Comment 24 for bug 1165433

Here's another way to trigger the crash:
1. Set up and use rfcomm/btusb as normal.
2. stop bluetooth daemon

It's not necessary to disconnect from networkmanager to trigger this.

This time the first anomaly is a warning in get_work_pool. This time it says pppd, and it was trying to release the connection. I need to set up serial console again but the call trace is (typed by hand):
warn_slowpath_common
warn_slowpath_null
flush_work
? kfree
__cancel_work_timer
cancel_work_sync
tty_ldisc_halt
tty_ldisc_release
tty_release
__fput
____fput
task_work_run
do_notify_resume
int_signal

Less than one second after, I get a full oops - this time in X, and the call trace is pretty much the same as the previously posted oops.