list_del corruption, ffff0000d01a2000->prev is LIST_POISON2 (dead000000000122)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4416 Comm: kworker/1:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
Workqueue: events delayed_fput
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
lr : __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
sp : ffff8000224e7990
x29: ffff8000224e7990 x28: 1fffe0001bd1aa34 x27: dfff800000000000
x26: 0000000000000000 x25: 1fffe0001bd1aa35 x24: ffff0000d7005498
x23: ffff0000d7005490 x22: dfff800000000000 x21: dead000000000122
x20: ffff0000d9502320 x19: ffff0000d01a2000 x18: 1fffe00033c2597e
x17: 6165642820324e4f x16: ffff800011ba16d0 x15: 4c20736920766572
x14: 0000000000000001 x13: 1ffff0000449ce98 x12: 0000000000000000
x11: ff00800008318060 x10: 0000000000000000 x9 : f8c4dca9566be100
x8 : f8c4dca9566be100 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff8000224e7458 x4 : ffff8000164c4fa0 x3 : ffff80000a8e4a5c
x2 : ffff00019e12cd10 x1 : 0000000100000000 x0 : 000000000000004e
Call trace:
 __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
 __list_del_entry include/linux/list.h:141 [inline]
 list_del_rcu include/linux/rculist.h:157 [inline]
 hci_chan_del+0x70/0x1bc net/bluetooth/hci_conn.c:2785
 l2cap_conn_free net/bluetooth/l2cap_core.c:1868 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put+0x80/0x10c net/bluetooth/l2cap_core.c:1882
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:502 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x194/0x26c net/bluetooth/l2cap_core.c:529
 l2cap_sock_release+0x160/0x1c8 net/bluetooth/l2cap_sock.c:1494
 __sock_release net/socket.c:654 [inline]
 sock_close+0xac/0x1ec net/socket.c:1400
 __fput+0x1b4/0x7b0 fs/file_table.c:320
 delayed_fput+0x78/0xa8 fs/file_table.c:343
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: b003c580 911e8000 aa1303e1 95c63ad6 (d4210000) 
---[ end trace 0000000000000000 ]---