================================================
WARNING: lock held when returning to user space!
6.18.0-rc7-next-20251128 #1 Not tainted
------------------------------------------------
syz-executor.3/7395 is leaving the kernel with locks still held!
1 lock held by syz-executor.3/7395:
 #0: ffff888015dc9c88 (&sb->s_type->i_mutex_key#21/1){+.+.}-{4:4}, at: start_creating_noperm+0x84/0xd0
9p: Unknown access argument 18446744073709551615: -34
9p: Unknown access argument 18446744073709551615: -34
9p: Unknown access argument 18446744073709551615: -34
9p: Unknown access argument 18446744073709551615: -34
Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
Bluetooth: hci0: command tx timeout
Bluetooth: hci0: Opcode 0x0c1a failed: -110
Bluetooth: hci0: Error when powering off device on rfkill (-110)