bisecting fixing commit since 961f830af0658ef5ef8a7708786d634a6115f16b
building syzkaller on 01975a06cb1a7b426ae17985374f2fff3ec38b62
testing commit 961f830af0658ef5ef8a7708786d634a6115f16b with gcc (GCC) 8.4.1 20210217
kernel signature: 07cffb24ba2452abd8ed23fe78063eec3a8c3615e2496aa67ae0705c8078b3b9
all runs: crashed: KASAN: use-after-free Read in hci_chan_del
testing current HEAD 9a2dc0e6c531d595bcdf2c66d0be131679bd02df
testing commit 9a2dc0e6c531d595bcdf2c66d0be131679bd02df with gcc (GCC) 8.4.1 20210217
kernel signature: 82e99cd7ed7e59b59105df217d033fae311da047148c9ff27b1aa3e278026c98
run #0: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #1: OK
run #2: OK
run #3: OK
run #4: OK
run #5: OK
run #6: crashed: BUG: sleeping function called from invalid context in lock_sock_nested
run #7: OK
run #8: OK
run #9: OK
reproducer seems to be flaky
Reproducer flagged being flaky
revisions tested: 2, total time: 30m35.881800968s (build: 17m43.873708347s, test: 12m19.885350153s)
the crash still happens on HEAD
commit msg: Linux 4.19.194
crash: BUG: sleeping function called from invalid context in lock_sock_nested
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
BUG: sleeping function called from invalid context at net/core/sock.c:2863
in_atomic(): 1, irqs_disabled(): 0, pid: 4768, name: syz-executor981
1 lock held by syz-executor981/4768:
 #0: 0000000051aee2ff (hci_sk_list.lock){++++}, at: hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756
Preemption disabled at:
[<ffffffff8614fe05>] hci_sock_dev_event+0x335/0x530 net/bluetooth/hci_sock.c:756
CPU: 0 PID: 4768 Comm: syz-executor981 Not tainted 4.19.194-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x17c/0x226 lib/dump_stack.c:118
 ___might_sleep.cold.15+0x1f1/0x265 kernel/sched/core.c:6192
 __might_sleep+0x95/0x190 kernel/sched/core.c:6145
 lock_sock_nested+0x24/0x100 net/core/sock.c:2863
 lock_sock include/net/sock.h:1510 [inline]
 hci_sock_dev_event+0x39a/0x530 net/bluetooth/hci_sock.c:758
 hci_unregister_dev+0x207/0x7a0 net/bluetooth/hci_core.c:3292
 vhci_release+0x6b/0xe0 drivers/bluetooth/hci_vhci.c:354
 __fput+0x249/0x7f0 fs/file_table.c:278
 ____fput+0x9/0x10 fs/file_table.c:309
 task_work_run+0x108/0x180 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xa6a/0x2d90 kernel/exit.c:870
 do_group_exit+0xf8/0x2c0 kernel/exit.c:967
 __do_sys_exit_group kernel/exit.c:978 [inline]
 __se_sys_exit_group kernel/exit.c:976 [inline]
 __x64_sys_exit_group+0x39/0x40 kernel/exit.c:976
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x444489
Code: Bad RIP value.
RSP: 002b:00007fffb4c20948 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00000000004cb390 RCX: 0000000000444489
RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001
RBP: 0000000000000001 R08: ffffffffffffffb8 R09: 000300ff004c5fe0
R10: 0000000000000000 R11: 0000000000