bisecting fixing commit since 8f4dd16603ce834d1c5c4da67803ea82dd282511 building syzkaller on 8a1f1f07b4d5c51a99e439c5b13b0cd8bb742856 testing commit 8f4dd16603ce834d1c5c4da67803ea82dd282511 compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: a325f610590fb93bad0b9acf997ea7dddced7e7522ad7f12da5308d98131b08a all runs: crashed: WARNING: ODEBUG bug in cancel_delayed_work testing current HEAD 72a8e05d4f66b5af7854df4490e3135168694b6b testing commit 72a8e05d4f66b5af7854df4490e3135168694b6b compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2 kernel signature: e198ca2cf62dfe35579f453c5935e81f8308b629f6e210abc0b3d68a1022a579 all runs: crashed: WARNING: ODEBUG bug in cancel_delayed_work revisions tested: 2, total time: 19m38.07097776s (build: 12m28.953824544s, test: 6m29.980932668s) the crash still happens on HEAD commit msg: Merge tag 'ovl-fixes-5.19-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs crash: WARNING: ODEBUG bug in cancel_delayed_work ------------[ cut here ]------------ ODEBUG: assert_init not available (active state 0) object type: timer_list hint: 0x0 WARNING: CPU: 1 PID: 4092 at lib/debugobjects.c:502 debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Modules linked in: CPU: 1 PID: 4092 Comm: syz-executor.0 Not tainted 5.19.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:502 Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 60 87 64 89 4c 89 ee 48 c7 c7 40 7b 64 89 e8 54 dc b5 04 <0f> 0b 83 05 85 32 42 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 RSP: 0018:ffffc90002cef938 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: fffff5200059df19 RBP: 0000000000000001 R08: 0000000000000001 R09: ffff8880b9f2792b R10: ffffed10173e4f25 R11: 0000000000000001 R12: ffffffff890e0c60 R13: ffffffff896481c0 R14: ffffffff815ffea0 R15: 1ffff9200059df32 FS: 0000555556409400(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200000c0 CR3: 000000001f88e000 CR4: 0000000000350ee0 Call Trace: debug_object_assert_init lib/debugobjects.c:892 [inline] debug_object_assert_init+0x1f4/0x2e0 lib/debugobjects.c:863 debug_timer_assert_init kernel/time/timer.c:792 [inline] debug_assert_init kernel/time/timer.c:837 [inline] del_timer+0x65/0xf0 kernel/time/timer.c:1257 try_to_grab_pending+0x41/0x80 kernel/workqueue.c:1275 __cancel_work kernel/workqueue.c:3250 [inline] cancel_delayed_work+0x6d/0x270 kernel/workqueue.c:3279 l2cap_clear_timer include/net/bluetooth/l2cap.h:883 [inline] l2cap_chan_del+0x43b/0x8e0 net/bluetooth/l2cap_core.c:665 l2cap_chan_close+0x180/0x990 net/bluetooth/l2cap_core.c:825 l2cap_sock_shutdown+0x307/0xdb0 net/bluetooth/l2cap_sock.c:1377 l2cap_sock_release+0x5d/0x1e0 net/bluetooth/l2cap_sock.c:1420 __sock_release+0xbb/0x270 net/socket.c:650 sock_close+0xf/0x20 net/socket.c:1365 __fput+0x1f5/0x8c0 fs/file_table.c:317 task_work_run+0xc0/0x160 kernel/task_work.c:177 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:169 [inline] exit_to_user_mode_prepare+0x23c/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc4e003bd2b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffcbcaf43a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007fc4e003bd2b RDX: ffffffffffffffb8 RSI: 0000000000000001 RDI: 0000000000000004 RBP: 00007fc4e019d960 R08: 0000000000000000 R09: 00007fc4e01a03e0 R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000e29b R13: 00007ffcbcaf44a0 R14: 00007ffcbcaf44c0 R15: 0000000000000032