bisecting fixing commit since d2b6f8a179194de0ffc4886ffc2c4358d86047b8
building syzkaller on 77e2b66864e69c17416614228723a1ebd3581ddc
testing commit d2b6f8a179194de0ffc4886ffc2c4358d86047b8 with gcc (GCC) 10.2.1 20210217
kernel signature: 3c04afd770a2f1f821894d330f2526e57d5fac52539e0a87b640264acd6602bf
all runs: crashed: BUG: corrupted list in kobject_add_internal
testing current HEAD 368094df48e680fa51cedb68537408cfa64b788e
testing commit 368094df48e680fa51cedb68537408cfa64b788e with gcc (GCC) 10.2.1 20210217
kernel signature: 3a201c3c05a412a387402d14bbc4c94c3831c29943a3146b27f1b6282c6f81f6
all runs: crashed: BUG: corrupted list in kobject_add_internal
revisions tested: 2, total time: 22m4.442176312s (build: 14m27.141851064s, test: 7m6.716097522s)
the crash still happens on HEAD
commit msg: Merge tag 'for-linus-5.13b-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
crash: BUG: corrupted list in kobject_add_internal
list_add double add: new=ffff88801f856420, prev=ffff88801f856420, next=ffff8881401cf000.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:29!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8842 Comm: kworker/u5:8 Not tainted 5.13.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci5 hci_rx_work
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 0d e8 66 fb 4c 89 e1 48 c7 c7 e0 88 fe 88 e8 45 da f2 ff 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 20 8a fe 88 e8 2e da f2 ff <0f> 0b 48 89 f1 48 c7 c7 a0 89 fe 88 4c 89 e6 e8 1a da f2 ff 0f 0b
RSP: 0018:ffffc900019877f0 EFLAGS: 00010286
RAX: 0000000000000058 RBX: ffff88801ee89298 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff88fe87e0 RDI: fffff52000330ef1
RBP: ffff88801f856420 R08: 0000000000000058 R09: ffff8880b9e2fec7
R10: ffffed10173c5fd8 R11: 000000000000009c R12: ffff8881401cf000
R13: ffff8881401cf000 R14: ffff88801f856420 R15: ffff88801f856418
FS:  0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000056c000 CR3: 000000000a68e000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_add include/linux/list.h:67 [inline]
 list_add_tail include/linux/list.h:100 [inline]
 kobj_kset_join lib/kobject.c:196 [inline]
 kobject_add_internal+0x15f/0x930 lib/kobject.c:246
 kobject_add_varg lib/kobject.c:390 [inline]
 kobject_add+0x120/0x190 lib/kobject.c:442
 device_add+0x2d8/0x1d60 drivers/base/core.c:3257
 hci_conn_add_sysfs+0x88/0x150 net/bluetooth/hci_sysfs.c:53
 hci_sync_conn_complete_evt.isra.0+0x496/0x720 net/bluetooth/hci_event.c:4381
 hci_event_packet+0xcb4/0x6e20 net/bluetooth/hci_event.c:6269
 hci_rx_work+0x3be/0xb60 net/bluetooth/hci_core.c:5098
 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2276
 worker_thread+0x598/0xf80 kernel/workqueue.c:2422
 kthread+0x36f/0x450 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
Modules linked in:
---[ end trace a2edc8e46abb6e0b ]---
RIP: 0010:__list_add_valid.cold+0x26/0x3c lib/list_debug.c:29
Code: 0d e8 66 fb 4c 89 e1 48 c7 c7 e0 88 fe 88 e8 45 da f2 ff 0f 0b 48 89 f2 4c 89 e1 48 89 ee 48 c7 c7 20 8a fe 88 e8 2e da f2 ff <0f> 0b 48 89 f1 48 c7 c7 a0 89 fe 88 4c 89 e6 e8 1a da f2 ff 0f 0b
RSP: 0018:ffffc900019877f0 EFLAGS: 00010286
RAX: 0000000000000058 RBX: ffff88801ee89298 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff88fe87e0 RDI: fffff52000330ef1
RBP: ffff88801f856420 R08: 0000000000000058 R09: ffff8880b9e2fec7
R10: ffffed10173c5fd8 R11: 000000000000009c R12: ffff8881401cf000
R13: ffff8881401cf000 R14: ffff88801f856420 R15: ffff88801f856418
FS:  0000000000000000(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000056c000 CR3: 000000000a68e000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400