list_del corruption. prev->next should be ffff88805e3b7518, but was 0000000000000000
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:61!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 12039 Comm: syz.4.1995 Not tainted 5.15.183-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 48 89 de e8 db f5 b6 05 0f 0b 48 c7 c7 00 a7 59 8a 48 89 de e8 ca f5 b6 05 0f 0b 48 c7 c7 60 a7 59 8a 48 89 de e8 b9 f5 b6 05 <0f> 0b 48 c7 c7 c0 a7 59 8a 48 89 de e8 a8 f5 b6 05 0f 0b 00 00 cc
RSP: 0018:ffffc900034cf730 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88805e3b7518 RCX: e5f63db3c2733f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffff88805e3b6020 R08: dffffc0000000000 R09: ffffed10172267a8
R10: ffffed10172267a8 R11: 1ffff110172267a7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888075c1e518 R15: ffff888075c1e518
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004000 CR3: 00000000640b0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __list_del_entry include/linux/list.h:132 [inline]
 list_del_init include/linux/list.h:204 [inline]
 bt_accept_unlink+0x35/0x230 net/bluetooth/af_bluetooth.c:209
 l2cap_sock_teardown_cb+0x1af/0x380 net/bluetooth/l2cap_sock.c:1588
 l2cap_chan_del+0xab/0x620 net/bluetooth/l2cap_core.c:655
 l2cap_conn_del+0x3c1/0x6a0 net/bluetooth/l2cap_core.c:1929
 hci_disconn_cfm include/net/bluetooth/hci_core.h:1520 [inline]
 hci_conn_hash_flush+0x107/0x220 net/bluetooth/hci_conn.c:1622
 hci_dev_do_close+0x991/0x1030 net/bluetooth/hci_core.c:1795
 hci_unregister_dev+0x2d7/0x580 net/bluetooth/hci_core.c:4040
 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345
 __fput+0x234/0x930 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 exit_task_work include/linux/task_work.h:33 [inline]
 do_exit+0x616/0x20a0 kernel/exit.c:874
 do_group_exit+0x12e/0x300 kernel/exit.c:996
 get_signal+0x6ca/0x12c0 kernel/signal.c:2900
 arch_do_signal_or_restart+0xc1/0x1300 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:280
RIP: 0033:0x7f9550f0e969
Code: Unable to access opcode bytes at RIP 0x7f9550f0e93f.
RSP: 002b:00007f954ed75fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 00007f9551135fa0 RCX: 00007f9550f0e969
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000411
RBP: 00007f9550f90ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f9551135fa0 R15: 00007ffc4ab70298
 </TASK>
Modules linked in:
---[ end trace a8b2f2fde887b7b0 ]---
RIP: 0010:__list_del_entry_valid+0x107/0x120 lib/list_debug.c:59
Code: 48 89 de e8 db f5 b6 05 0f 0b 48 c7 c7 00 a7 59 8a 48 89 de e8 ca f5 b6 05 0f 0b 48 c7 c7 60 a7 59 8a 48 89 de e8 b9 f5 b6 05 <0f> 0b 48 c7 c7 c0 a7 59 8a 48 89 de e8 a8 f5 b6 05 0f 0b 00 00 cc
RSP: 0018:ffffc900034cf730 EFLAGS: 00010246
RAX: 0000000000000054 RBX: ffff88805e3b7518 RCX: e5f63db3c2733f00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffff88805e3b6020 R08: dffffc0000000000 R09: ffffed10172267a8
R10: ffffed10172267a8 R11: 1ffff110172267a7 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff888075c1e518 R15: ffff888075c1e518
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffec57b9fc8 CR3: 0000000068863000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400