------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28, CPU#1: kbnepd bnep0/5219
Modules linked in:
CPU: 1 UID: 0 PID: 5219 Comm: kbnepd bnep0 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
lr : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28
sp : ffff800095607770
x29: ffff800095607770 x28: 1fffe000183951c2 x27: ffff0000c1ca8008
x26: 1fffe00018395005 x25: dfff800000000000 x24: 1fffe0001a451c8c
x23: dfff800000000000 x22: ffff8000824efa6c x21: 0000000000000000
x20: ffff0000d228e478 x19: ffff80008a19c000 x18: 00000000ffffffff
x17: ffff800084d7fe14 x16: ffff8000824e8a44 x15: ffff80008251a5d0
x14: ffff800080f08a9c x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 6021faeafbddff00
x8 : 6021faeafbddff00 x7 : ffff80008048c5b8 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f6830
x2 : 0000000100000001 x1 : ffff0000c5bb9d40 x0 : 0000000000000000
Call trace:
 refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 (P)
 __refcount_sub_and_test include/linux/refcount.h:400 [inline]
 __refcount_dec_and_test include/linux/refcount.h:432 [inline]
 refcount_dec_and_test include/linux/refcount.h:450 [inline]
 kref_put include/linux/kref.h:64 [inline]
 klist_dec_and_del+0x370/0x394 lib/klist.c:206
 klist_put+0xc4/0x11c lib/klist.c:217
 klist_del+0x24/0x34 lib/klist.c:230
 device_del+0x188/0x71c drivers/base/core.c:3938
 netdev_unregister_kobject+0x2a8/0x39c net/core/net-sysfs.c:2308
 unregister_netdevice_many_notify+0x123c/0x1760 net/core/dev.c:12481
 unregister_netdevice_many net/core/dev.c:12509 [inline]
 unregister_netdevice_queue+0x274/0x30c net/core/dev.c:12320
 unregister_netdevice include/linux/netdevice.h:3474 [inline]
 unregister_netdev+0x2c/0x70 net/core/dev.c:12527
 bnep_session+0x21b8/0x239c net/bluetooth/bnep/core.c:544
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
irq event stamp: 6872
hardirqs last  enabled at (6871): [<ffff80008690f4e0>] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline]
hardirqs last  enabled at (6871): [<ffff80008690f4e0>] __arm64_exit_to_kernel_mode+0x64/0x78 arch/arm64/kernel/entry-common.c:60
hardirqs last disabled at (6872): [<ffff80008690b3d0>] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:445
softirqs last  enabled at (6758): [<ffff80008030e6e4>] softirq_handle_end kernel/softirq.c:468 [inline]
softirqs last  enabled at (6758): [<ffff80008030e6e4>] handle_softirqs+0xc28/0xd98 kernel/softirq.c:650
softirqs last disabled at (6135): [<ffff8000800204c0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
---[ end trace 0000000000000000 ]---