bisecting fixing commit since 14b58326976de6ef3998eefec1dd7f8b38b97a75
building syzkaller on f721e4a097714a9054b9fe1aadf427afbbd2c157
testing commit 14b58326976de6ef3998eefec1dd7f8b38b97a75 with gcc (GCC) 8.1.0
kernel signature: 862ee9147b39402ae91e5b9769a48e7144d4eff15dfb40996d11137698b45b9c
run #0: crashed: KASAN: use-after-free Read in bt_accept_enqueue
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing current HEAD bae31eef2a167ef160ab2703b6a2f5bbecd98d92
testing commit bae31eef2a167ef160ab2703b6a2f5bbecd98d92 with gcc (GCC) 8.1.0
kernel signature: 2abc75f85f554dc381a7c299c0ebe32502811eb655f9dea704af8ada67aba8bd
run #0: crashed: BUG: corrupted list in bt_accept_unlink
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: OK
run #7: OK
run #8: OK
run #9: OK
revisions tested: 2, total time: 38m25.688542025s (build: 17m51.171670165s, test: 19m44.547457366s)
the crash still happens on HEAD
commit msg: Linux 4.14.200
crash: BUG: corrupted list in bt_accept_unlink
Bluetooth: Wrong link type (-22)
Bluetooth: Wrong link type (-22)
list_del corruption. next->prev should be ffff88808ede96d0, but was ffff88808f1e3790
Bluetooth: Wrong link type (-22)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:56!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7783 Comm: kworker/u5:1 Not tainted 4.14.200-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci2 hci_rx_work
task: ffff888091afc2c0 task.stack: ffff8880a5748000
RIP: 0010:__list_del_entry_valid.cold.1+0x37/0x58 lib/list_debug.c:54
RSP: 0018:ffff8880a574f750 EFLAGS: 00010282
RAX: 0000000000000054 RBX: ffff88808ede96d0 RCX: 0000000000000000
RDX: 0000000000000054 RSI: ffffffff86cbf660 RDI: ffffed1014ae9ee1
RBP: ffff8880a574f768 R08: ffff888091afcc08 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000000 R12: ffff88809b7e4e50
R13: ffff88808f1e3790 R14: ffff88808ebca080 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe182845e8 CR3: 0000000092bea000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:117 [inline]
 list_del_init include/linux/list.h:159 [inline]
 bt_accept_unlink+0x1f/0x1f0 net/bluetooth/af_bluetooth.c:187
 l2cap_sock_teardown_cb+0x169/0x3e0 net/bluetooth/l2cap_sock.c:1365
 l2cap_chan_del+0x9b/0x790 net/bluetooth/l2cap_core.c:599
 l2cap_disconnect_req net/bluetooth/l2cap_core.c:4353 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5432 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5798 [inline]
 l2cap_recv_frame+0x4403/0x9e40 net/bluetooth/l2cap_core.c:7022
 l2cap_recv_acldata+0x756/0x8a0 net/bluetooth/l2cap_core.c:7593
 hci_acldata_packet net/bluetooth/hci_core.c:4066 [inline]
 hci_rx_work+0x5d4/0x8d0 net/bluetooth/hci_core.c:4249
 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250
 kthread+0x338/0x400 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 e8 b4 48 42 fe 0f 0b 4c 89 ea 48 89 de 48 c7 c7 60 10 04 87 e8 a0 48 42 fe 0f 0b 48 89 de 48 c7 c7 80 11 04 87 e8 8f 48 42 fe <0f> 0b 48 89 de 48 c7 c7 20 11 04 87 e8 7e 48 42 fe 0f 0b 90 90 
RIP: __list_del_entry_valid.cold.1+0x37/0x58 lib/list_debug.c:54 RSP: ffff8880a574f750
---[ end trace d156f4e549086f48 ]---