list_del corruption. next->prev should be ffff0000c9d7ea00, but was 0000000000000000. (next=ffff0000cc0a8d00)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:64!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 8731 Comm: syz-executor.4 Not tainted 6.1.0-rc5-syzkaller-32269-g9500fc6e9e60 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/30/2022
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
lr : __list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
sp : ffff8000153a3990
x29: ffff8000153a3990 x28: ffff0000cc0a8d00 x27: ffff800009a8825c
x26: ffff800009a88240 x25: ffff0000cc0a8d00 x24: ffff0000c6bb5ec0
x23: ffff0000c9d7ea00 x22: 0000000000000000 x21: ffff0000fa4e1730
x20: ffff8000153a3a08 x19: 0000000000000000 x18: 00000000000000c0
x17: 20747562202c3030 x16: ffff80000dc18158 x15: ffff000102341a40
x14: 0000000000000000 x13: 00000000ffffffff x12: ffff000102341a40
x11: ff808000081c6510 x10: 0000000000000000 x9 : 31ba0981391d2e00
x8 : 31ba0981391d2e00 x7 : ffff80000c0b2b74 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefddcc8 x1 : 0000000100000001 x0 : 000000000000006d
Call trace:
 __list_del_entry_valid+0xcc/0xd0 lib/list_debug.c:62
 __list_del_entry include/linux/list.h:134 [inline]
 list_move_tail include/linux/list.h:229 [inline]
 remove_nodes+0xbc/0x2d0 drivers/base/devres.c:455
 devres_release_all+0x80/0x194 drivers/base/devres.c:529
 device_release+0x28/0xe0 drivers/base/core.c:2321
 kobject_cleanup+0xe8/0x280 lib/kobject.c:673
 kobject_release lib/kobject.c:704 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x94/0xf8 lib/kobject.c:721
 put_device+0x28/0x40 drivers/base/core.c:3624
 hci_free_dev+0x24/0x34 net/bluetooth/hci_core.c:2560
 vhci_release+0x4c/0x80 drivers/bluetooth/hci_vhci.c:569
 __fput+0x198/0x3e4 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x100/0x148 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0x2dc/0xcac kernel/exit.c:820
 do_group_exit+0x98/0xcc kernel/exit.c:950
 get_signal+0xabc/0xb2c kernel/signal.c:2858
 do_signal+0x128/0x438 arch/arm64/kernel/signal.c:1071
 do_notify_resume+0xc0/0x1f0 arch/arm64/kernel/signal.c:1124
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 asm_exit_to_user_mode+0x70/0x84 arch/arm64/kernel/entry-common.c:149
 ret_from_fork+0x1c/0x20 arch/arm64/kernel/entry.S:866
Code: d4210000 f001b780 912e0800 94aa876b (d4210000) 
---[ end trace 0000000000000000 ]---