bisecting fixing commit since f6d5cb9e2c06f7d583dd9f4f7cca21d13d78c32a
building syzkaller on 816e0689d7d9d8321f8bf360740f0e516aee15ca
testing commit f6d5cb9e2c06f7d583dd9f4f7cca21d13d78c32a with gcc (GCC) 8.1.0
kernel signature: e89e89360a770ea4e844c3ebfd6d678286e117246541fc89d7d78f4c6f6d2f4c
all runs: crashed: general protection fault in hci_phy_link_complete_evt
testing current HEAD ad326970d25cc85128cd22d62398751ad072efff
testing commit ad326970d25cc85128cd22d62398751ad072efff with gcc (GCC) 8.1.0
kernel signature: 8fcdc0c0eea13662cfd895ee9d6f0545901b95a6dee5908c5dd55a56b5ca93fc
all runs: crashed: general protection fault in hci_phy_link_complete_evt
revisions tested: 2, total time: 24m7.182766768s (build: 17m48.016154193s, test: 5m48.331800955s)
the crash still happens on HEAD
commit msg: Linux 4.19.152
crash: general protection fault in hci_phy_link_complete_evt
batman_adv: batadv0: Interface activated: batadv_slave_1
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 6653 Comm: kworker/u5:5 Not tainted 4.19.152-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x260/0x650 net/bluetooth/hci_event.c:4681
Code: c1 ea 03 80 3c 02 00 0f 85 7c 03 00 00 4c 8b a3 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5f 03 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880964efa58 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888095cccd40 RCX: 1ffff110167c75a7
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
kasan: CONFIG_KASAN_INLINE enabled
RBP: ffff8880964efa98 R08: 0000000000000000 R09: ffffed10174c473a
R10: ffffed10174c473a R11: ffff8880ba6239d3 R12: 0000000000000000
R13: ffff88809174950b R14: ffff8880b4555080 R15: 00000000000000c9
FS:  0000000000000000(0000) GS:ffff8880ba600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc6d592ff8 CR3: 00000000a2ff1000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hci_event_packet+0x2b8e/0x7215 net/bluetooth/hci_event.c:5911
kasan: GPF could be caused by NULL-ptr deref or user memory access
 hci_rx_work+0x31b/0x8e0 net/bluetooth/hci_core.c:4359
 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2155
 worker_thread+0x85/0xb60 kernel/workqueue.c:2298
 kthread+0x347/0x410 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
general protection fault: 0000 [#2] PREEMPT SMP KASAN
---[ end trace ec743e6017423019 ]---
CPU: 1 PID: 6664 Comm: kworker/u5:7 Tainted: G      D           4.19.152-syzkaller #0
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x260/0x650 net/bluetooth/hci_event.c:4681
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci4 hci_rx_work
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x260/0x650 net/bluetooth/hci_event.c:4681
Code: c1 ea 03 80 3c 02 00 0f 85 7c 03 00 00 4c 8b a3 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5f 03 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RSP: 0018:ffff8880972afa58 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: ffff888090164700 RCX: ffffffff8624e7b4
RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010
RBP: ffff8880972afa98 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffff8880a2d7384b R14: ffff88809a571300 R15: 00000000000000c9
FS:  0000000000000000(0000) GS:ffff8880ba700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559f84c5ddc8 CR3: 00000000a2c82000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 hci_event_packet+0x2b8e/0x7215 net/bluetooth/hci_event.c:5911
 hci_rx_work+0x31b/0x8e0 net/bluetooth/hci_core.c:4359
 process_one_work+0x7b9/0x15a0 kernel/workqueue.c:2155
 worker_thread+0x85/0xb60 kernel/workqueue.c:2298
 kthread+0x347/0x410 kernel/kthread.c:259
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
Modules linked in:
---[ end trace ec743e601742301a ]---
Code: c1 ea 03 80 3c 02 00 0f 85 7c 03 00 00 4c 8b a3 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5f 03 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RIP: 0010:hci_phy_link_complete_evt.isra.126+0x260/0x650 net/bluetooth/hci_event.c:4681
RSP: 0018:ffff8880964efa58 EFLAGS: 00010202
Code: c1 ea 03 80 3c 02 00 0f 85 7c 03 00 00 4c 8b a3 28 08 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 10 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 5f 03 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b
RAX: dffffc0000000000 RBX: ffff888095cccd40 RCX: 1ffff110167c75a7
RSP: 0018:ffff8880964efa58 EFLAGS: 00010202
RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000010
RBP: ffff8880964efa98 R08: 0000000000000000 R09: ffffed10174c473a
R10: ffffed10174c473a R11: ffff8880ba6239d3 R12: 0000000000000000
R13: ffff88809174950b R14: ffff8880b4555080 R15: 00000000000000c9
FS:  0000000000000000(0000) GS:ffff8880ba600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f820000 CR3: 00000000abdca000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400