bisecting fixing commit since ac3a0c8472969a03c0496ae774b3a29eb26c8d5a building syzkaller on 80a0690249dc4dbbbed95ba197192b99c73694c5 testing commit ac3a0c8472969a03c0496ae774b3a29eb26c8d5a with gcc (GCC) 8.4.1 20210217 kernel signature: 46836ff7d61c89a8407d96bef4554c2d7c33135dbcdfcda1a66241ef6659288b run #0: crashed: KASAN: use-after-free Read in skb_dequeue run #1: crashed: WARNING: locking bug in hci_dev_reset run #2: crashed: WARNING: locking bug in hci_dev_reset run #3: crashed: WARNING: locking bug in hci_dev_reset run #4: crashed: WARNING: locking bug in hci_dev_reset run #5: crashed: general protection fault in __queue_work run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK reproducer seems to be flaky testing current HEAD 832ce924b1a14e139e184a6da9f5a69a5e47b256 testing commit 832ce924b1a14e139e184a6da9f5a69a5e47b256 with gcc (GCC) 10.2.1 20210217 kernel signature: d19633d278e6f2a4db73500f8648d50d6aac0662fd813043bbd7b318ef90dc1b run #0: crashed: WARNING: locking bug in hci_dev_reset run #1: crashed: WARNING: locking bug in hci_dev_reset run #2: crashed: WARNING: locking bug in hci_dev_reset run #3: crashed: WARNING: locking bug in hci_dev_reset run #4: crashed: WARNING: locking bug in hci_dev_reset run #5: crashed: WARNING: locking bug in hci_dev_reset run #6: OK run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: crashed: WARNING: locking bug in hci_dev_reset run #16: OK run #17: OK run #18: OK run #19: OK Reproducer flagged being flaky revisions tested: 2, total time: 31m38.40945696s (build: 12m48.306650599s, test: 18m3.656261835s) the crash still happens on HEAD commit msg: chelsio/chtls: unlock on error in chtls_pt_recvmsg() crash: WARNING: locking bug in hci_dev_reset ------------[ cut here ]------------ DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 0 PID: 20426 at kernel/locking/lockdep.c:203 hlock_class kernel/locking/lockdep.c:203 [inline] WARNING: CPU: 0 PID: 20426 at kernel/locking/lockdep.c:203 hlock_class kernel/locking/lockdep.c:192 [inline] WARNING: CPU: 0 PID: 20426 at kernel/locking/lockdep.c:203 check_wait_context kernel/locking/lockdep.c:4575 [inline] WARNING: CPU: 0 PID: 20426 at kernel/locking/lockdep.c:203 __lock_acquire+0x1598/0x5050 kernel/locking/lockdep.c:4852 Modules linked in: CPU: 0 PID: 20426 Comm: syz-executor.4 Not tainted 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:hlock_class kernel/locking/lockdep.c:203 [inline] RIP: 0010:hlock_class kernel/locking/lockdep.c:192 [inline] RIP: 0010:check_wait_context kernel/locking/lockdep.c:4575 [inline] RIP: 0010:__lock_acquire+0x1598/0x5050 kernel/locking/lockdep.c:4852 Code: 08 84 d2 0f 85 83 36 00 00 8b 15 7b ac f0 08 85 d2 0f 85 0b fb ff ff 48 c7 c6 40 48 cb 87 48 c7 c7 60 42 cb 87 e8 c3 2c fd 05 <0f> 0b e9 f1 fa ff ff c7 44 24 50 fe ff ff ff 41 bf 01 00 00 00 c7 RSP: 0018:ffffc9000192f860 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff88812e5d8d84 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000004 RDI: fffff52000325efe RBP: ffff88812e5d8400 R08: 0000000000000001 R09: ffff8881f642095b R10: ffffed103ec8412b R11: fffffffffffc7480 R12: 0000000000000000 R13: ffff88812e5d8dc8 R14: 0000000000000857 R15: 0000000000000000 FS: 00007fcc0463e700(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000530198 CR3: 0000000101e81002 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire kernel/locking/lockdep.c:5512 [inline] lock_acquire+0x212/0x850 kernel/locking/lockdep.c:5477 flush_workqueue+0xed/0x1250 kernel/workqueue.c:2786 drain_workqueue+0x112/0x300 kernel/workqueue.c:2951 hci_dev_do_reset net/bluetooth/hci_core.c:1884 [inline] hci_dev_reset+0x1d3/0x3e0 net/bluetooth/hci_core.c:1927 hci_sock_ioctl+0x3d0/0x630 net/bluetooth/hci_sock.c:1035 sock_do_ioctl+0xc6/0x210 net/socket.c:1039 sock_ioctl+0x3bf/0x570 net/socket.c:1179 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:1069 [inline] __se_sys_ioctl fs/ioctl.c:1055 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:1055 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x464769 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcc0463e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000055c0e0 RCX: 0000000000464769 RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000006 RBP: 00000000004ae608 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055c0e0 R13: 00007fffdebb19ff R14: 00007fcc0463e300 R15: 0000000000022000 irq event stamp: 45 hardirqs last enabled at (45): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (45): [] _raw_spin_unlock_irqrestore+0x40/0x90 kernel/locking/spinlock.c:191 hardirqs last disabled at (44): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (44): [] _raw_spin_lock_irqsave+0xa9/0xd0 kernel/locking/spinlock.c:159 softirqs last enabled at (38): [] hci_sock_ioctl+0x10c/0x630 net/bluetooth/hci_sock.c:1010 softirqs last disabled at (36): [] spin_lock_bh include/linux/spinlock.h:359 [inline] softirqs last disabled at (36): [] release_sock+0x16/0x170 net/core/sock.c:3072 ---[ end trace 0b26658e60ea11ed ]--- general protection fault, probably for non-canonical address 0xdffffc0000000017: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf] CPU: 0 PID: 20426 Comm: syz-executor.4 Tainted: G W 5.12.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:check_wait_context kernel/locking/lockdep.c:4575 [inline] RIP: 0010:__lock_acquire+0x40d/0x5050 kernel/locking/lockdep.c:4852 Code: 0c 00 00 4f 8d 34 76 49 c1 e6 06 49 81 c6 c0 4f ff 8b 49 8d be b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 5f 10 00 00 48 b8 00 00 00 00 00 fc RSP: 0018:ffffc9000192f860 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: ffff88812e5d8d84 RCX: 0000000000000000 RDX: 0000000000000017 RSI: 0000000000000004 RDI: 00000000000000b8 RBP: ffff88812e5d8400 R08: 0000000000000001 R09: ffff8881f642095b R10: ffffed103ec8412b R11: fffffffffffc7480 R12: 0000000000000000 R13: ffff88812e5d8dc8 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fcc0463e700(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000530198 CR3: 0000000101e81002 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire kernel/locking/lockdep.c:5512 [inline] lock_acquire+0x212/0x850 kernel/locking/lockdep.c:5477 flush_workqueue+0xed/0x1250 kernel/workqueue.c:2786 drain_workqueue+0x112/0x300 kernel/workqueue.c:2951 hci_dev_do_reset net/bluetooth/hci_core.c:1884 [inline] hci_dev_reset+0x1d3/0x3e0 net/bluetooth/hci_core.c:1927 hci_sock_ioctl+0x3d0/0x630 net/bluetooth/hci_sock.c:1035 sock_do_ioctl+0xc6/0x210 net/socket.c:1039 sock_ioctl+0x3bf/0x570 net/socket.c:1179 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:1069 [inline] __se_sys_ioctl fs/ioctl.c:1055 [inline] __x64_sys_ioctl+0x11f/0x190 fs/ioctl.c:1055 do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x464769 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcc0463e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000055c0e0 RCX: 0000000000464769 RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000006 RBP: 00000000004ae608 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055c0e0 R13: 00007fffdebb19ff R14: 00007fcc0463e300 R15: 0000000000022000 Modules linked in: ---[ end trace 0b26658e60ea11ee ]--- RIP: 0010:check_wait_context kernel/locking/lockdep.c:4575 [inline] RIP: 0010:__lock_acquire+0x40d/0x5050 kernel/locking/lockdep.c:4852 Code: 0c 00 00 4f 8d 34 76 49 c1 e6 06 49 81 c6 c0 4f ff 8b 49 8d be b8 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 5f 10 00 00 48 b8 00 00 00 00 00 fc RSP: 0018:ffffc9000192f860 EFLAGS: 00010006 RAX: dffffc0000000000 RBX: ffff88812e5d8d84 RCX: 0000000000000000 RDX: 0000000000000017 RSI: 0000000000000004 RDI: 00000000000000b8 RBP: ffff88812e5d8400 R08: 0000000000000001 R09: ffff8881f642095b R10: ffffed103ec8412b R11: fffffffffffc7480 R12: 0000000000000000 R13: ffff88812e5d8dc8 R14: 0000000000000000 R15: 0000000000000000 FS: 00007fcc0463e700(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000530198 CR3: 0000000101e81002 CR4: 00000000001706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400