Bluetooth: Wrong link type (-22)
list_del corruption. next->prev should be ffff888095d9e910, but was ffff888097cbae90
Bluetooth: Wrong link type (-22)
Bluetooth: Wrong link type (-22)
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:56!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 7822 Comm: kworker/u5:2 Not tainted 4.14.196-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: hci0 hci_rx_work
task: ffff888085220600 task.stack: ffff888085278000
RIP: 0010:__list_del_entry_valid.cold.1+0x37/0x58 lib/list_debug.c:54
RSP: 0018:ffff88808527f750 EFLAGS: 00010282
RAX: 0000000000000054 RBX: ffff888095d9e910 RCX: 0000000000000000
RDX: 0000000000000054 RSI: ffff888085220f28 RDI: ffffed1010a4fee1
RBP: ffff88808527f768 R08: ffff888085220f48 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88809ac7ce50
R13: ffff888097cbae90 R14: ffff88809ac7ca00 R15: 0000000000000021
FS:  0000000000000000(0000) GS:ffff8880aed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051b800 CR3: 000000008afff000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_del_entry include/linux/list.h:117 [inline]
 list_del_init include/linux/list.h:159 [inline]
 bt_accept_unlink+0x1f/0x1f0 net/bluetooth/af_bluetooth.c:187
 l2cap_sock_teardown_cb+0x165/0x3d0 net/bluetooth/l2cap_sock.c:1353
 l2cap_chan_del+0x9b/0x790 net/bluetooth/l2cap_core.c:596
 l2cap_disconnect_req net/bluetooth/l2cap_core.c:4349 [inline]
 l2cap_bredr_sig_cmd net/bluetooth/l2cap_core.c:5427 [inline]
 l2cap_sig_channel net/bluetooth/l2cap_core.c:5793 [inline]
 l2cap_recv_frame+0x43d5/0x9e30 net/bluetooth/l2cap_core.c:7017
 l2cap_recv_acldata+0x756/0x8a0 net/bluetooth/l2cap_core.c:7588
 hci_acldata_packet net/bluetooth/hci_core.c:4066 [inline]
 hci_rx_work+0x5d4/0x8d0 net/bluetooth/hci_core.c:4249
 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250
 kthread+0x338/0x400 kernel/kthread.c:232
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 e8 04 73 42 fe 0f 0b 4c 89 ea 48 89 de 48 c7 c7 20 0f 04 87 e8 f0 72 42 fe 0f 0b 48 89 de 48 c7 c7 40 10 04 87 e8 df 72 42 fe <0f> 0b 48 89 de 48 c7 c7 e0 0f 04 87 e8 ce 72 42 fe 0f 0b 90 90 
RIP: __list_del_entry_valid.cold.1+0x37/0x58 lib/list_debug.c:54 RSP: ffff88808527f750
---[ end trace cf22eb0f646cd733 ]---