bisecting fixing commit since 961f830af0658ef5ef8a7708786d634a6115f16b building syzkaller on 01975a06cb1a7b426ae17985374f2fff3ec38b62 testing commit 961f830af0658ef5ef8a7708786d634a6115f16b with gcc (GCC) 8.4.1 20210217 kernel signature: b6393bee219d7dd4ec84b7869b5af2e50ff9d2a641d9ef574b15c3bc2667e813 all runs: crashed: KASAN: use-after-free Read in hci_chan_del testing current HEAD fcfbdfe9626edd5bf00c732e093eed249ecdbfa1 testing commit fcfbdfe9626edd5bf00c732e093eed249ecdbfa1 with gcc (GCC) 8.4.1 20210217 kernel signature: 5d4fe07354e583f0865644c5ca2df8974637c54a60682fa0fe95c97bfcb18d2f run #0: crashed: WARNING: ODEBUG bug in netdev_freemem run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: crashed: BUG: sleeping function called from invalid context in lock_sock_nested run #8: OK run #9: crashed: BUG: sleeping function called from invalid context in lock_sock_nested reproducer seems to be flaky Reproducer flagged being flaky revisions tested: 2, total time: 32m9.754101482s (build: 18m32.985440151s, test: 13m5.566172964s) the crash still happens on HEAD commit msg: Linux 4.19.197 crash: BUG: sleeping function called from invalid context in lock_sock_nested BUG: sleeping function called from invalid context at net/core/sock.c:2863 in_atomic(): 1, irqs_disabled(): 0, pid: 29094, name: syz-executor.3 1 lock held by syz-executor.3/29094: #0: 00000000d88a308c (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756 Preemption disabled at: [] hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756 CPU: 1 PID: 29094 Comm: syz-executor.3 Not tainted 4.19.197-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 ___might_sleep.cold.15+0x1f1/0x265 kernel/sched/core.c:6192 __might_sleep+0x95/0x190 kernel/sched/core.c:6145 lock_sock_nested+0x24/0x100 net/core/sock.c:2863 lock_sock include/net/sock.h:1510 [inline] hci_sock_dev_event+0x39a/0x530 net/bluetooth/hci_sock.c:758 hci_unregister_dev+0x207/0x7a0 net/bluetooth/hci_core.c:3292 vhci_release+0x6b/0xe0 drivers/bluetooth/hci_vhci.c:354 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa6a/0x2d90 kernel/exit.c:870 do_group_exit+0xf8/0x2c0 kernel/exit.c:967 get_signal+0x30b/0x1970 kernel/signal.c:2589 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x417aec Code: Bad RIP value. RSP: 002b:00007ffeb4e674f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 00007ffeb4e67590 RCX: 0000000000417aec RDX: 0000000000000038 RSI: 0000000000558020 RDI: 00000000000000f9 RBP: 0000000000000003 R08: 0000000000000000 R09: 0079746972756365 R10: 00007ffeb4e66eb0 R11: 0000000000000246 R12: 00007ffeb4e675d0 R13: 000000000005f8a5 R14: 0000000000000000 R15: 0000000000000009 batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device veth1_macvtap left promiscuous mode device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode device hsr_slave_1 left promiscuous mode device hsr_slave_0 left promiscuous mode team0 (unregistering): Port device team_slave_1 removed team0 (unregistering): Port device team_slave_0 removed bond0 (unregistering): Releasing backup interface bond_slave_1 bond0 (unregistering): Releasing backup interface bond_slave_0 bond0 (unregistering): Released all slaves IPVS: ftp: loaded support on port[0] = 21 BUG: sleeping function called from invalid context at net/core/sock.c:2863 in_atomic(): 1, irqs_disabled(): 0, pid: 969, name: syz-executor418 1 lock held by syz-executor418/969: #0: 00000000d88a308c (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756 Preemption disabled at: [] hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756 CPU: 1 PID: 969 Comm: syz-executor418 Tainted: G W 4.19.197-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 ___might_sleep.cold.15+0x1f1/0x265 kernel/sched/core.c:6192 __might_sleep+0x95/0x190 kernel/sched/core.c:6145 lock_sock_nested+0x24/0x100 net/core/sock.c:2863 lock_sock include/net/sock.h:1510 [inline] hci_sock_dev_event+0x39a/0x530 net/bluetooth/hci_sock.c:758 hci_unregister_dev+0x207/0x7a0 net/bluetooth/hci_core.c:3292 vhci_release+0x6b/0xe0 drivers/bluetooth/hci_vhci.c:354 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa6a/0x2d90 kernel/exit.c:870 __do_sys_exit kernel/exit.c:936 [inline] __se_sys_exit kernel/exit.c:934 [inline] __x64_sys_exit+0x3d/0x50 kernel/exit.c:934 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x403a4e Code: Bad RIP value. RSP: 002b:00007fc78c56b340 EFLAGS: 00000246 ORIG_RAX: 000000000000003c RAX: ffffffffffffffda RBX: 00007fc78c56b700 RCX: 0000000000403a4e RD