------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 1 PID: 12421 at lib/refcount.c:190 refcount_sub_and_test_checked lib/refcount.c:190 [inline]
WARNING: CPU: 1 PID: 12421 at lib/refcount.c:190 refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 12421 Comm: syz-executor.1 Not tainted 5.2.0-rc6-next-20190628 #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 panic+0x2dc/0x755 kernel/panic.c:219
 __warn.cold+0x20/0x4c kernel/panic.c:576
 report_bug+0x263/0x2b0 lib/bug.c:186
 fixup_bug arch/x86/kernel/traps.c:179 [inline]
 fixup_bug arch/x86/kernel/traps.c:174 [inline]
 do_error_trap+0x11b/0x200 arch/x86/kernel/traps.c:272
 do_invalid_op+0x37/0x50 arch/x86/kernel/traps.c:291
 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:986
RIP: 0010:refcount_sub_and_test_checked lib/refcount.c:190 [inline]
RIP: 0010:refcount_sub_and_test_checked+0x1d0/0x200 lib/refcount.c:180
Code: 1d 18 9d 64 06 31 ff 89 de e8 0c 89 37 fe 84 db 75 94 e8 c3 87 37 fe 48 c7 c7 e0 98 c5 87 c6 05 f8 9c 64 06 01 e8 f8 00 09 fe <0f> 0b e9 75 ff ff ff e8 a4 87 37 fe e9 6e ff ff ff 48 89 df e8 27
RSP: 0018:ffff88805057fb40 EFLAGS: 00010282
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 000000000001bf20 RSI: ffffffff815c1626 RDI: ffffed100a0aff5a
RBP: ffff88805057fbd8 R08: ffff88804f80c680 R09: ffffed1015d260b1
R10: ffffed1015d260b0 R11: ffff8880ae930587 R12: 00000000ffffffff
R13: 0000000000000001 R14: ffff88805057fbb0 R15: 0000000000000000
 refcount_dec_and_test_checked+0x1b/0x20 lib/refcount.c:220
 kref_put include/linux/kref.h:64 [inline]
 kobject_put+0x6c/0xe0 lib/kobject.c:739
 kset_put include/linux/kobject.h:219 [inline]
 kobj_kset_leave+0x18c/0x230 lib/kobject.c:209
 kobject_del+0xe8/0x170 lib/kobject.c:627
 cleanup_glue_dir.part.0+0x100/0x130 drivers/base/core.c:1829
 cleanup_glue_dir drivers/base/core.c:2300 [inline]
 device_del+0x823/0xb80 drivers/base/core.c:2298
 hci_unregister_dev+0x2a6/0x860 net/bluetooth/hci_core.c:3399
 vhci_release+0x76/0xf0 drivers/bluetooth/hci_vhci.c:339
 __fput+0x2ff/0x890 fs/file_table.c:280
 ____fput+0x16/0x20 fs/file_table.c:313
 task_work_run+0x145/0x1c0 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x280/0x2d0 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x5a9/0x6a0 arch/x86/entry/common.c:299
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459519
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007fb000440c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: 0000000000000002 RBX: 0000000000000003 RCX: 0000000000459519
RDX: 0000000000000002 RSI: 00000000200000c0 RDI: 0000000000000004
RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb0004416d4
R13: 00000000004c8f76 R14: 00000000004dff38 R15: 00000000ffffffff
Kernel Offset: disabled
Rebooting in 86400 seconds..