Warning: Permanently added '10.128.0.66' (ECDSA) to the list of known hosts.
[   40.255501][ T4222] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   40.259271][ T4222] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   40.261499][ T4222] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   40.264011][ T4222] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   40.266397][ T4222] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   40.269618][ T4222] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
executing program
[   40.307555][ T4222] 
[   40.308185][ T4222] =====================================
[   40.309532][ T4222] WARNING: bad unlock balance detected!
[   40.310827][ T4222] 6.1.26-syzkaller #0 Not tainted
[   40.312041][ T4222] -------------------------------------
[   40.313499][ T4222] kworker/u5:2/4222 is trying to release lock (&conn->chan_lock) at:
[   40.315489][ T4222] [<ffff80001138a084>] l2cap_disconnect_rsp+0x210/0x30c
[   40.317148][ T4222] but there are no more locks to release!
[   40.318533][ T4222] 
[   40.318533][ T4222] other info that might help us debug this:
[   40.320459][ T4222] 2 locks held by kworker/u5:2/4222:
[   40.321776][ T4222]  #0: ffff0000d4f90938 ((wq_completion)hci0#2){+.+.}-{0:0}, at: process_one_work+0x664/0x1404
[   40.324274][ T4222]  #1: ffff80001d9e7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404
[   40.327043][ T4222] 
[   40.327043][ T4222] stack backtrace:
[   40.328462][ T4222] CPU: 0 PID: 4222 Comm: kworker/u5:2 Not tainted 6.1.26-syzkaller #0
[   40.330448][ T4222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/30/2023
[   40.332913][ T4222] Workqueue: hci0 hci_rx_work
[   40.334087][ T4222] Call trace:
[   40.334872][ T4222]  dump_backtrace+0x1c8/0x1f4
[   40.336087][ T4222]  show_stack+0x2c/0x3c
[   40.337154][ T4222]  dump_stack_lvl+0x108/0x170
[   40.338350][ T4222]  dump_stack+0x1c/0x5c
[   40.339353][ T4222]  print_unlock_imbalance_bug+0x250/0x2a4
[   40.340718][ T4222]  lock_release+0x4dc/0xa50
[   40.341811][ T4222]  __mutex_unlock_slowpath+0xe0/0x6cc
[   40.343160][ T4222]  mutex_unlock+0x24/0x30
[   40.344224][ T4222]  l2cap_disconnect_rsp+0x210/0x30c
[   40.345452][ T4222]  l2cap_bredr_sig_cmd+0x974/0x7e94
[   40.346753][ T4222]  l2cap_recv_frame+0x83c/0x6a14
[   40.347942][ T4222]  l2cap_recv_acldata+0x4f4/0x163c
[   40.349233][ T4222]  hci_rx_work+0x2cc/0x8b8
[   40.350341][ T4222]  process_one_work+0x7ac/0x1404
[   40.351502][ T4222]  worker_thread+0x8e4/0xfec
[   40.352612][ T4222]  kthread+0x250/0x2d8
[   40.353616][ T4222]  ret_from_fork+0x10/0x20