signature: 28d67828f3468b4b0510912863a3c6c5cc96ed78b19e76b4984aa6b4f7f1776d run #0: crashed: BUG: corrupted list in kobj_kset_leave run #1: crashed: KASAN: use-after-free Read in klist_dec_and_del run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobject_add_internal run #5: crashed: BUG: corrupted list in kobject_add_internal run #6: crashed: BUG: corrupted list in kobject_add_internal run #7: crashed: BUG: corrupted list in kobject_add_internal run #8: crashed: BUG: corrupted list in kobject_add_internal run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad 50a5de895dbe5df947b3a695777db5b2c313e065 Bisecting: 4204 revisions left to test after this (roughly 12 steps) [56a451b780676bc1cdac011735fe2869fa2e9abf] Merge tag 'ntb-5.7' of git://github.com/jonmason/ntb testing commit 56a451b780676bc1cdac011735fe2869fa2e9abf with gcc (GCC) 8.1.0 kernel signature: 56b142d0f680a9c16e273370e72f99934f503e6f38f107b2053fcb069a6a527f all runs: OK # git bisect good 56a451b780676bc1cdac011735fe2869fa2e9abf Bisecting: 2102 revisions left to test after this (roughly 11 steps) [6c5bc8fe4e1915da8296a665bd742dbe34de02f0] ethtool: add EEE_NTF notification testing commit 6c5bc8fe4e1915da8296a665bd742dbe34de02f0 with gcc (GCC) 8.1.0 kernel signature: 86254e3211ba7e9fe94b1db63b8b34c3c72c93def67d5c2b5dde839bcc751981 run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobject_add_internal run #2: crashed: BUG: corrupted list in kobj_kset_leave run #3: crashed: KASAN: use-after-free Read in klist_dec_and_del run #4: crashed: BUG: corrupted list in kobj_kset_leave run #5: crashed: BUG: corrupted list in kobj_kset_leave run #6: crashed: KASAN: use-after-free Read in klist_dec_and_del run #7: crashed: BUG: corrupted list in kobj_kset_leave run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad 6c5bc8fe4e1915da8296a665bd742dbe34de02f0 Bisecting: 1050 revisions left to test after this (roughly 10 steps) [1fcbebf115d9ce077c2ba5ecfb521cc1eedcb467] ionic: drop ethtool driver version testing commit 1fcbebf115d9ce077c2ba5ecfb521cc1eedcb467 with gcc (GCC) 8.1.0 kernel signature: fb14e00440644035e25e38f43a413a1d14ba9f5807cd181882ff54e60a7d2bbf all runs: OK # git bisect good 1fcbebf115d9ce077c2ba5ecfb521cc1eedcb467 Bisecting: 550 revisions left to test after this (roughly 9 steps) [ab9d1e172f0588d563080517d99570ba0be1efc3] Merge branch 'veth-xdp-stats' testing commit ab9d1e172f0588d563080517d99570ba0be1efc3 with gcc (GCC) 8.1.0 kernel signature: 46b26e995e7d615b1aeb659dc7f93a811806ca30aea24a99f585b35148391613 all runs: OK # git bisect good ab9d1e172f0588d563080517d99570ba0be1efc3 Bisecting: 252 revisions left to test after this (roughly 8 steps) [5ef8c665416b9815113042e0edebe8ff66a45e2e] Merge tag 'wireless-drivers-next-2020-03-24' of git://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next testing commit 5ef8c665416b9815113042e0edebe8ff66a45e2e with gcc (GCC) 8.1.0 kernel signature: 4a54de2de65fed42ecd9b76e671fb5b495da3957bb35ee88171a0204a5a3f866 run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobject_add_internal run #2: crashed: BUG: corrupted list in kobj_kset_leave run #3: crashed: BUG: corrupted list in kobj_kset_leave run #4: crashed: BUG: corrupted list in kobj_kset_leave run #5: crashed: BUG: corrupted list in kobject_add_internal run #6: crashed: BUG: corrupted list in kobj_kset_leave run #7: crashed: BUG: corrupted list in kobj_kset_leave run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: KASAN: use-after-free Read in klist_dec_and_del # git bisect bad 5ef8c665416b9815113042e0edebe8ff66a45e2e Bisecting: 147 revisions left to test after this (roughly 7 steps) [adbea1a5f5d9ec5a34ceada6c08b9a8bef65be2b] Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/next-queue testing commit adbea1a5f5d9ec5a34ceada6c08b9a8bef65be2b with gcc (GCC) 8.1.0 kernel signature: 1915711ef7e8246337f09f42c1a4fa01f0f900475b08641d797f943db327e06b run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobj_kset_leave run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobject_add_internal run #5: crashed: BUG: corrupted list in kobj_kset_leave run #6: crashed: BUG: corrupted list in kobject_add_internal run #7: crashed: BUG: corrupted list in kobj_kset_leave run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad adbea1a5f5d9ec5a34ceada6c08b9a8bef65be2b Bisecting: 80 revisions left to test after this (roughly 6 steps) [ffe10e679cec9a99f19049459cb27c2fbb1e913a] net: dsa: sja1105: Add support for the SGMII port testing commit ffe10e679cec9a99f19049459cb27c2fbb1e913a with gcc (GCC) 8.1.0 kernel signature: f5807933d9f9cb4020c5306dd52cd84c6f79478e7b48fb7cc11fd30729ad737a run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobj_kset_leave run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobj_kset_leave run #5: crashed: KASAN: use-after-free Read in klist_dec_and_del run #6: crashed: BUG: corrupted list in kobject_add_internal run #7: crashed: BUG: corrupted list in kobj_kset_leave run #8: crashed: KASAN: use-after-free Read in klist_dec_and_del run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad ffe10e679cec9a99f19049459cb27c2fbb1e913a Bisecting: 34 revisions left to test after this (roughly 5 steps) [107db7ec783820411801c469ed08f8f68b369e08] docs: networking: convert 6lowpan.txt to ReST testing commit 107db7ec783820411801c469ed08f8f68b369e08 with gcc (GCC) 8.1.0 kernel signature: 3583ab53aaff77f26efcec910184f69abe806cc5eed2d7a9dc3d261f331aa34f all runs: OK # git bisect good 107db7ec783820411801c469ed08f8f68b369e08 Bisecting: 17 revisions left to test after this (roughly 4 steps) [bb0084ec893ebed123911e50c93f3b8ae8470531] Bluetooth: hci_h5: Switch from BT_ERR to bt_dev_err where possible testing commit bb0084ec893ebed123911e50c93f3b8ae8470531 with gcc (GCC) 8.1.0 kernel signature: 6f8940d7a3372852a763e16a01f400325a98de325a3410cb42bb46cd4fc887bc all runs: OK # git bisect good bb0084ec893ebed123911e50c93f3b8ae8470531 Bisecting: 8 revisions left to test after this (roughly 3 steps) [b354e6c10eaf97a1f5aff4839795bd32ad32f0f9] Bluetooth: L2CAP: Fix a condition in l2cap_sock_recvmsg() testing commit b354e6c10eaf97a1f5aff4839795bd32ad32f0f9 with gcc (GCC) 8.1.0 kernel signature: 74746b3cbcd8f9be5e4e917f38f6733d7d779ad4a2b7891bf1891459333fcadf run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: KASAN: use-after-free Read in klist_dec_and_del run #2: crashed: BUG: corrupted list in kobject_add_internal run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobject_add_internal run #5: crashed: BUG: corrupted list in kobj_kset_leave run #6: crashed: KASAN: use-after-free Read in klist_dec_and_del run #7: crashed: BUG: corrupted list in kobject_add_internal run #8: crashed: BUG: corrupted list in kobj_kset_leave run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad b354e6c10eaf97a1f5aff4839795bd32ad32f0f9 Bisecting: 4 revisions left to test after this (roughly 2 steps) [4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc] Bluetooth: Handle BR/EDR devices during suspend testing commit 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc with gcc (GCC) 8.1.0 kernel signature: ad97f3092bc1727780e96783d839376fd1e3434ab69b34ff689127de01ea34ab run #0: crashed: BUG: corrupted list in kobject_add_internal run #1: crashed: BUG: corrupted list in kobject_add_internal run #2: crashed: BUG: corrupted list in kobj_kset_leave run #3: crashed: BUG: corrupted list in kobject_add_internal run #4: crashed: BUG: corrupted list in kobj_kset_leave run #5: crashed: BUG: corrupted list in kobject_add_internal run #6: crashed: BUG: corrupted list in kobj_kset_leave run #7: crashed: KASAN: use-after-free Read in klist_dec_and_del run #8: crashed: KASAN: use-after-free Read in klist_dec_and_del run #9: crashed: BUG: corrupted list in kobject_add_internal # git bisect bad 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc Bisecting: 1 revision left to test after this (roughly 1 step) [72da7b2ccabd5fd93d6b8d0093936e980602652b] Bluetooth: mgmt: add mgmt_cmd_status in add_advertising testing commit 72da7b2ccabd5fd93d6b8d0093936e980602652b with gcc (GCC) 8.1.0 kernel signature: 424b7690633df27d0390a74c2e580f1aaab648d29cf0244cd3e0c7df254d0cae all runs: OK # git bisect good 72da7b2ccabd5fd93d6b8d0093936e980602652b Bisecting: 0 revisions left to test after this (roughly 0 steps) [9952d90ea2885d7cbf80cd233f694f09a9c0eaec] Bluetooth: Handle PM_SUSPEND_PREPARE and PM_POST_SUSPEND testing commit 9952d90ea2885d7cbf80cd233f694f09a9c0eaec with gcc (GCC) 8.1.0 kernel signature: 9779bc8e27607fc9298691cb29612251f330e59cd5f2e1bd5dc4f1fa113b605a all runs: OK # git bisect good 9952d90ea2885d7cbf80cd233f694f09a9c0eaec 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc is the first bad commit commit 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc Author: Abhishek Pandit-Subedi Date: Wed Mar 11 08:54:01 2020 -0700 Bluetooth: Handle BR/EDR devices during suspend To handle BR/EDR devices, we first disable page scan and disconnect all connected devices. Once that is complete, we add event filters (for devices that can wake the system) and re-enable page scan. Signed-off-by: Abhishek Pandit-Subedi Signed-off-by: Marcel Holtmann include/net/bluetooth/hci.h | 17 ++++--- include/net/bluetooth/hci_core.h | 10 +++- net/bluetooth/hci_core.c | 22 ++++++-- net/bluetooth/hci_event.c | 24 +++++++++ net/bluetooth/hci_request.c | 106 +++++++++++++++++++++++++++++++++++++++ 5 files changed, 169 insertions(+), 10 deletions(-) culprit signature: ad97f3092bc1727780e96783d839376fd1e3434ab69b34ff689127de01ea34ab parent signature: 9779bc8e27607fc9298691cb29612251f330e59cd5f2e1bd5dc4f1fa113b605a revisions tested: 17, total time: 3h55m49.727377833s (build: 1h52m59.811772453s, test: 2h0m36.305141637s) first bad commit: 4f40afc6c76451daff7d0dcfc8a3d113ccf65bfc Bluetooth: Handle BR/EDR devices during suspend recipients (to): ["abhishekpandit@chromium.org" "davem@davemloft.net" "johan.hedberg@gmail.com" "kuba@kernel.org" "linux-bluetooth@vger.kernel.org" "marcel@holtmann.org" "marcel@holtmann.org" "netdev@vger.kernel.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: BUG: corrupted list in kobject_add_internal debugfs: Directory '200' with parent 'hci3' already present! list_add double add: new=ffff8880a351a3c8, prev=ffff8880a351a3c8, next=ffff8880a9a88500. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8635 Comm: kworker/u5:7 Not tainted 5.5.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci3 hci_rx_work RIP: 0010:__list_add_valid+0xa3/0xb0 lib/list_debug.c:29 Code: 24 eb ab 48 89 f7 48 89 34 24 e8 68 25 58 fe 48 8b 34 24 eb bd 48 89 f2 48 89 d9 48 89 ee 48 c7 c7 20 6a ad 87 e8 f1 dc 10 fe <0f> 0b 90 66 2e 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc900017b7668 EFLAGS: 00010286 RAX: 0000000000000058 RBX: ffff8880a9a88500 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8b61f460 RBP: ffff8880a351a3c8 R08: ffffed1015d06629 R09: ffffed1015d06629 R10: ffffed1015d06628 R11: ffff8880ae833147 R12: ffff8880939c1160 R13: ffff8880a9a88500 R14: ffff8880a351a3c0 R15: ffff8880a351a3c8 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000480 CR3: 00000000a4bde000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] kobj_kset_join lib/kobject.c:196 [inline] kobject_add_internal+0x15f/0x820 lib/kobject.c:246 kobject_add_varg lib/kobject.c:390 [inline] kobject_add+0x10f/0x170 lib/kobject.c:442 device_add+0x304/0x1900 drivers/base/core.c:2412 hci_conn_add_sysfs+0x7f/0xc0 net/bluetooth/hci_sysfs.c:53 hci_conn_complete_evt net/bluetooth/hci_event.c:2558 [inline] hci_event_packet+0x527/0x999f net/bluetooth/hci_event.c:5968 hci_rx_work+0x1a2/0x910 net/bluetooth/hci_core.c:4685 process_one_work+0x8d1/0x15b0 kernel/workqueue.c:2264 worker_thread+0x82/0xb50 kernel/workqueue.c:2410 kthread+0x31d/0x3e0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Modules linked in: ---[ end trace aa3b2c12c1538d4f ]--- RIP: 0010:__list_add_valid+0xa3/0xb0 lib/list_debug.c:29 Code: 24 eb ab 48 89 f7 48 89 34 24 e8 68 25 58 fe 48 8b 34 24 eb bd 48 89 f2 48 89 d9 48 89 ee 48 c7 c7 20 6a ad 87 e8 f1 dc 10 fe <0f> 0b 90 66 2e 0f 1f 84 00 00 00 00 00 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc900017b7668 EFLAGS: 00010286 RAX: 0000000000000058 RBX: ffff8880a9a88500 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8b61f460 RBP: ffff8880a351a3c8 R08: ffffed1015d06629 R09: ffffed1015d06629 R10: ffffed1015d06628 R11: ffff8880ae833147 R12: ffff8880939c1160 R13: ffff8880a9a88500 R14: ffff8880a351a3c0 R15: ffff8880a351a3c8 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000480 CR3: 00000000a4bde000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400