------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1556 at lib/refcount.c:25 refcount_warn_saturate+0xdd/0x140 lib/refcount.c:25
Modules linked in:
CPU: 0 PID: 1556 Comm: kworker/u5:0 Not tainted 5.12.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
RIP: 0010:refcount_warn_saturate+0xdd/0x140 lib/refcount.c:25
Code: 30 80 e4 06 01 e8 10 f8 ed 03 0f 0b eb 9d 80 3d 1f 80 e4 06 00 75 94 48 c7 c7 e0 45 12 88 c6 05 0f 80 e4 06 01 e8 f0 f7 ed 03 <0f> 0b e9 7a ff ff ff 80 3d f9 7f e4 06 00 0f 85 6d ff ff ff 48 c7
RSP: 0018:ffffc90005027980 EFLAGS: 00010286
RAX: 0000000000000000 RBX: ffff88812a0d0018 RCX: 0000000000000000
RDX: 0000000000000002 RSI: ffffffff88127fc0 RDI: fffff52000a04f22
RBP: 0000000000000002 R08: 0000000000000001 R09: ffff8881f64310e7
R10: ffffed103ec8621c R11: 746e756f63666572 R12: dffffc0000000000
R13: 0000000000000001 R14: ffff88812a0d0021 R15: ffffffff8a20bec8
FS:  0000000000000000(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001320608 CR3: 0000000120414000 CR4: 0000000000350ef0
Call Trace:
 __refcount_add include/linux/refcount.h:199 [inline]
 __refcount_inc include/linux/refcount.h:250 [inline]
 refcount_inc include/linux/refcount.h:267 [inline]
 kref_get include/linux/kref.h:45 [inline]
 l2cap_chan_hold net/bluetooth/l2cap_core.c:495 [inline]
 l2cap_global_chan_by_psm+0x35a/0x3c0 net/bluetooth/l2cap_core.c:1984
 l2cap_conless_channel net/bluetooth/l2cap_core.c:7603 [inline]
 l2cap_recv_frame+0xa1f/0x9dd0 net/bluetooth/l2cap_core.c:7673
 hci_acldata_packet net/bluetooth/hci_core.c:4902 [inline]
 hci_rx_work+0x38f/0x930 net/bluetooth/hci_core.c:5093
 process_one_work+0x84c/0x13b0 kernel/workqueue.c:2275
 worker_thread+0x598/0xf80 kernel/workqueue.c:2421
 kthread+0x36f/0x450 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294