Re: [syzbot] [bluetooth?] kernel panic: kernel: panic_on_warn set ... (3)

[Hillf Danton <hdanton@sina.com>]

> Date: Sun, 30 Aug 2026 10:38:31 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    08dbfad3f504 Merge tag 'for-linus' of git://git.kernel.org..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14f47379580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=5e4e3a0e188a497e
> dashboard link: https://syzkaller.appspot.com/bug?extid=fe5ea83cdd7fc263f452
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10c2a379580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16181e25580000

#syz test

--- x/include/net/bluetooth/hci_core.h
+++ y/include/net/bluetooth/hci_core.h
@@ -1701,9 +1701,13 @@ static inline struct hci_conn *hci_conn_
 
 static inline void hci_conn_drop(struct hci_conn *conn)
 {
+	int cnt;
+
 	BT_DBG("hcon %p orig refcnt %d", conn, atomic_read(&conn->refcnt));
 
-	if (atomic_dec_and_test(&conn->refcnt)) {
+	cnt = atomic_dec_return(&conn->refcnt);
+	WARN_ON(cnt < 0);
+	if (cnt == 0) {
 		unsigned long timeo;
 
 		switch (conn->type) {
--