bisecting fixing commit since f8788d86ab28f61f7b46eb6be375f8a726783636
building syzkaller on 59b57593586656c1d5be820aeed0e751087e6ac6
testing commit f8788d86ab28f61f7b46eb6be375f8a726783636 with gcc (GCC) 8.1.0
kernel signature: ff9e869e49908fb05d1f22d86ad70b618ae6e0b3964c276a6f6d147252b1a3fc
run #0: crashed: WARNING: refcount bug in l2cap_chan_put
run #1: crashed: KASAN: use-after-free Read in l2cap_chan_close
run #2: crashed: WARNING: refcount bug in l2cap_chan_put
run #3: crashed: WARNING: refcount bug in l2cap_chan_put
run #4: crashed: KASAN: use-after-free Read in l2cap_chan_close
run #5: crashed: WARNING: refcount bug in l2cap_chan_put
run #6: crashed: KASAN: use-after-free Read in l2cap_chan_close
run #7: crashed: KASAN: use-after-free Read in l2cap_chan_close
run #8: crashed: WARNING: refcount bug in l2cap_chan_put
run #9: OK
testing current HEAD 04300d66f0a06d572d9f2ad6768c38cabde22179
testing commit 04300d66f0a06d572d9f2ad6768c38cabde22179 with gcc (GCC) 8.1.0
kernel signature: 2f613c0d94980e3e9ff2cb97e00f9b4d13d84b833785c53c6099261ab5f41009
run #0: crashed: WARNING: refcount bug in l2cap_chan_put
run #1: crashed: WARNING: refcount bug in l2cap_chan_put
run #2: crashed: WARNING: refcount bug in l2cap_chan_put
run #3: crashed: BUG: unable to handle kernel NULL pointer dereference in l2cap_chan_close
run #4: crashed: WARNING: refcount bug in l2cap_chan_put
run #5: crashed: WARNING: refcount bug in l2cap_chan_put
run #6: crashed: WARNING: refcount bug in l2cap_chan_put
run #7: crashed: WARNING: refcount bug in l2cap_chan_put
run #8: crashed: WARNING: refcount bug in l2cap_chan_put
run #9: boot failed: can't ssh into the instance
revisions tested: 2, total time: 33m21.711461666s (build: 11m0.759073421s, test: 21m23.275783714s)
the crash still happens on HEAD
commit msg: Merge tag 'riscv-for-linus-5.8-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux into master
crash: WARNING: refcount bug in l2cap_chan_put
neighbour: ndisc_cache: neighbor table overflow!
neighbour: ndisc_cache: neighbor table overflow!
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 23 at lib/refcount.c:28 refcount_warn_saturate+0xe2/0xf0 lib/refcount.c:28
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 23 Comm: kworker/1:1 Not tainted 5.8.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events do_enable_set
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0xb9/0xf1 lib/dump_stack.c:118
 panic+0x115/0x2fa kernel/panic.c:231
 __warn.cold.13+0x20/0x28 kernel/panic.c:600
 report_bug+0xc5/0x100 lib/bug.c:198
 handle_bug+0x39/0xa0 arch/x86/kernel/traps.c:235
 exc_invalid_op+0x18/0x70 arch/x86/kernel/traps.c:255
 asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:540
RIP: 0010:refcount_warn_saturate+0xe2/0xf0 lib/refcount.c:28
Code: 48 c7 c7 60 4f f0 83 c6 05 39 ea 8c 02 01 e8 cd 65 4d ff 0f 0b 5d c3 48 c7 c7 08 4f f0 83 c6 05 24 ea 8c 02 01 e8 b6 65 4d ff <0f> 0b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 8b 07 3d 00 00 00 c0 74
RSP: 0018:ffffc90000d2fdc0 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff88810cfe1000 RCX: 0000000000000001
RDX: 0000000080000001 RSI: ffffffff8400d631 RDI: 00000000ffffffff
RBP: ffffc90000d2fdc0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c12d3c0
R13: ffff88810bf14b80 R14: ffff88810bf14b80 R15: ffff88810bf14b88
 refcount_sub_and_test include/linux/refcount.h:274 [inline]
 refcount_dec_and_test include/linux/refcount.h:294 [inline]
 kref_put include/linux/kref.h:64 [inline]
 l2cap_chan_put+0x90/0xa0 net/bluetooth/l2cap_core.c:502
 do_enable_set+0x1dc/0x350 net/bluetooth/6lowpan.c:1083
 process_one_work+0x260/0x5e0 kernel/workqueue.c:2269
 worker_thread+0x3e/0x390 kernel/workqueue.c:2415
 kthread+0x160/0x180 kernel/kthread.c:291
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Kernel Offset: disabled
Rebooting in 86400 seconds..