bisecting cause commit starting from e49d033bddf5b565044e2abe4241353959bc9120
building syzkaller on 6a81331a1d4c744da9204d02ec88d558f7eea9c9
testing commit e49d033bddf5b565044e2abe4241353959bc9120 with gcc (GCC) 10.2.1 20210217
kernel signature: 13c46ff51ffa06c1de2f86a4412f4f54b56543c39766c98164c7825a1d343458
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.11
testing commit f40ddce88593482919761f74910f42f4b84c004b with gcc (GCC) 10.2.1 20210217
kernel signature: 44f58b074a2b4030a1bedf2f1cdddcbbe15c92ffea3b784ca4f9f31b88987f51
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.10
testing commit 2c85ebc57b3e1817b6ce1a6b703928e113a90442 with gcc (GCC) 10.2.1 20210217
kernel signature: 4742733baa9bf82e241d783d026dc2511126290e27e7df12714b205c43255576
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.9
testing commit bbf5c979011a099af5dc76498918ed7df445635b with gcc (GCC) 10.2.1 20210217
kernel signature: c5db40808f8354789d304b4248372764a0a9e3bd6067aa6a6a0663ace87ac3ea
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.8
testing commit bcf876870b95592b52519ed4aafcf9d95999bc9c with gcc (GCC) 8.4.1 20210217
kernel signature: 5d5db905a29e886d4efedddc7c045cb6d7fa040cd3d9de48e0aa78c1d3357e75
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.7
testing commit 3d77e6a8804abcc0504c904bd6e5cdf3a5cf8162 with gcc (GCC) 8.4.1 20210217
kernel signature: 694927f270c924473baa1645cf3e46211382cdeb91db268c2363cc6797b41fe8
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: KASAN: use-after-free Read in hci_conn_add_sysfs
run #3: crashed: BUG: corrupted list in kobject_add_internal
run #4: crashed: BUG: corrupted list in kobject_add_internal
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: BUG: corrupted list in kobject_add_internal
run #8: crashed: BUG: corrupted list in kobject_add_internal
run #9: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.6
testing commit 7111951b8d4973bda27ff663f2cf18b663d15b48 with gcc (GCC) 8.4.1 20210217
kernel signature: 465f1dc5ded474a9ba5e43cca9cc1f09bb05d55f63916e1ebe569728cad5a636
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: BUG: corrupted list in kobject_add_internal
run #3: crashed: BUG: corrupted list in kobject_add_internal
run #4: crashed: BUG: corrupted list in kobject_add_internal
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: KASAN: use-after-free Read in hci_conn_add_sysfs
run #8: crashed: BUG: corrupted list in kobject_add_internal
run #9: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.5
testing commit d5226fa6dbae0569ee43ecfc08bdcd6770fc4755 with gcc (GCC) 8.4.1 20210217
kernel signature: f1d2a0134f8956f9ec716cd240a833897b5a62b5431e35e60d334d883749072c
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: BUG: corrupted list in kobject_add_internal
run #3: crashed: KASAN: use-after-free Read in hci_conn_add_sysfs
run #4: crashed: BUG: corrupted list in kobject_add_internal
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: BUG: corrupted list in kobject_add_internal
run #8: crashed: BUG: corrupted list in kobject_add_internal
run #9: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.4
testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.4.1 20210217
kernel signature: 3f14fbf3ee94b7ec709f4176de692fad28379a6cfdd4afa08aa82c70055fb1ab
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.3
testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.4.1 20210217
kernel signature: 457310f91ce51f11704650ffedc537752ec21d945a9ab917b17d3db488e81e9f
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.4.1 20210217
kernel signature: d72b319b5c0a1755226290b310bc5da8fa78ef184a54efbf54bf35811920753a
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: BUG: corrupted list in kobject_add_internal
run #3: crashed: KASAN: use-after-free Read in hci_conn_add_sysfs
run #4: crashed: BUG: corrupted list in kobject_add_internal
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: BUG: corrupted list in kobject_add_internal
run #8: crashed: KASAN: use-after-free Read in hci_conn_add_sysfs
run #9: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.4.1 20210217
kernel signature: e18d60d4abca9aa170fd650ee96b5d20dd778a0c0c8601a1bf629f9523bff87b
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v5.0
testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.4.1 20210217
kernel signature: f4ab1fd68d4038dbaccea33c38e3381f646886b0064dd3932478472b03b29136
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: BUG: corrupted list in kobject_add_internal
run #3: crashed: BUG: corrupted list in kobject_add_internal
run #4: crashed: BUG: corrupted list in corrupted
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: BUG: corrupted list in kobject_add_internal
run #8: crashed: BUG: corrupted list in kobject_add_internal
run #9: crashed: BUG: corrupted list in kobject_add_internal
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.4.1 20210217
kernel signature: b4d6935a3db61697ee87f06f6db629c2c1e9ff78fa2d7886d0f5b510ad3c790b
run #0: crashed: BUG: corrupted list in kobject_add_internal
run #1: crashed: BUG: corrupted list in kobject_add_internal
run #2: crashed: BUG: corrupted list in kobject_add_internal
run #3: crashed: BUG: corrupted list in kobject_add_internal
run #4: crashed: BUG: corrupted list in kobject_add_internal
run #5: crashed: BUG: corrupted list in kobject_add_internal
run #6: crashed: BUG: corrupted list in kobject_add_internal
run #7: crashed: BUG: corrupted list in kobject_add_internal
run #8: crashed: BUG: corrupted list in kobject_add_internal
run #9: crashed: BUG: corrupted list in corrupted
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.4.1 20210217
kernel signature: 19d342d55c13cc5a3bd7b5f7083e89a73d5dbcc2b7ce2f8c39a7bfdcc0974e00
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v4.18
testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.4.1 20210217
kernel signature: 74de57b84c0fba71dc2ae4e3ed1509ed4d5d4ccfd6bb0b97db98b9e3e6d0bd16
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing release v4.17
testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.4.1 20210217
failed to run ["make" "-j" "64" "ARCH=x86_64" "CC=/syzkaller/shared/bisect_bin/gcc-8.1.0/bin/gcc" "bzImage"]: exit status 2
testing release v4.16
testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.4.1 20210217
orc_dump.c:106:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:111:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
elf.c:135:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:140:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.15
testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.4.1 20210217
orc_dump.c:106:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:111:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
elf.c:135:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:140:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:36:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.14
testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.4.1 20210217
orc_dump.c:105:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
orc_dump.c:110:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:139:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:36:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.13
testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.4.1 20210217
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:144:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:149:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.12
testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.4.1 20210217
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
elf.c:141:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:146:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
testing release v4.11
testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.5.0
elf.c:141:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:146:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.10
testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.9
testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:35:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.8
testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:129:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:134:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.7
testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
elf.c:122:2: error: 'elf_getshnum' is deprecated [-Werror=deprecated-declarations]
elf.c:127:2: error: 'elf_getshstrndx' is deprecated [-Werror=deprecated-declarations]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
testing release v4.6
testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0
tools/include/linux/log2.h:19:1: error: ignoring attribute 'noreturn' because it conflicts with attribute 'const' [-Werror=attributes]
pager.c:33:12: error: passing argument 2 to 'restrict'-qualified parameter aliases with argument 4 [-Werror=restrict]
revisions tested: 16, total time: 2h44m16.936263681s (build: 1h49m17.323654426s, test: 48m35.051610219s)
the crash already happened on the oldest tested release
commit msg: Linux 4.18
crash: BUG: corrupted list in kobject_add_internal
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
list_add double add: new=ffff8800acfe83d8, prev=ffff8800acfe83d8, next=ffff8800b5b0c900.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 1759 Comm: kworker/u5:0 Not tainted 4.18.0-syzkaller #0
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci5 hci_rx_work
RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29
Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 41 72 4e fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 40 46 ee 87 e8 d5 d7 0c fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 
RSP: 0018:ffff8800b26577f8 EFLAGS: 00010282
RAX: 0000000000000058 RBX: ffff8800b5b0c900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87ee4400 RDI: ffffffff8b1e4d20
RBP: ffff8800b2657810 R08: ffffed00174e4db9 R09: ffffed00174e4db8
R10: ffffed00174e4db8 R11: ffff8800ba726dc7 R12: ffff8800acfe83d8
R13: ffff8800acfe83e8 R14: ffff8800b5b0c900 R15: ffff8800acfe83d0
FS:  0000000000000000(0000) GS:ffff8800ba700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000568020 CR3: 00000000b3aca000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_add include/linux/list.h:60 [inline]
 list_add_tail include/linux/list.h:93 [inline]
 kobj_kset_join lib/kobject.c:169 [inline]
 kobject_add_internal+0x165/0x8d0 lib/kobject.c:219
 kobject_add_varg lib/kobject.c:363 [inline]
 kobject_add+0x10f/0x170 lib/kobject.c:407
 device_add+0x33e/0x1530 drivers/base/core.c:1827
 hci_conn_add_sysfs+0x8e/0x160 net/bluetooth/hci_sysfs.c:53
 hci_sync_conn_complete_evt.isra.100+0x8a8/0xaa0 net/bluetooth/hci_event.c:3772
 hci_event_packet+0x3780/0x7576 net/bluetooth/hci_event.c:5371
 hci_rx_work+0x368/0xa40 net/bluetooth/hci_core.c:4258
 process_one_work+0x7b9/0x1580 kernel/workqueue.c:2153
 worker_thread+0x85/0xb60 kernel/workqueue.c:2296
 kthread+0x316/0x3d0 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:412
Modules linked in:
---[ end trace 3a1a331dc5714e49 ]---
RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29
Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 41 72 4e fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 40 46 ee 87 e8 d5 d7 0c fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 
RSP: 0018:ffff8800b26577f8 EFLAGS: 00010282
RAX: 0000000000000058 RBX: ffff8800b5b0c900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff87ee4400 RDI: ffffffff8b1e4d20
RBP: ffff8800b2657810 R08: ffffed00174e4db9 R09: ffffed00174e4db8
R10: ffffed00174e4db8 R11: ffff8800ba726dc7 R12: ffff8800acfe83d8
R13: ffff8800acfe83e8 R14: ffff8800b5b0c900 R15: ffff8800acfe83d0
FS:  0000000000000000(0000) GS:ffff8800ba700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000568020 CR3: 00000000b3aca000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400