bisecting fixing commit since 31acccdc877486a649a86d37725a15175fcd5ed6
building syzkaller on 4a7fa9b416fd0a961793328a785666d6d2c5976d
testing commit 31acccdc877486a649a86d37725a15175fcd5ed6 with gcc (GCC) 8.1.0
kernel signature: df9e3ed192a15457bc0878b8af69b29ee75192d948e0d5210c82d61815a24cf7
all runs: crashed: general protection fault in hci_phy_link_complete_evt
testing current HEAD 13d2ce42de8cb98ff952f8de6307f896203854c2
testing commit 13d2ce42de8cb98ff952f8de6307f896203854c2 with gcc (GCC) 8.1.0
kernel signature: 8c6d0b763640f9db56ba6cf6266a07dbfbd75de138722dce4a7d439287b35a88
run #0: crashed: general protection fault in hci_phy_link_complete_evt
run #1: crashed: general protection fault in hci_phy_link_complete_evt
run #2: crashed: general protection fault in hci_phy_link_complete_evt
run #3: crashed: general protection fault in hci_phy_link_complete_evt
run #4: crashed: general protection fault in hci_phy_link_complete_evt
run #5: crashed: general protection fault in hci_phy_link_complete_evt
run #6: crashed: general protection fault in hci_phy_link_complete_evt
run #7: crashed: general protection fault in hci_phy_link_complete_evt
run #8: crashed: general protection fault in hci_phy_link_complete_evt
run #9: boot failed: can't ssh into the instance
revisions tested: 2, total time: 31m31.2003044s (build: 17m55.100823264s, test: 12m59.951707095s)
the crash still happens on HEAD
commit msg: Linux 4.19.163
crash: general protection fault in hci_phy_link_complete_evt
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
kasan: CONFIG_KASAN_INLINE enabled
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
CPU: 1 PID: 7855 Comm: kworker/u5:7 Not tainted 4.19.163-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x2f5/0x7f0 net/bluetooth/hci_event.c:4681
Code: c1 ea 03 80 3c 02 00 0f 85 63 04 00 00 49 8b 9c 24 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffff8881d3cb7a50 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1103b5a552f
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: ffff8881d3cb7a90 R08: 0000000000000000 R09: ffffed103eca4552
R10: ffffed103eca4552 R11: ffff8881f6522a93 R12: ffff8881dab64400
R13: ffff8881f46c130b R14: ffff8881dce52400 R15: 00000000000000c9
FS:  0000000000000000(0000) GS:ffff8881f6500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001590004 CR3: 000000000986d006 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hci_event_packet+0x2a25/0x683a net/bluetooth/hci_event.c:5911
 hci_rx_work+0x33e/0xa60 net/bluetooth/hci_core.c:4359
 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2155
 worker_thread+0x85/0xb60 kernel/workqueue.c:2298
 kthread+0x347/0x410 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace f13fcd4aacc4315a ]---
batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x2f5/0x7f0 net/bluetooth/hci_event.c:4681
batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0
Code: c1 ea 03 80 3c 02 00 0f 85 63 04 00 00 49 8b 9c 24 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 75 04 00 00 48 b8 00 00 00 00 00 fc ff df 48 8b
RSP: 0018:ffff8881d3cb7a50 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff1103b5a552f
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: ffff8881d3cb7a90 R08: 0000000000000000 R09: ffffed103eca4552
R10: ffffed103eca4552 R11: ffff8881f6522a93 R12: ffff8881dab64400
R13: ffff8881f46c130b R14: ffff8881dce52400 R15: 00000000000000c9
FS:  0000000000000000(0000) GS:ffff8881f6500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001590004 CR3: 000000000986d006 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400