list_del corruption, ffff0000db2f0b00->prev is LIST_POISON2 (dead000000000122)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:58!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 3708 Comm: krfcommd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 62400005 (nZCv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
lr : __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
sp : ffff800023987430
x29: ffff800023987430 x28: ffff800018bd17c0 x27: ffff800023987700
x26: ffff0000d2d41e08 x25: ffff0000d2d41e00 x24: ffff0000d6bbd498
x23: ffff0000d6bbd490 x22: dfff800000000000 x21: dead000000000122
x20: ffff0000f970a320 x19: ffff0000db2f0b00 x18: 1fffe00033c2597e
x17: 6165642820324e4f x16: ffff800011ba16d0 x15: 4c20736920766572
x14: 0000000000000001 x13: 1ffff00004730dec x12: 0000000000000000
x11: ff00800008318060 x10: 0000000000000000 x9 : bc26ef4f9243ae00
x8 : bc26ef4f9243ae00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800023986ef8 x4 : ffff8000164c4fa0 x3 : ffff80000a8e4a5c
x2 : ffff00019e12cd10 x1 : 0000000100000000 x0 : 000000000000004e
Call trace:
 __list_del_entry_valid+0x128/0x15c lib/list_debug.c:56
 __list_del_entry include/linux/list.h:141 [inline]
 list_del_rcu include/linux/rculist.h:157 [inline]
 hci_chan_del+0x70/0x1bc net/bluetooth/hci_conn.c:2785
 l2cap_conn_free net/bluetooth/l2cap_core.c:1868 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_conn_put+0x80/0x10c net/bluetooth/l2cap_core.c:1882
 l2cap_chan_destroy net/bluetooth/l2cap_core.c:502 [inline]
 kref_put include/linux/kref.h:65 [inline]
 l2cap_chan_put+0x194/0x26c net/bluetooth/l2cap_core.c:529
 l2cap_sock_release+0x160/0x1c8 net/bluetooth/l2cap_sock.c:1494
 __sock_release net/socket.c:654 [inline]
 sock_release+0x88/0x144 net/socket.c:682
 rfcomm_session_del+0x144/0x1f8 net/bluetooth/rfcomm/core.c:781
 rfcomm_session_close+0xf8/0x180 net/bluetooth/rfcomm/core.c:820
 rfcomm_process_sessions net/bluetooth/rfcomm/core.c:-1 [inline]
 rfcomm_run+0x3afc/0x4e08 net/bluetooth/rfcomm/core.c:2254
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Code: b003c580 911e8000 aa1303e1 95c63ad6 (d4210000) 
---[ end trace 0000000000000000 ]---