From: syzbot <syzbot+9cb68ebbbe46dc73843e@syzkaller.appspotmail.com>
To: gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
rafael@kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] BUG: corrupted list in remove_nodes
Date: Fri, 25 Nov 2022 01:44:46 -0800 [thread overview]
Message-ID: <000000000000396ded05ee485f93@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 9500fc6e9e60 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10bf96b5880000
kernel config: https://syzkaller.appspot.com/x/.config?x=b25c9f218686dd5e
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb68ebbbe46dc73843e
compiler: Debian clang version 13.0.1-++20220126092033+75e33f71c2da-1~exp1~20220126212112.63, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1363e60652f7/disk-9500fc6e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fcc4da811bb6/vmlinux-9500fc6e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0b554298f1fa/Image-9500fc6e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9cb68ebbbe46dc73843e@syzkaller.appspotmail.com
list_del corruption. next->prev should be ffff0000c9d7ea00, but was 0000000000000000. (next=ffff0000cc0a8d00)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:64!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 8731 Comm: syz-executor.4 Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
lr : __list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
sp : ffff8000153a3990
x29: ffff8000153a3990 x28: ffff0000cc0a8d00 x27: ffff800009a8825c
x26: ffff800009a88240 x25: ffff0000cc0a8d00 x24: ffff0000c6bb5ec0
x23: ffff0000c9d7ea00 x22: 0000000000000000 x21: ffff0000fa4e1730
x20: ffff8000153a3a08 x19: 0000000000000000 x18: 00000000000000c0
x17: 20747562202c3030 x16: ffff80000dc18158 x15: ffff000102341a40
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000102341a40
x11: ff808000081c6510 x10: 0000000000000000 x9 : 31ba0981391d2e00
x8 : 31ba0981391d2e00 x7 : ffff80000c0b2b74 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefddcc8 x1 : 0000000100000001 x0 : 000000000000006d
Call trace:
__list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
__list_del_entry include/linux/list.h:134 [inline]
list_move_tail include/linux/list.h:229 [inline]
remove_nodes+0xbc/0x2d0 drivers/base/devres.c:455
devres_release_all+0x80/0x194 drivers/base/devres.c:529
device_release+0x28/0xe0 drivers/base/core.c:2321
kobject_cleanup+0xe8/0x280 lib/kobject.c:673
kobject_release lib/kobject.c:704 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x94/0xf8 lib/kobject.c:721
put_device+0x28/0x40 drivers/base/core.c:3624
hci_free_dev+0x24/0x34 net/bluetooth/hci_core.c:2560
vhci_release+0x4c/0x80 drivers/bluetooth/hci_vhci.c:569
__fput+0x198/0x3e4 fs/file_table.c:320
____fput+0x20/0x30 fs/file_table.c:348
task_work_run+0x100/0x148 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x2dc/0xcac kernel/exit.c:820
do_group_exit+0x98/0xcc kernel/exit.c:950
get_signal+0xabc/0xb2c kernel/signal.c:2858
do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1071
do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1124
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
asm_exit_to_user_mode+0x70/0x84 arch/arm64/kernel/entry-common.c:149
ret_from_fork+0x1c/0x20 arch/arm64/kernel/entry.S:866
Code: d4210000 f001b780 912e0800 94aa876b (d4210000)
---[ end trace 0000000000000000 ]---
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
reply other threads:[~2022-11-25 9:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000396ded05ee485f93@google.com \
--to=syzbot+9cb68ebbbe46dc73843e@syzkaller.appspotmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rafael@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox