bisecting fixing commit since 6ca2f514c57864e3085a65c5e9d2adca4144bc4c building syzkaller on 6972b10616d785401dea17cec890cca8916424a7 testing commit 6ca2f514c57864e3085a65c5e9d2adca4144bc4c compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 68a28d33b32db025380636943e9b28b12fbedfc3b6fbccf98775f951f89a6cdd all runs: crashed: KASAN: use-after-free Read in klist_dec_and_del testing current HEAD c2276d585654e8d573366c29c565043ec36adf63 testing commit c2276d585654e8d573366c29c565043ec36adf63 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 855a7d47ec639449f5de812b45411ce6505109d13cb71df70164507df1b883b0 run #0: crashed: general protection fault in klist_next run #1: crashed: general protection fault in klist_next run #2: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor348627943" "root@10.128.1.74:./syz-executor348627943"] Warning: Permanently added '10.128.1.74' (ECDSA) to the list of known hosts. run #3: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor614396442" "root@10.128.1.80:./syz-executor614396442"] run #4: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor548051036" "root@10.128.1.89:./syz-executor548051036"] Warning: Permanently added '10.128.1.89' (ECDSA) to the list of known hosts. run #5: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor740399627" "root@10.128.1.122:./syz-executor740399627"] run #6: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor902220270" "root@10.128.0.195:./syz-executor902220270"] run #7: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor132662096" "root@10.128.0.32:./syz-executor132662096"] run #8: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor775192687" "root@10.128.15.204:./syz-executor775192687"] run #9: basic kernel testing failed: failed to copy test binary to VM: timedout ["scp" "-P" "22" "-F" "/dev/null" "-o" "UserKnownHostsFile=/dev/null" "-o" "BatchMode=yes" "-o" "IdentitiesOnly=yes" "-o" "StrictHostKeyChecking=no" "-o" "ConnectTimeout=10" "/tmp/syz-executor186430210" "root@10.128.15.199:./syz-executor186430210"] Warning: Permanently added '10.128.15.199' (ECDSA) to the list of known hosts. revisions tested: 2, total time: 35m11.944316107s (build: 21m28.056119321s, test: 13m16.66417296s) the crash still happens on HEAD commit msg: Linux 4.19.208 crash: general protection fault in klist_next ---[ end trace 28b680099fc1dd67 ]--- kasan: CONFIG_KASAN_INLINE enabled RIP: 0010:klist_next+0x48/0x450 lib/klist.c:378 kasan: GPF could be caused by NULL-ptr deref or user memory access Code: 48 89 fb 48 83 ec 18 80 3c 02 00 0f 85 e1 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b4 02 00 00 4c 8d 6b 08 4d 8b 7c 24 50 48 b8 00 general protection fault: 0000 [#3] PREEMPT SMP KASAN RSP: 0000:ffff888098b3f6c0 EFLAGS: 00010206 CPU: 1 PID: 8483 Comm: syz-executor.1 Tainted: G D 4.19.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:klist_next+0x48/0x450 lib/klist.c:378 Code: 48 89 fb 48 83 ec 18 80 3c 02 00 0f 85 e1 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b4 02 00 00 4c 8d 6b 08 4d 8b 7c 24 50 48 b8 00 RSP: 0018:ffff8880aa48f6b0 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8880aa48f730 RCX: ffffffff813d2053 RDX: 000000000000000a RSI: ffff8880aa48f730 RDI: 0000000000000050 RBP: ffff8880aa48f6f0 R08: ffffed101363988d R09: ffffed101363988c R10: ffffed101363988c R11: ffff88809b1cc463 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff86d984f0 R15: dffffc0000000000 FS: 0000000002f74400(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe153cb8b7 CR3: 000000009c183000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: next_device drivers/base/core.c:2398 [inline] device_find_child+0xb1/0x170 drivers/base/core.c:2541 hci_conn_del_sysfs+0xaa/0x150 net/bluetooth/hci_sysfs.c:71 hci_conn_cleanup+0x1ff/0x4e0 net/bluetooth/hci_conn.c:128 hci_conn_del+0x22c/0x6b0 net/bluetooth/hci_conn.c:611 hci_conn_hash_flush+0x171/0x230 net/bluetooth/hci_conn.c:1513 hci_dev_do_close+0x5dc/0xf10 net/bluetooth/hci_core.c:1687 hci_unregister_dev+0x12f/0x400 net/bluetooth/hci_core.c:3288 vhci_release+0x6b/0xe0 drivers/bluetooth/hci_vhci.c:354 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa6a/0x2d90 kernel/exit.c:870 do_group_exit+0xf8/0x2c0 kernel/exit.c:967 get_signal+0x30b/0x1970 kernel/signal.c:2589 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4192cf Code: Bad RIP value. RSP: 002b:00007fff474790b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: 000000000000000c RBX: 000000000000174b RCX: 00000000004192cf RDX: 000000000000000c RSI: 00007fff474791b0 RDI: 00000000000000f8 RBP: 00007fff4747914c R08: 0000000000000000 R09: 00000066eb211bf2 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032 R13: 000000000006170a R14: 0000000000000002 R15: 00007fff474791b0 Modules linked in: kasan: CONFIG_KASAN_INLINE enabled RAX: dffffc0000000000 RBX: ffff888098b3f740 RCX: ffffffff813d2053 ---[ end trace 28b680099fc1dd68 ]--- RBP: ffff888098b3f700 R08: ffffed1014333cbd R09: ffffed1014333cbc RIP: 0010:klist_next+0x48/0x450 lib/klist.c:378 R10: ffffed1014333cbc R11: ffff8880a199e5e3 R12: 0000000000000000 Code: 48 89 fb 48 83 ec 18 80 3c 02 00 0f 85 e1 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b4 02 00 00 4c 8d 6b 08 4d 8b 7c 24 50 48 b8 00 RDX: 000000000000000a RSI: ffff888098b3f740 RDI: 0000000000000050 RSP: 0000:ffff888098b3f6c0 EFLAGS: 00010206 kasan: GPF could be caused by NULL-ptr deref or user memory access RAX: dffffc0000000000 RBX: ffff888098b3f740 RCX: ffffffff813d2053 RBP: ffff888098b3f700 R08: ffffed1014333cbd R09: ffffed1014333cbc RDX: 000000000000000a RSI: ffff888098b3f740 RDI: 0000000000000050 R10: ffffed1014333cbc R11: ffff8880a199e5e3 R12: 0000000000000000 RBP: ffff888098b3f700 R08: ffffed1014333cbd R09: ffffed1014333cbc R13: 0000000000000000 R14: ffffffff86d984f0 R15: dffffc0000000000 R10: ffffed1014333cbc R11: ffff8880a199e5e3 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff86d984f0 R15: dffffc0000000000 R13: 0000000000000000 R14: ffffffff86d984f0 R15: dffffc0000000000 general protection fault: 0000 [#4] PREEMPT SMP KASAN FS: 0000000002f74400(0000) GS:ffff8880ba300000(0000) knlGS:0000000000000000 CPU: 0 PID: 19124 Comm: syz-executor.5 Tainted: G D 4.19.208-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:klist_next+0x48/0x450 lib/klist.c:378 Code: 48 89 fb 48 83 ec 18 80 3c 02 00 0f 85 e1 02 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 23 49 8d 7c 24 50 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 b4 02 00 00 4c 8d 6b 08 4d 8b 7c 24 50 48 b8 00 RSP: 0018:ffff8880aa34f6c0 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8880aa34f740 RCX: ffffffff813d2053 RDX: 000000000000000a RSI: ffff8880aa34f740 RDI: 0000000000000050 RBP: ffff8880aa34f700 R08: ffffed101316f05d R09: ffffed101316f05c R10: ffffed101316f05c R11: ffff888098b782e3 R12: 0000000000000000 R13: 0000000000000000 R14: ffffffff86d984f0 R15: dffffc0000000000 FS: 00000000026b5400(0000) GS:ffff8880ba200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb07d261010 CR3: 00000000a1a86000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Call Trace: next_device drivers/base/core.c:2398 [inline] device_find_child+0xb1/0x170 drivers/base/core.c:2541 CR2: 00007f51d7333000 CR3: 00000000b3140000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 hci_conn_del_sysfs+0xaa/0x150 net/bluetooth/hci_sysfs.c:71 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 hci_conn_cleanup+0x1ff/0x4e0 net/bluetooth/hci_conn.c:128 ---------------- Code disassembly (best guess): 0: 48 89 fb mov %rdi,%rbx 3: 48 83 ec 18 sub $0x18,%rsp 7: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) b: 0f 85 e1 02 00 00 jne 0x2f2 11: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 18: fc ff df 1b: 4c 8b 23 mov (%rbx),%r12 1e: 49 8d 7c 24 50 lea 0x50(%r12),%rdi 23: 48 89 fa mov %rdi,%rdx 26: 48 c1 ea 03 shr $0x3,%rdx * 2a: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction 2e: 0f 85 b4 02 00 00 jne 0x2e8 34: 4c 8d 6b 08 lea 0x8(%rbx),%r13 38: 4d 8b 7c 24 50 mov 0x50(%r12),%r15 3d: 48 rex.W 3e: b8 .byte 0xb8