syzbot


INFO: trying to register non-static key in l2cap_unregister_user

Status: upstream: reported on 2026/01/14 08:17
Reported-by: syzbot+5e13e02a225fdf8241b0@syzkaller.appspotmail.com
First crash: 14d, last: 14d
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: trying to register non-static key in l2cap_unregister_user bluetooth -1 10 4d19h 104d 0/29 upstream: reported on 2025/10/16 15:35

Sample crash report:
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 PID: 5404 Comm: khidpd_10cf05df Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 assign_lock_key+0x224/0x258 kernel/locking/lockdep.c:974
 register_lock_class+0x1ac/0x694 kernel/locking/lockdep.c:1287
 __lock_acquire+0x150/0x6544 kernel/locking/lockdep.c:4928
 lock_acquire+0x20c/0x644 kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x54/0x6c kernel/locking/spinlock.c:154
 __mutex_lock_common+0xc6c/0x1f38 kernel/locking/mutex.c:701
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 l2cap_unregister_user+0x70/0x18c net/bluetooth/l2cap_core.c:1895
 hidp_session_thread+0x3d0/0x46c net/bluetooth/hidp/core.c:1305
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
list_del corruption. prev->next should be ffff8000216d7c00, but was 0000000000000000. (prev=ffff0000dc3d0060)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 5404 Comm: khidpd_10cf05df Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
lr : __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
sp : ffff8000216d7b10
x29: ffff8000216d7b10 x28: dfff800000000000 x27: ffff7000042daf7c
x26: 1ffff00003849b0c x25: ffff80001c24d000 x24: 0000000000000000
x23: ffff0000de5d0000 x22: dfff800000000000 x21: ffff0000dc3d0060
x20: ffff0000dc3d0060 x19: ffff8000216d7c00 x18: ffff800011a6bd40
x17: 20747562202c3030 x16: ffff800008042d90 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff0080000830c768 x10: 0000000000000000 x9 : f7dcce724972b000
x8 : f7dcce724972b000 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000216d75d8 x4 : ffff800015134e80 x3 : ffff8000083144a8
x2 : 0000000000000001 x1 : 0000000000000002 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid+0x13c/0x158 lib/list_debug.c:59
 __list_del_entry include/linux/list.h:134 [inline]
 list_del include/linux/list.h:148 [inline]
 __mutex_remove_waiter kernel/locking/mutex.c:218 [inline]
 __mutex_lock_common+0xd04/0x1f38 kernel/locking/mutex.c:715
 __mutex_lock kernel/locking/mutex.c:747 [inline]
 mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799
 l2cap_unregister_user+0x70/0x18c net/bluetooth/l2cap_core.c:1895
 hidp_session_thread+0x3d0/0x46c net/bluetooth/hidp/core.c:1305
 kthread+0x250/0x2d8 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850
Code: 91178000 aa1303e1 aa1503e3 95be5661 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/14 08:16 linux-6.1.y bec0e10ee67e d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 INFO: trying to register non-static key in l2cap_unregister_user
* Struck through repros no longer work on HEAD.