list_del corruption, ffff0001608e8800->next is LIST_POISON1 (dead000000000100)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:55!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 3743 Comm: syz-executor.5 Not tainted 6.0.0-rc2-syzkaller-16455-ga41a877bc12d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53
lr : __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53
sp : ffff80003870bad0
x29: ffff80003870bad0 x28: 0000000000000000 x27: ffff80000c57c700
x26: 0000000000000002 x25: ffff0000cae60000 x24: 0000000000000002
x23: 0000000000000007 x22: ffff0001608e8800 x21: ffff0000cae60010
x20: ffff0000cae60000 x19: ffff0001608e8800 x18: 000000000000009b
x17: ffff80000c04d6bc x16: ffff80000dbb8658 x15: ffff000160680000
x14: 0000000000000000 x13: 00000000ffffffff x12: 0000000000040000
x11: 0000000000002c53 x10: ffff800012cee000 x9 : b44f0b147837e900
x8 : b44f0b147837e900 x7 : ffff800008163ce8 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : ffff0001fefbecd0 x1 : 0000000100000000 x0 : 000000000000004e
Call trace:
 __list_del_entry_valid+0x98/0xd0 lib/list_debug.c:53
 __list_del_entry include/linux/list.h:134 [inline]
 list_del include/linux/list.h:148 [inline]
 mgmt_pending_remove+0x24/0x140 net/bluetooth/mgmt_util.c:314
 remove_adv_monitor+0x160/0x184 net/bluetooth/mgmt.c:5057
 hci_mgmt_cmd+0x440/0x53c net/bluetooth/hci_sock.c:1619
 hci_sock_sendmsg+0x3c4/0x6d8 net/bluetooth/hci_sock.c:1739
 sock_sendmsg_nosec net/socket.c:714 [inline]
 sock_sendmsg net/socket.c:734 [inline]
 sock_write_iter+0x140/0x1bc net/socket.c:1108
 call_write_iter include/linux/fs.h:2187 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x2dc/0x46c fs/read_write.c:578
 ksys_write+0xb4/0x160 fs/read_write.c:631
 __do_sys_write fs/read_write.c:643 [inline]
 __se_sys_write fs/read_write.c:640 [inline]
 __arm64_sys_write+0x24/0x34 fs/read_write.c:640
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:52 [inline]
 el0_svc_common+0x138/0x220 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x48/0x154 arch/arm64/kernel/syscall.c:206
 el0_svc+0x58/0x150 arch/arm64/kernel/entry-common.c:624
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:642
 el0t_64_sync+0x18c/0x190
Code: d2802002 910bb000 f2fbd5a2 94a810cf (d4210000) 
---[ end trace 0000000000000000 ]---