------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28, CPU#1: syz.4.384/6382 Modules linked in: CPU: 1 UID: 0 PID: 6382 Comm: syz.4.384 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 lr : refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 sp : ffff800098177610 x29: ffff800098177610 x28: 1ffff000113af364 x27: 1fffe0001eb2acea x26: dfff800000000000 x25: ffff0000cddc1d00 x24: 1fffe0001e9fb58c x23: dfff800000000000 x22: ffff800082472ce4 x21: 0000000000000000 x20: ffff0000f4fdac78 x19: ffff800089f9b000 x18: 00000000ffffffff x17: ffff80008a164c80 x16: ffff80008a55c7b8 x15: ffff0000cddc2850 x14: ffff0000cddc2830 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000dae x10: 0000000000ff0100 x9 : c8f665d06d6b5200 x8 : c8f665d06d6b5200 x7 : ffff80008047caa0 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f1374 x2 : 0000000100000001 x1 : ffff0000cddc1d00 x0 : 0000000000000000 Call trace: refcount_warn_saturate+0x154/0x1f8 lib/refcount.c:28 (P) __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] klist_dec_and_del+0x368/0x38c lib/klist.c:206 klist_put+0xc0/0x118 lib/klist.c:217 klist_del lib/klist.c:230 [inline] klist_remove+0x118/0x254 lib/klist.c:249 device_move+0x164/0x5a8 drivers/base/core.c:4632 hci_conn_del_sysfs+0xb4/0x194 net/bluetooth/hci_sysfs.c:75 hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline] hci_conn_del+0x9bc/0xf04 net/bluetooth/hci_conn.c:1307 hci_conn_hash_flush+0x17c/0x238 net/bluetooth/hci_conn.c:2735 hci_dev_close_sync+0x5bc/0xd88 net/bluetooth/hci_sync.c:5368 hci_dev_do_close+0x34/0xb8 net/bluetooth/hci_core.c:502 hci_unregister_dev+0x1e8/0x49c net/bluetooth/hci_core.c:2716 vhci_release+0x12c/0x17c drivers/bluetooth/hci_vhci.c:690 __fput+0x340/0x744 fs/file_table.c:510 ____fput+0x20/0x30 fs/file_table.c:538 task_work_run+0x1c4/0x254 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x580/0x1a6c kernel/exit.c:976 __do_sys_exit kernel/exit.c:1086 [inline] __se_sys_exit kernel/exit.c:1084 [inline] do_group_exit+0x0/0x22c kernel/exit.c:1084 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:740 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:759 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 3090 hardirqs last enabled at (3089): [] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline] hardirqs last enabled at (3089): [] arm64_exit_to_kernel_mode+0x80/0x94 arch/arm64/kernel/entry-common.c:62 hardirqs last disabled at (3090): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:429 softirqs last enabled at (3046): [] __alloc_skb+0x1c0/0x5f8 net/core/skbuff.c:696 softirqs last disabled at (3042): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (3042): [] __alloc_skb+0x1a8/0x5f8 net/core/skbuff.c:695 ---[ end trace 0000000000000000 ]--- FAT-fs (loop4): error, fat_free_clusters: deleting FAT entry beyond EOF FAT-fs (loop4): Filesystem has been set read-only