getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) fork() 00:32:39 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:39 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:32:39 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 975.906699] Bluetooth: hci1: HCI_REQ-0x0401 [ 975.949755] Bluetooth: hci1: HCI_REQ-0x0401 [ 977.080957] Bluetooth: hci1: command 0x0401 tx timeout [ 979.128929] Bluetooth: hci1: command 0x0401 tx timeout [ 981.176958] Bluetooth: hci1: command 0x0401 tx timeout [ 983.224927] Bluetooth: hci1: command 0x0401 tx timeout 00:32:53 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:32:53 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:32:53 executing program 6: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:53 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) fork() 00:32:53 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:32:53 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:32:53 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 988.777416] Bluetooth: hci1: HCI_REQ-0x0401 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:53 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, 0x0, 0x0, 0x800) fork() 00:32:53 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:53 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(0xffffffffffffffff, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:32:53 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 989.586210] Bluetooth: hci1: HCI_REQ-0x0401 [ 989.586693] Bluetooth: hci1: HCI_REQ-0x0401 [ 989.639410] Bluetooth: hci1: HCI_REQ-0x0401 [ 990.840858] Bluetooth: hci1: command 0x0401 tx timeout [ 992.888830] Bluetooth: hci1: command 0x0401 tx timeout [ 994.936827] Bluetooth: hci1: command 0x0401 tx timeout [ 996.994028] Bluetooth: hci1: command 0x0401 tx timeout 00:33:07 executing program 6: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:07 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, 0x0, 0x0, 0x800) fork() 00:33:07 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:07 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:07 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:07 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:07 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) [ 1003.676173] Bluetooth: hci1: HCI_REQ-0x0401 00:33:08 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:08 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, 0x0, 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:08 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, 0x0, 0x0, 0x800) fork() 00:33:08 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:08 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:08 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:08 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:08 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240), 0x8, 0x800) fork() [ 1004.507301] Bluetooth: hci1: HCI_REQ-0x0401 [ 1004.510859] Bluetooth: hci1: HCI_REQ-0x0401 [ 1004.544651] Bluetooth: hci1: HCI_REQ-0x0401 [ 1005.688898] Bluetooth: hci1: command 0x0401 tx timeout [ 1007.736956] Bluetooth: hci1: command 0x0401 tx timeout [ 1009.784920] Bluetooth: hci1: command 0x0401 tx timeout [ 1011.832894] Bluetooth: hci1: command 0x0401 tx timeout 00:33:22 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:22 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240), 0x8, 0x800) fork() 00:33:22 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:33:22 executing program 6: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1018.291491] Bluetooth: hci1: HCI_REQ-0x0401 00:33:22 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240), 0x8, 0x800) fork() 00:33:22 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:22 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) fork() 00:33:22 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:22 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x0, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1019.094358] Bluetooth: hci1: HCI_REQ-0x0401 [ 1019.095428] Bluetooth: hci1: HCI_REQ-0x0401 [ 1019.151715] Bluetooth: hci1: HCI_REQ-0x0401 [ 1020.345006] Bluetooth: hci1: command 0x0401 tx timeout [ 1022.392916] Bluetooth: hci1: command 0x0401 tx timeout [ 1024.440958] Bluetooth: hci1: command 0x0401 tx timeout [ 1026.488919] Bluetooth: hci1: command 0x0401 tx timeout 00:33:36 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:33:36 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) fork() 00:33:36 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:36 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:36 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 6: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1031.741488] Bluetooth: hci1: HCI_REQ-0x0401 00:33:36 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) pidfd_send_signal(0xffffffffffffffff, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r3 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r3, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r3, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r4, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) fork() [ 1031.845636] Bluetooth: hci1: HCI_REQ-0x0401 [ 1031.849976] Bluetooth: hci1: HCI_REQ-0x0401 00:33:36 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:33:36 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:36 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:36 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1032.174080] Bluetooth: hci0: HCI_REQ-0x0401 00:33:36 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:36 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1032.605813] Bluetooth: hci1: HCI_REQ-0x0401 [ 1032.608658] Bluetooth: hci1: HCI_REQ-0x0401 00:33:37 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:37 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:37 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:37 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:37 executing program 6: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1032.803843] Bluetooth: hci1: HCI_REQ-0x0401 [ 1032.806802] Bluetooth: hci1: HCI_REQ-0x0401 00:33:37 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:33:37 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:37 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) 00:33:37 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:37 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:33:37 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1033.540180] Bluetooth: hci1: HCI_REQ-0x0401 [ 1033.544859] Bluetooth: hci1: HCI_REQ-0x0401 [ 1033.809885] Bluetooth: hci1: command 0x0401 tx timeout [ 1034.232936] Bluetooth: hci0: command 0x0401 tx timeout [ 1035.832844] Bluetooth: hci1: command 0x0401 tx timeout [ 1037.880852] Bluetooth: hci1: command 0x0401 tx timeout [ 1039.929025] Bluetooth: hci1: command 0x0401 tx timeout [ 1041.976851] Bluetooth: hci1: command 0x0401 tx timeout [ 1044.024868] Bluetooth: hci1: command 0x0401 tx timeout [ 1046.072845] Bluetooth: hci1: command 0x0401 tx timeout 00:33:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:51 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:51 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:33:51 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:33:51 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, 0x0) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:33:51 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:51 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r3, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r4}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r1}, {0x8, 0x1, r5}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1047.506566] Bluetooth: hci1: HCI_REQ-0x0401 [ 1047.536151] Bluetooth: hci0: HCI_REQ-0x0401 00:33:51 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) 00:33:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:51 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) 00:33:52 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) 00:33:52 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) 00:33:52 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:33:52 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:33:52 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) [ 1048.122055] Bluetooth: hci1: command 0x0401 tx timeout [ 1048.340823] Bluetooth: hci1: HCI_REQ-0x0401 [ 1048.364496] Bluetooth: hci1: HCI_REQ-0x0401 [ 1049.593844] Bluetooth: hci0: command 0x0401 tx timeout [ 1050.168866] Bluetooth: hci1: command 0x0401 tx timeout [ 1052.217005] Bluetooth: hci1: command 0x0401 tx timeout [ 1054.265007] Bluetooth: hci1: command 0x0401 tx timeout [ 1056.313023] Bluetooth: hci1: command 0x0401 tx timeout 00:34:04 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:04 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:04 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:04 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:04 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:34:04 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1060.012289] Bluetooth: hci1: HCI_REQ-0x0401 [ 1060.034137] Bluetooth: hci0: HCI_REQ-0x0401 00:34:04 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:04 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:04 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:04 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:34:04 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1060.840803] Bluetooth: hci1: HCI_REQ-0x0401 [ 1062.072953] Bluetooth: hci0: command 0x0401 tx timeout [ 1062.074007] Bluetooth: hci1: command 0x0401 tx timeout [ 1064.121001] Bluetooth: hci1: command 0x0401 tx timeout 00:34:18 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:18 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:18 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:18 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:18 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:18 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 00:34:18 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 1073.789933] Bluetooth: hci1: HCI_REQ-0x0401 00:34:18 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:18 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) 00:34:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) 00:34:18 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:18 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:34:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) 00:34:18 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) [ 1074.604312] Bluetooth: hci1: HCI_REQ-0x0401 [ 1074.607863] Bluetooth: hci1: HCI_REQ-0x0401 [ 1075.832839] Bluetooth: hci1: command 0x0401 tx timeout [ 1077.880809] Bluetooth: hci1: command 0x0401 tx timeout [ 1079.928927] Bluetooth: hci1: command 0x0401 tx timeout 00:34:30 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:30 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:30 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1086.057552] Bluetooth: hci1: HCI_REQ-0x0401 00:34:30 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 00:34:30 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:30 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) 00:34:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:30 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:30 executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) [ 1086.886449] Bluetooth: hci1: HCI_REQ-0x0401 [ 1086.887335] Bluetooth: hci1: HCI_REQ-0x0401 [ 1088.120846] Bluetooth: hci1: command 0x0401 tx timeout [ 1090.168835] Bluetooth: hci1: command 0x0401 tx timeout [ 1092.217224] Bluetooth: hci1: command 0x0401 tx timeout 00:34:42 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:34:42 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:42 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) 00:34:42 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:42 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:42 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:42 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:42 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1098.346674] Bluetooth: hci1: HCI_REQ-0x0401 [ 1098.438710] Bluetooth: hci1: HCI_REQ-0x0401 [ 1098.474348] Bluetooth: hci1: HCI_REQ-0x0401 [ 1100.408847] Bluetooth: hci1: command 0x0401 tx timeout [ 1102.456872] Bluetooth: hci1: command 0x0401 tx timeout [ 1104.504856] Bluetooth: hci1: command 0x0401 tx timeout 00:34:56 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:34:56 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) 00:34:56 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1112.064233] Bluetooth: hci0: HCI_REQ-0x0401 [ 1112.065120] Bluetooth: hci1: HCI_REQ-0x0401 00:34:56 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1112.145318] Bluetooth: hci1: HCI_REQ-0x0401 00:34:56 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, 0x0) [ 1112.299482] Bluetooth: hci1: HCI_REQ-0x0401 00:34:56 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1112.359727] Bluetooth: hci1: HCI_REQ-0x0401 00:34:56 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:34:56 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1112.491069] Bluetooth: hci1: HCI_REQ-0x0401 [ 1112.511655] Bluetooth: hci1: HCI_REQ-0x0401 [ 1112.540614] Bluetooth: hci1: HCI_REQ-0x0401 [ 1114.104975] Bluetooth: hci1: command 0x0401 tx timeout [ 1114.106249] Bluetooth: hci0: command 0x0401 tx timeout [ 1116.152849] Bluetooth: hci1: command 0x0401 tx timeout [ 1118.200926] Bluetooth: hci1: command 0x0401 tx timeout [ 1120.248888] Bluetooth: hci1: command 0x0401 tx timeout [ 1122.296868] Bluetooth: hci1: command 0x0401 tx timeout [ 1124.344912] Bluetooth: hci1: command 0x0401 tx timeout [ 1126.392930] Bluetooth: hci1: command 0x0401 tx timeout 00:35:11 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:11 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:11 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:11 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:11 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:11 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:11 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:11 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1126.767113] Bluetooth: hci1: HCI_REQ-0x0401 [ 1126.769844] Bluetooth: hci1: HCI_REQ-0x0401 [ 1126.772120] Bluetooth: hci1: HCI_REQ-0x0401 00:35:11 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1126.798675] Bluetooth: hci0: HCI_REQ-0x0401 00:35:11 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1127.022492] Bluetooth: hci1: HCI_REQ-0x0401 00:35:11 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1127.078678] Bluetooth: hci1: HCI_REQ-0x0401 [ 1128.824996] Bluetooth: hci0: command 0x0401 tx timeout [ 1128.826186] Bluetooth: hci1: command 0x0401 tx timeout [ 1130.873864] Bluetooth: hci1: command 0x0401 tx timeout [ 1132.920957] Bluetooth: hci1: command 0x0401 tx timeout [ 1134.969039] Bluetooth: hci1: command 0x0401 tx timeout [ 1137.017056] Bluetooth: hci1: command 0x0401 tx timeout 00:35:24 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:24 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1139.910239] Bluetooth: hci0: HCI_REQ-0x0401 [ 1139.911382] Bluetooth: hci1: HCI_REQ-0x0401 00:35:24 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:24 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:35:24 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:24 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:24 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:24 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:35:24 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:24 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:35:24 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:24 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:24 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:35:24 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:24 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:24 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:35:24 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1140.746785] Bluetooth: hci1: HCI_REQ-0x0401 [ 1140.749798] Bluetooth: hci1: HCI_REQ-0x0401 [ 1141.944942] Bluetooth: hci1: command 0x0401 tx timeout [ 1141.946047] Bluetooth: hci0: command 0x0401 tx timeout [ 1143.992834] Bluetooth: hci1: command 0x0401 tx timeout [ 1146.040877] Bluetooth: hci1: command 0x0401 tx timeout 00:35:39 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:39 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:35:39 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, r0, 0x0) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:39 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1155.022054] Bluetooth: hci1: HCI_REQ-0x0401 00:35:39 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:35:39 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:39 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:39 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:39 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1155.854687] Bluetooth: hci1: HCI_REQ-0x0401 [ 1155.857014] Bluetooth: hci1: HCI_REQ-0x0401 [ 1155.858033] Bluetooth: hci1: HCI_REQ-0x0401 [ 1157.048835] Bluetooth: hci1: command 0x0401 tx timeout [ 1159.096847] Bluetooth: hci1: command 0x0401 tx timeout [ 1161.145028] Bluetooth: hci1: command 0x0401 tx timeout [ 1163.192851] Bluetooth: hci1: command 0x0401 tx timeout 00:35:51 executing program 5: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:35:51 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:35:51 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1167.335451] Bluetooth: hci1: HCI_REQ-0x0401 00:35:51 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:35:51 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1167.358161] Bluetooth: hci1: HCI_REQ-0x0401 00:35:51 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:35:51 executing program 5: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) r6 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r6, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) 00:35:51 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:52 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:35:52 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:35:52 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) r6 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r6, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) [ 1168.167803] Bluetooth: hci1: HCI_REQ-0x0401 [ 1168.168615] Bluetooth: hci1: HCI_REQ-0x0401 [ 1168.169421] Bluetooth: hci1: HCI_REQ-0x0401 [ 1169.336984] Bluetooth: hci1: command 0x0401 tx timeout [ 1171.384915] Bluetooth: hci1: command 0x0401 tx timeout [ 1173.437182] Bluetooth: hci1: command 0x0401 tx timeout [ 1175.481035] Bluetooth: hci1: command 0x0401 tx timeout [ 1177.535075] Bluetooth: hci1: command 0x0401 tx timeout 00:36:07 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:07 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:36:07 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) r6 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r6, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) 00:36:07 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:07 executing program 5: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:07 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:36:07 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1183.440975] Bluetooth: hci1: HCI_REQ-0x0401 [ 1183.454934] Bluetooth: hci1: HCI_REQ-0x0401 00:36:07 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1183.462290] Bluetooth: hci1: HCI_REQ-0x0401 [ 1183.506162] Bluetooth: hci1: HCI_REQ-0x0401 00:36:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:08 executing program 5: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:08 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) 00:36:08 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:36:08 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:08 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:08 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:08 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1184.301342] Bluetooth: hci1: HCI_REQ-0x0401 [ 1184.302002] Bluetooth: hci1: HCI_REQ-0x0401 [ 1184.305837] Bluetooth: hci1: HCI_REQ-0x0401 [ 1185.464853] Bluetooth: hci1: command 0x0401 tx timeout [ 1187.512946] Bluetooth: hci1: command 0x0401 tx timeout [ 1189.561004] Bluetooth: hci1: command 0x0401 tx timeout [ 1191.608879] Bluetooth: hci1: command 0x0401 tx timeout [ 1193.656820] Bluetooth: hci1: command 0x0401 tx timeout [ 1195.704871] Bluetooth: hci1: command 0x0401 tx timeout 00:36:21 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:36:21 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:21 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:21 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:21 executing program 5: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1197.627554] Bluetooth: hci1: HCI_REQ-0x0401 00:36:21 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:21 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:21 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) 00:36:21 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:22 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1197.752805] Bluetooth: hci1: command 0x0401 tx timeout 00:36:22 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:22 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:22 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:22 executing program 5: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:22 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1198.434203] Bluetooth: hci1: HCI_REQ-0x0401 [ 1198.435323] Bluetooth: hci1: HCI_REQ-0x0401 [ 1198.487811] Bluetooth: hci1: HCI_REQ-0x0401 [ 1199.800841] Bluetooth: hci1: command 0x0401 tx timeout [ 1201.848805] Bluetooth: hci1: command 0x0401 tx timeout [ 1203.896901] Bluetooth: hci1: command 0x0401 tx timeout [ 1205.944967] Bluetooth: hci1: command 0x0401 tx timeout 00:36:35 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:35 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1210.755584] Bluetooth: hci1: HCI_REQ-0x0401 00:36:35 executing program 5: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 2: pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 00:36:35 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:35 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) 00:36:35 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:35 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:35 executing program 2: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:35 executing program 2: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:35 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:35 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1211.586734] Bluetooth: hci1: HCI_REQ-0x0401 [ 1211.654085] Bluetooth: hci1: HCI_REQ-0x0401 [ 1211.657786] Bluetooth: hci1: HCI_REQ-0x0401 [ 1212.792914] Bluetooth: hci1: command 0x0401 tx timeout [ 1214.840843] Bluetooth: hci1: command 0x0401 tx timeout [ 1216.888842] Bluetooth: hci1: command 0x0401 tx timeout [ 1218.937024] Bluetooth: hci1: command 0x0401 tx timeout 00:36:50 executing program 2: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:50 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:50 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:36:50 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:50 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:50 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:50 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:50 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) getuid() [ 1226.737234] Bluetooth: hci1: HCI_REQ-0x0401 00:36:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, 0x0, 0x0, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:51 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:51 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:36:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:36:51 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:36:51 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1227.523446] Bluetooth: hci1: HCI_REQ-0x0401 [ 1227.525639] Bluetooth: hci1: HCI_REQ-0x0401 [ 1227.527902] Bluetooth: hci1: HCI_REQ-0x0401 [ 1228.792990] Bluetooth: hci1: command 0x0401 tx timeout [ 1230.840968] Bluetooth: hci1: command 0x0401 tx timeout [ 1232.888840] Bluetooth: hci1: command 0x0401 tx timeout [ 1234.936981] Bluetooth: hci1: command 0x0401 tx timeout 00:37:04 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:04 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:04 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:04 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:37:04 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1239.923363] Bluetooth: hci1: HCI_REQ-0x0401 00:37:04 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) getuid() 00:37:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:04 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:37:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240), 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:04 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:04 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:37:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:04 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:04 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1240.725875] Bluetooth: hci1: HCI_REQ-0x0401 [ 1240.747852] Bluetooth: hci1: HCI_REQ-0x0401 [ 1240.751858] Bluetooth: hci1: HCI_REQ-0x0401 [ 1241.976956] Bluetooth: hci1: command 0x0401 tx timeout [ 1244.024970] Bluetooth: hci1: command 0x0401 tx timeout [ 1246.072989] Bluetooth: hci1: command 0x0401 tx timeout [ 1248.150491] Bluetooth: hci1: command 0x0401 tx timeout [ 1254.101617] Bluetooth: hci1: HCI_REQ-0x0401 [ 1254.109389] Bluetooth: hci1: HCI_REQ-0x0401 00:37:18 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:37:18 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:18 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:18 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:37:18 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x0) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:18 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:18 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) getuid() 00:37:18 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:37:18 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:18 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:37:18 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:18 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1254.933196] Bluetooth: hci1: HCI_REQ-0x0401 [ 1254.938785] Bluetooth: hci1: HCI_REQ-0x0401 [ 1254.978492] Bluetooth: hci1: HCI_REQ-0x0401 [ 1256.120833] Bluetooth: hci1: command 0x0401 tx timeout [ 1258.168833] Bluetooth: hci1: command 0x0401 tx timeout [ 1260.217022] Bluetooth: hci1: command 0x0401 tx timeout [ 1262.265054] Bluetooth: hci1: command 0x0401 tx timeout [ 1264.313010] Bluetooth: hci1: command 0x0401 tx timeout 00:37:31 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:37:31 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:31 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:31 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:31 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:31 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(&(0x7f0000000400), 0x0) 00:37:31 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:31 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1267.033099] Bluetooth: hci1: HCI_REQ-0x0401 00:37:31 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:31 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(&(0x7f0000000400), 0x0) 00:37:31 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:31 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:31 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(&(0x7f0000000400), 0x0) 00:37:31 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:31 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:31 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) [ 1267.856080] Bluetooth: hci1: HCI_REQ-0x0401 [ 1267.857854] Bluetooth: hci1: HCI_REQ-0x0401 [ 1267.858713] Bluetooth: hci1: HCI_REQ-0x0401 [ 1269.049008] Bluetooth: hci1: command 0x0401 tx timeout [ 1271.096994] Bluetooth: hci1: command 0x0401 tx timeout [ 1273.145024] Bluetooth: hci1: command 0x0401 tx timeout [ 1275.193018] Bluetooth: hci1: command 0x0401 tx timeout 00:37:43 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:43 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) 00:37:43 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:43 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:43 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:43 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:37:43 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:37:43 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1279.427193] Bluetooth: hci1: HCI_REQ-0x0401 00:37:43 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) 00:37:43 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:37:44 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r7 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(r7, &(0x7f0000000380)=r8, 0x12) 00:37:44 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:44 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:44 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:37:44 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:44 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) [ 1280.252255] Bluetooth: hci1: HCI_REQ-0x0401 [ 1280.253320] Bluetooth: hci1: HCI_REQ-0x0401 [ 1280.255519] Bluetooth: hci1: HCI_REQ-0x0401 [ 1281.465274] Bluetooth: hci1: command 0x0401 tx timeout [ 1283.513415] Bluetooth: hci1: command 0x0401 tx timeout [ 1285.560922] Bluetooth: hci1: command 0x0401 tx timeout [ 1287.609062] Bluetooth: hci1: command 0x0401 tx timeout 00:37:56 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:56 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1292.065280] Bluetooth: hci1: HCI_REQ-0x0401 00:37:56 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:37:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:56 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:37:56 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) 00:37:56 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:56 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:56 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) 00:37:56 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:56 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:37:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:56 executing program 2: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) 00:37:56 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, 0x0, 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:37:56 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:37:56 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:37:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:37:56 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() [ 1292.895887] Bluetooth: hci1: HCI_REQ-0x0401 [ 1292.898697] Bluetooth: hci1: HCI_REQ-0x0401 [ 1294.072961] Bluetooth: hci1: command 0x0401 tx timeout [ 1296.120976] Bluetooth: hci1: command 0x0401 tx timeout [ 1298.168867] Bluetooth: hci1: command 0x0401 tx timeout 00:38:10 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:10 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:10 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:10 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:10 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:10 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:10 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1306.298231] Bluetooth: hci1: HCI_REQ-0x0401 00:38:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:10 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:10 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:10 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:10 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1307.119368] Bluetooth: hci1: HCI_REQ-0x0401 [ 1307.133781] Bluetooth: hci1: HCI_REQ-0x0401 [ 1308.344898] Bluetooth: hci1: command 0x0401 tx timeout [ 1310.392929] Bluetooth: hci1: command 0x0401 tx timeout [ 1312.440971] Bluetooth: hci1: command 0x0401 tx timeout 00:38:23 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:23 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:23 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:23 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1319.184038] Bluetooth: hci1: HCI_REQ-0x0401 00:38:23 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:23 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:23 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:23 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:23 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:23 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:23 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:23 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:23 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:23 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:23 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:23 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1320.017501] Bluetooth: hci1: HCI_REQ-0x0401 [ 1320.076625] Bluetooth: hci1: HCI_REQ-0x0401 [ 1320.079834] Bluetooth: hci1: HCI_REQ-0x0401 [ 1321.208878] Bluetooth: hci1: command 0x0401 tx timeout [ 1323.257899] Bluetooth: hci1: command 0x0401 tx timeout [ 1325.304985] Bluetooth: hci1: command 0x0401 tx timeout [ 1327.352893] Bluetooth: hci1: command 0x0401 tx timeout 00:38:36 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:36 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:36 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:36 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:36 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:36 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:36 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:36 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1332.679977] Bluetooth: hci1: HCI_REQ-0x0401 00:38:37 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:37 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:37 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:37 executing program 4: io_uring_setup(0x34e4, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:37 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:37 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:37 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:37 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:37 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:37 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:37 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1333.497811] Bluetooth: hci1: HCI_REQ-0x0401 [ 1333.501176] Bluetooth: hci1: HCI_REQ-0x0401 [ 1334.713135] Bluetooth: hci1: command 0x0401 tx timeout [ 1336.761027] Bluetooth: hci1: command 0x0401 tx timeout [ 1338.809012] Bluetooth: hci1: command 0x0401 tx timeout [ 1345.361622] Bluetooth: hci1: HCI_REQ-0x0401 00:38:49 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:49 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:49 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:38:49 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:49 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:49 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:38:49 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:49 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:38:49 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:38:49 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, 0x0) getuid() 00:38:49 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1}, 0x8, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:38:49 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:38:49 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:38:50 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:38:50 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1346.185702] Bluetooth: hci1: HCI_REQ-0x0401 [ 1346.194212] Bluetooth: hci1: HCI_REQ-0x0401 [ 1346.195818] Bluetooth: hci1: HCI_REQ-0x0401 [ 1347.384967] Bluetooth: hci1: command 0x0401 tx timeout [ 1349.432993] Bluetooth: hci1: command 0x0401 tx timeout [ 1351.480907] Bluetooth: hci1: command 0x0401 tx timeout [ 1353.528856] Bluetooth: hci1: command 0x0401 tx timeout 00:39:06 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:06 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:39:07 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:07 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:39:07 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:07 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:07 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1362.703412] Bluetooth: hci1: HCI_REQ-0x0401 00:39:07 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) fork() 00:39:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc830"}, 0x23, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:07 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) fork() 00:39:07 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:07 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:07 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) fork() 00:39:07 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:07 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) fork() [ 1363.538776] Bluetooth: hci1: HCI_REQ-0x0401 [ 1363.541796] Bluetooth: hci1: HCI_REQ-0x0401 [ 1364.728917] Bluetooth: hci1: command 0x0401 tx timeout [ 1366.776958] Bluetooth: hci1: command 0x0401 tx timeout [ 1368.824965] Bluetooth: hci1: command 0x0401 tx timeout 00:39:19 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:19 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:19 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:19 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:19 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:19 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) fork() 00:39:19 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, 0x0, 0x200000, 0x120) 00:39:19 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1375.010837] Bluetooth: hci1: HCI_REQ-0x0401 [ 1375.041252] Bluetooth: hci1: HCI_REQ-0x0401 00:39:19 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) fork() 00:39:19 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) 00:39:19 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:19 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:19 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b3"}, 0x30, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:19 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:19 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:39:19 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) fork() 00:39:20 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) 00:39:20 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1375.838866] Bluetooth: hci1: HCI_REQ-0x0401 [ 1375.856074] Bluetooth: hci1: HCI_REQ-0x0401 [ 1375.859536] Bluetooth: hci1: HCI_REQ-0x0401 [ 1377.016913] Bluetooth: hci1: command 0x0401 tx timeout [ 1379.064840] Bluetooth: hci1: command 0x0401 tx timeout [ 1381.112967] Bluetooth: hci1: command 0x0401 tx timeout [ 1383.161026] Bluetooth: hci1: command 0x0401 tx timeout [ 1385.208959] Bluetooth: hci1: command 0x0401 tx timeout 00:39:35 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) 00:39:35 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1391.154451] Bluetooth: hci1: HCI_REQ-0x0401 00:39:35 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:35 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) [ 1391.308888] Bluetooth: hci1: HCI_REQ-0x0401 [ 1391.353917] Bluetooth: hci1: HCI_REQ-0x0401 [ 1391.358574] Bluetooth: hci1: HCI_REQ-0x0401 00:39:35 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:35 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) 00:39:35 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:35 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:36 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) 00:39:36 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) 00:39:36 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:36 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c790"}, 0x37, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1392.037780] Bluetooth: hci1: HCI_REQ-0x0401 [ 1392.038320] Bluetooth: hci1: HCI_REQ-0x0401 [ 1392.041859] Bluetooth: hci1: HCI_REQ-0x0401 [ 1392.045787] Bluetooth: hci1: HCI_REQ-0x0401 00:39:36 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:36 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) 00:39:36 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:36 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:36 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:36 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:39:36 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1392.221181] Bluetooth: hci1: HCI_REQ-0x0401 [ 1393.019956] Bluetooth: hci1: HCI_REQ-0x0401 [ 1393.022678] Bluetooth: hci1: HCI_REQ-0x0401 [ 1393.236730] Bluetooth: hci1: command 0x0401 tx timeout [ 1395.256822] Bluetooth: hci1: command 0x0401 tx timeout [ 1397.304823] Bluetooth: hci1: command 0x0401 tx timeout [ 1399.352929] Bluetooth: hci1: command 0x0401 tx timeout [ 1401.400849] Bluetooth: hci1: command 0x0401 tx timeout [ 1403.448816] Bluetooth: hci1: command 0x0401 tx timeout [ 1405.496810] Bluetooth: hci1: command 0x0401 tx timeout 00:39:50 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:50 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:50 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:50 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:50 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1406.479655] Bluetooth: hci1: HCI_REQ-0x0401 00:39:50 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4", 0x32, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1406.487626] Bluetooth: hci1: HCI_REQ-0x0401 00:39:50 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) 00:39:50 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:50 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r0 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:50 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) pidfd_open(0xffffffffffffffff, 0x0) 00:39:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:39:51 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r0 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:39:51 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) epoll_create(0x400) pidfd_open(0xffffffffffffffff, 0x0) 00:39:51 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:39:51 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) pidfd_open(0xffffffffffffffff, 0x0) [ 1407.317305] Bluetooth: hci1: HCI_REQ-0x0401 [ 1407.356767] Bluetooth: hci1: HCI_REQ-0x0401 [ 1407.357215] Bluetooth: hci1: HCI_REQ-0x0401 [ 1407.561440] Bluetooth: hci1: command 0x0401 tx timeout [ 1409.592795] Bluetooth: hci1: command 0x0401 tx timeout [ 1411.640829] Bluetooth: hci1: command 0x0401 tx timeout [ 1413.688922] Bluetooth: hci1: command 0x0401 tx timeout [ 1415.736819] Bluetooth: hci1: command 0x0401 tx timeout [ 1417.784823] Bluetooth: hci1: command 0x0401 tx timeout 00:40:03 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:03 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:03 executing program 4: pidfd_open(0xffffffffffffffff, 0x0) 00:40:03 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:03 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:03 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:40:03 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) r0 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r1}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1418.950364] Bluetooth: hci1: HCI_REQ-0x0401 00:40:03 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:03 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e3654"}, 0x3c, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1419.032358] Bluetooth: hci1: HCI_REQ-0x0401 [ 1419.098012] Bluetooth: hci1: HCI_REQ-0x0401 [ 1419.827300] Bluetooth: hci1: HCI_REQ-0x0401 [ 1419.833926] Bluetooth: hci1: command 0x0401 tx timeout [ 1421.880822] Bluetooth: hci1: command 0x0401 tx timeout [ 1423.928811] Bluetooth: hci1: command 0x0401 tx timeout [ 1426.009538] Bluetooth: hci1: command 0x0401 tx timeout [ 1428.024971] Bluetooth: hci1: command 0x0401 tx timeout [ 1430.072961] Bluetooth: hci1: command 0x0401 tx timeout [ 1432.120937] Bluetooth: hci1: command 0x0401 tx timeout 00:40:17 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:40:17 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {0x0, 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1432.700141] Bluetooth: hci1: HCI_REQ-0x0401 00:40:17 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) 00:40:17 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:17 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:40:17 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f58", 0x1a, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, 0x0) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:40:17 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:17 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f58", 0x1a, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x9, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1433.286424] Bluetooth: hci0: HCI_REQ-0x0401 00:40:17 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:17 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:17 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1433.532829] Bluetooth: hci1: HCI_REQ-0x0401 [ 1433.533315] Bluetooth: hci1: HCI_REQ-0x0401 [ 1433.567801] Bluetooth: hci1: HCI_REQ-0x0401 [ 1433.571256] Bluetooth: hci1: HCI_REQ-0x0401 [ 1434.744923] Bluetooth: hci1: command 0x0401 tx timeout [ 1435.320832] Bluetooth: hci0: command 0x0401 tx timeout [ 1436.792831] Bluetooth: hci1: command 0x0401 tx timeout [ 1438.840832] Bluetooth: hci1: command 0x0401 tx timeout [ 1440.888876] Bluetooth: hci1: command 0x0401 tx timeout [ 1442.936836] Bluetooth: hci1: command 0x0401 tx timeout 00:40:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {0x0, 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf", 0x0, 0x9}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:40:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:30 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) [ 1445.983168] Bluetooth: hci1: HCI_REQ-0x0401 00:40:30 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1446.034942] Bluetooth: hci0: HCI_REQ-0x0401 00:40:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1446.321324] Bluetooth: hci0: HCI_REQ-0x0401 00:40:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:30 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:30 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:40:30 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\b', 0x1, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1446.584578] Bluetooth: hci0: HCI_REQ-0x0401 00:40:30 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) r1 = syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r1, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) [ 1446.741430] Bluetooth: hci0: HCI_REQ-0x0401 [ 1446.816788] Bluetooth: hci1: HCI_REQ-0x0401 [ 1446.817528] Bluetooth: hci1: HCI_REQ-0x0401 [ 1446.833783] Bluetooth: hci1: HCI_REQ-0x0401 [ 1446.836879] Bluetooth: hci1: HCI_REQ-0x0401 00:40:31 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {0x0, 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:31 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1446.922683] Bluetooth: hci1: HCI_REQ-0x0401 [ 1448.046826] Bluetooth: hci1: command 0x0401 tx timeout [ 1448.122991] Bluetooth: hci0: command 0x0401 tx timeout [ 1450.104845] Bluetooth: hci1: command 0x0401 tx timeout [ 1450.168829] Bluetooth: hci0: command 0x0401 tx timeout [ 1452.152829] Bluetooth: hci1: command 0x0401 tx timeout [ 1452.216878] Bluetooth: hci0: command 0x0401 tx timeout [ 1454.200887] Bluetooth: hci1: command 0x0401 tx timeout [ 1454.264899] Bluetooth: hci0: command 0x0401 tx timeout [ 1456.248847] Bluetooth: hci1: command 0x0401 tx timeout [ 1458.296918] Bluetooth: hci1: command 0x0401 tx timeout 00:40:44 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(0xffffffffffffffff, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:44 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:40:44 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:44 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:44 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:44 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:44 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:44 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) [ 1460.668583] Bluetooth: hci1: HCI_REQ-0x0401 [ 1460.701132] Bluetooth: hci0: HCI_REQ-0x0401 00:40:45 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, 0x0, 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1461.501557] Bluetooth: hci1: HCI_REQ-0x0401 [ 1461.502720] Bluetooth: hci1: HCI_REQ-0x0401 [ 1462.712830] Bluetooth: hci0: command 0x0401 tx timeout [ 1462.713325] Bluetooth: hci1: command 0x0401 tx timeout [ 1464.760823] Bluetooth: hci1: command 0x0401 tx timeout [ 1466.808937] Bluetooth: hci1: command 0x0401 tx timeout 00:40:57 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) 00:40:57 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:40:57 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, 0x0, 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:40:57 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1473.467270] Bluetooth: hci1: HCI_REQ-0x0401 [ 1473.485855] Bluetooth: hci0: HCI_REQ-0x0401 [ 1473.574566] Bluetooth: hci1: HCI_REQ-0x0401 00:40:57 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:40:57 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) 00:40:57 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1473.746167] Bluetooth: hci0: HCI_REQ-0x0401 00:40:58 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1474.328178] Bluetooth: hci1: HCI_REQ-0x0401 [ 1474.337048] Bluetooth: hci1: HCI_REQ-0x0401 [ 1475.512992] Bluetooth: hci0: command 0x0401 tx timeout [ 1475.514128] Bluetooth: hci1: command 0x0401 tx timeout [ 1477.560969] Bluetooth: hci1: command 0x0401 tx timeout [ 1477.562236] Bluetooth: hci0: command 0x0401 tx timeout [ 1479.608898] Bluetooth: hci1: command 0x0401 tx timeout [ 1481.657065] Bluetooth: hci1: command 0x0401 tx timeout 00:41:13 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f58", 0x1a, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, 0x0, 0x0) 00:41:13 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1488.768028] Bluetooth: hci1: HCI_REQ-0x0401 00:41:13 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, 0x0, 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1488.840206] Bluetooth: hci0: HCI_REQ-0x0401 00:41:13 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) pipe2(0x0, 0x0) [ 1489.015130] Bluetooth: hci0: HCI_REQ-0x0401 00:41:13 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:41:13 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f58", 0x1a, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1489.158097] Bluetooth: hci0: HCI_REQ-0x0401 00:41:13 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:13 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0, 0x0, 0x5}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:13 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x0, 0x0, "cd3cdf"}) 00:41:13 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1489.340618] Bluetooth: hci0: HCI_REQ-0x0401 00:41:13 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f58", 0x1a, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1489.599946] Bluetooth: hci1: HCI_REQ-0x0401 [ 1489.601067] Bluetooth: hci1: HCI_REQ-0x0401 [ 1490.808953] Bluetooth: hci1: command 0x0401 tx timeout [ 1490.873017] Bluetooth: hci0: command 0x0401 tx timeout [ 1492.856942] Bluetooth: hci1: command 0x0401 tx timeout [ 1492.921852] Bluetooth: hci0: command 0x0401 tx timeout [ 1494.904848] Bluetooth: hci1: command 0x0401 tx timeout [ 1494.968829] Bluetooth: hci0: command 0x0401 tx timeout [ 1497.016851] Bluetooth: hci0: command 0x0401 tx timeout 00:41:28 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:28 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:41:28 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1504.392679] Bluetooth: hci1: HCI_REQ-0x0401 00:41:28 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7", 0x1b, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 3: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 00:41:28 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f00000028c0)='\bp', 0x2}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:28 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:29 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:29 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:29 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:41:29 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:29 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) [ 1505.226284] Bluetooth: hci1: HCI_REQ-0x0401 [ 1505.228383] Bluetooth: hci1: HCI_REQ-0x0401 [ 1505.229369] Bluetooth: hci1: HCI_REQ-0x0401 [ 1505.230808] Bluetooth: hci1: HCI_REQ-0x0401 [ 1506.424920] Bluetooth: hci1: command 0x0401 tx timeout [ 1508.473088] Bluetooth: hci1: command 0x0401 tx timeout [ 1510.520861] Bluetooth: hci1: command 0x0401 tx timeout [ 1512.568923] Bluetooth: hci1: command 0x0401 tx timeout [ 1514.616848] Bluetooth: hci1: command 0x0401 tx timeout 00:41:43 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:43 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:41:43 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380), 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) [ 1518.945461] Bluetooth: hci1: HCI_REQ-0x0401 00:41:43 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:43 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:43 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:43 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x0) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:41:43 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}]}) 00:41:43 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) fork() [ 1519.770302] Bluetooth: hci1: HCI_REQ-0x0401 [ 1519.773766] Bluetooth: hci1: HCI_REQ-0x0401 [ 1519.774394] Bluetooth: hci1: HCI_REQ-0x0401 [ 1519.776986] Bluetooth: hci1: HCI_REQ-0x0401 [ 1520.952830] Bluetooth: hci1: command 0x0401 tx timeout [ 1523.000806] Bluetooth: hci1: command 0x0401 tx timeout [ 1525.048838] Bluetooth: hci1: command 0x0401 tx timeout [ 1527.096893] Bluetooth: hci1: command 0x0401 tx timeout [ 1529.144872] Bluetooth: hci1: command 0x0401 tx timeout 00:41:59 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}]}) 00:41:59 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380)=r8, 0x12) 00:41:59 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7", 0x1b, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:59 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:59 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:59 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:41:59 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:41:59 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x0, 0x120) [ 1535.649365] Bluetooth: hci1: HCI_REQ-0x0401 00:42:00 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) 00:42:00 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}]}) 00:42:00 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:00 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:42:00 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380)=r8, 0x12) 00:42:00 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:00 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}]}) 00:42:00 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) [ 1536.474206] Bluetooth: hci1: HCI_REQ-0x0401 [ 1536.475204] Bluetooth: hci1: HCI_REQ-0x0401 [ 1536.506269] Bluetooth: hci1: HCI_REQ-0x0401 [ 1537.656792] Bluetooth: hci1: command 0x0401 tx timeout [ 1539.704798] Bluetooth: hci1: command 0x0401 tx timeout [ 1541.752817] Bluetooth: hci1: command 0x0401 tx timeout [ 1543.800872] Bluetooth: hci1: command 0x0401 tx timeout 00:42:12 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7", 0x1b, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:12 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:12 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:12 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r8 = fork() write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000380)=r8, 0x12) 00:42:12 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:42:12 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@fowner_eq}]}) 00:42:12 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, 0x0, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r2}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:12 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1548.397895] Bluetooth: hci1: HCI_REQ-0x0401 00:42:12 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:12 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:12 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) [ 1548.593541] Bluetooth: hci1: HCI_REQ-0x0401 [ 1548.595779] Bluetooth: hci1: HCI_REQ-0x0401 00:42:12 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:12 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:13 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:13 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7", 0x1b, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:13 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@fowner_eq}]}) [ 1549.240770] Bluetooth: hci1: HCI_REQ-0x0401 [ 1549.251518] Bluetooth: hci1: HCI_REQ-0x0401 [ 1549.252430] Bluetooth: hci1: HCI_REQ-0x0401 [ 1550.456831] Bluetooth: hci1: command 0x0401 tx timeout [ 1552.504835] Bluetooth: hci1: command 0x0401 tx timeout [ 1554.552968] Bluetooth: hci1: command 0x0401 tx timeout [ 1556.600832] Bluetooth: hci1: command 0x0401 tx timeout [ 1558.648809] Bluetooth: hci1: command 0x0401 tx timeout [ 1560.696854] Bluetooth: hci1: command 0x0401 tx timeout 00:42:26 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:26 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) syz_open_dev$char_usb(0xc, 0xb4, 0x7) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:26 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295", 0xe, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:26 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:26 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:26 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, 0x0) 00:42:26 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@fowner_eq}]}) 00:42:26 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r1 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r1}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1562.438987] Bluetooth: hci1: HCI_REQ-0x0401 00:42:26 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:26 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) syz_open_dev$char_usb(0xc, 0xb4, 0x7) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:27 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:27 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) syz_open_dev$char_usb(0xc, 0xb4, 0x7) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:27 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:27 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@smackfstransmute}, {@dont_appraise}, {@fowner_eq}]}) 00:42:27 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:27 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, &(0x7f0000000380), 0x12) [ 1563.272654] Bluetooth: hci1: HCI_REQ-0x0401 [ 1563.273916] Bluetooth: hci1: HCI_REQ-0x0401 [ 1563.276772] Bluetooth: hci1: HCI_REQ-0x0401 [ 1564.473028] Bluetooth: hci1: command 0x0401 tx timeout [ 1566.520937] Bluetooth: hci1: command 0x0401 tx timeout [ 1568.568895] Bluetooth: hci1: command 0x0401 tx timeout [ 1570.617002] Bluetooth: hci1: command 0x0401 tx timeout 00:42:40 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1576.242017] Bluetooth: hci1: HCI_REQ-0x0401 00:42:40 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:40 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) syz_open_dev$char_usb(0xc, 0xb4, 0x7) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:40 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:40 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, &(0x7f0000000380), 0x12) 00:42:40 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:40 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:40 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@fowner_gt}, {@dont_appraise}, {@fowner_eq}]}) 00:42:40 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) pidfd_open(0xffffffffffffffff, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:40 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) syz_open_dev$char_usb(0xc, 0xb4, 0x7) 00:42:40 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@dont_appraise}, {@fowner_eq}]}) 00:42:40 executing program 1: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:40 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:40 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) 00:42:41 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, &(0x7f0000000380), 0x12) 00:42:41 executing program 1: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) epoll_create(0x400) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) [ 1577.072642] Bluetooth: hci1: HCI_REQ-0x0401 [ 1577.116695] Bluetooth: hci1: HCI_REQ-0x0401 [ 1578.296803] Bluetooth: hci1: command 0x0401 tx timeout [ 1580.344823] Bluetooth: hci1: command 0x0401 tx timeout [ 1582.396091] Bluetooth: hci1: command 0x0401 tx timeout 00:42:53 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:53 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) 00:42:53 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:53 executing program 3: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(r6, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() write$cgroup_pid(r8, 0x0, 0x0) 00:42:53 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@dont_appraise}, {@fowner_eq}]}) 00:42:53 executing program 1: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:53 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:53 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1589.193921] Bluetooth: hci1: HCI_REQ-0x0401 00:42:53 executing program 1: msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:42:53 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:42:53 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{0x0}, {&(0x7f00000028c0)='\bp', 0x2}], 0x0, &(0x7f0000002a80)={[], [{@dont_appraise}, {@fowner_eq}]}) 00:42:53 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:53 executing program 1: msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) 00:42:53 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:53 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) pidfd_open(0xffffffffffffffff, 0x0) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:42:53 executing program 1: msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) [ 1590.024321] Bluetooth: hci1: HCI_REQ-0x0401 [ 1590.025282] Bluetooth: hci1: HCI_REQ-0x0401 [ 1590.027795] Bluetooth: hci1: HCI_REQ-0x0401 00:42:54 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:42:54 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) [ 1591.224936] Bluetooth: hci1: command 0x0401 tx timeout [ 1593.273137] Bluetooth: hci1: command 0x0401 tx timeout [ 1595.321051] Bluetooth: hci1: command 0x0401 tx timeout [ 1597.369032] Bluetooth: hci1: command 0x0401 tx timeout [ 1604.520430] Bluetooth: hci1: HCI_REQ-0x0401 00:43:08 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) epoll_create(0x400) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:43:08 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0), 0x0, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 1: msgsnd(0xffffffffffffffff, 0x0, 0x0, 0x0) 00:43:08 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x0, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:08 executing program 4: signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:43:08 executing program 1: msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x0, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) 00:43:09 executing program 4: syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) 00:43:09 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:09 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f", 0x63, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:09 executing program 4: syz_open_dev$mouse(0x0, 0x1, 0x80) 00:43:09 executing program 1: msgsnd(0xffffffffffffffff, &(0x7f00000002c0), 0x8, 0x0) 00:43:09 executing program 4: syz_open_dev$mouse(0x0, 0x1, 0x80) 00:43:09 executing program 4: syz_open_dev$mouse(0x0, 0x1, 0x80) [ 1605.347601] Bluetooth: hci1: HCI_REQ-0x0401 [ 1605.352861] Bluetooth: hci1: HCI_REQ-0x0401 [ 1605.358188] Bluetooth: hci1: HCI_REQ-0x0401 [ 1605.380844] Bluetooth: hci1: HCI_REQ-0x0401 00:43:09 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:09 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:09 executing program 4: syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x80) 00:43:09 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) 00:43:09 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1605.437221] Bluetooth: hci1: HCI_REQ-0x0401 [ 1605.531694] Bluetooth: hci1: HCI_REQ-0x0401 [ 1605.609576] Bluetooth: hci1: HCI_REQ-0x0401 [ 1606.588348] Bluetooth: hci1: command 0x0401 tx timeout [ 1608.632817] Bluetooth: hci1: command 0x0401 tx timeout [ 1610.680903] Bluetooth: hci1: command 0x0401 tx timeout [ 1612.728886] Bluetooth: hci1: command 0x0401 tx timeout [ 1614.776914] Bluetooth: hci1: command 0x0401 tx timeout [ 1616.824902] Bluetooth: hci1: command 0x0401 tx timeout [ 1618.872830] Bluetooth: hci1: command 0x0401 tx timeout [ 1620.936870] Bluetooth: hci1: command 0x0401 tx timeout 00:43:25 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:25 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x0, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:25 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98e", 0x8, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:25 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:25 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1621.166122] Bluetooth: hci1: HCI_REQ-0x0401 00:43:25 executing program 4: syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x0) 00:43:25 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:25 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) [ 1621.241865] Bluetooth: hci1: HCI_REQ-0x0401 [ 1622.008854] Bluetooth: hci1: HCI_REQ-0x0401 [ 1622.016081] Bluetooth: hci1: HCI_REQ-0x0401 [ 1622.016965] Bluetooth: hci1: HCI_REQ-0x0401 [ 1622.050167] Bluetooth: hci1: HCI_REQ-0x0401 [ 1623.224978] Bluetooth: hci1: command 0x0401 tx timeout [ 1625.273026] Bluetooth: hci1: command 0x0401 tx timeout [ 1627.320879] Bluetooth: hci1: command 0x0401 tx timeout [ 1629.368864] Bluetooth: hci1: command 0x0401 tx timeout [ 1631.416887] Bluetooth: hci1: command 0x0401 tx timeout [ 1633.464940] Bluetooth: hci1: command 0x0401 tx timeout 00:43:38 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x0, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1633.909992] Bluetooth: hci1: HCI_REQ-0x0401 00:43:38 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7", 0x2, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) 00:43:38 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:43:38 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:43:38 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:43:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:43:38 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x1, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:38 executing program 2: syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) [ 1634.737390] Bluetooth: hci1: HCI_REQ-0x0401 [ 1634.789759] Bluetooth: hci1: HCI_REQ-0x0401 [ 1634.790213] Bluetooth: hci1: HCI_REQ-0x0401 [ 1634.793170] Bluetooth: hci1: HCI_REQ-0x0401 [ 1634.795776] Bluetooth: hci1: HCI_REQ-0x0401 [ 1635.960826] Bluetooth: hci1: command 0x0401 tx timeout [ 1638.008810] Bluetooth: hci1: command 0x0401 tx timeout [ 1640.056965] Bluetooth: hci1: command 0x0401 tx timeout [ 1642.104978] Bluetooth: hci1: command 0x0401 tx timeout [ 1644.152952] Bluetooth: hci1: command 0x0401 tx timeout [ 1646.201067] Bluetooth: hci1: command 0x0401 tx timeout 00:43:51 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:51 executing program 2: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:43:51 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:43:51 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:51 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:51 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:51 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() 00:43:51 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1647.557665] Bluetooth: hci1: HCI_REQ-0x0401 00:43:51 executing program 2: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:43:51 executing program 1: syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:43:52 executing program 2: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:43:52 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:52 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:43:52 executing program 1: syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:43:52 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:43:52 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x0, 0x0, 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1648.374403] Bluetooth: hci1: HCI_REQ-0x0401 [ 1648.376640] Bluetooth: hci1: HCI_REQ-0x0401 [ 1648.379394] Bluetooth: hci1: HCI_REQ-0x0401 [ 1648.414370] Bluetooth: hci1: HCI_REQ-0x0401 [ 1649.592931] Bluetooth: hci1: command 0x0401 tx timeout [ 1651.641949] Bluetooth: hci1: command 0x0401 tx timeout [ 1653.688922] Bluetooth: hci1: command 0x0401 tx timeout [ 1655.740209] Bluetooth: hci1: command 0x0401 tx timeout [ 1657.784828] Bluetooth: hci1: command 0x0401 tx timeout 00:44:07 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:44:07 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 1: syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:44:07 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 3: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() [ 1663.124768] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.227263] Bluetooth: hci1: HCI_REQ-0x0401 00:44:07 executing program 1: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:44:07 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 1: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:44:07 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, 0x0, 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:44:07 executing program 1: syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) 00:44:07 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:07 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1663.952533] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.953628] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.958132] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.973838] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.979302] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.980390] Bluetooth: hci1: HCI_REQ-0x0401 [ 1663.982457] Bluetooth: hci1: HCI_REQ-0x0401 00:44:08 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) getuid() 00:44:08 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xb0, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:08 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:08 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:08 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x0, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) 00:44:08 executing program 4: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) ioctl$LOOP_SET_FD(r4, 0x4c00, 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x5}}, './file0\x00'}) r5 = signalfd4(0xffffffffffffffff, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r5, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e"}, 0x3a, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) fork() 00:44:08 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:08 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1664.127120] Bluetooth: hci1: HCI_REQ-0x0401 [ 1664.247847] Bluetooth: hci1: HCI_REQ-0x0401 [ 1664.988662] Bluetooth: hci1: HCI_REQ-0x0401 [ 1664.990778] Bluetooth: hci1: HCI_REQ-0x0401 [ 1664.992775] Bluetooth: hci1: HCI_REQ-0x0401 [ 1664.993644] Bluetooth: hci1: HCI_REQ-0x0401 [ 1665.027439] Bluetooth: hci1: HCI_REQ-0x0401 [ 1665.189927] Bluetooth: hci1: command 0x0401 tx timeout [ 1667.192825] Bluetooth: hci1: command 0x0401 tx timeout [ 1669.240807] Bluetooth: hci1: command 0x0401 tx timeout [ 1671.288989] Bluetooth: hci1: command 0x0401 tx timeout [ 1673.336855] Bluetooth: hci1: command 0x0401 tx timeout [ 1675.384815] Bluetooth: hci1: command 0x0401 tx timeout [ 1677.432970] Bluetooth: hci1: command 0x0401 tx timeout 00:44:23 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xb0, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) 00:44:23 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 0: r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8, 0x800) r1 = epoll_create(0x400) pidfd_getfd(r0, r1, 0x0) r2 = pidfd_open(0xffffffffffffffff, 0x0) fsetxattr$security_selinux(r2, &(0x7f0000000040), &(0x7f0000000080)='system_u:object_r:modem_device_t:s0\x00', 0x24, 0x0) r3 = syz_open_dev$mouse(&(0x7f00000000c0), 0x1, 0x80) pidfd_send_signal(r3, 0x17, &(0x7f0000000100)={0x2d, 0x0, 0x2}, 0x0) r4 = openat$incfs(r0, &(0x7f0000000180)='.pending_reads\x00', 0x24000, 0x11) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x7) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r5, {0x5}}, './file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000200)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x2}}, './file0\x00'}) r7 = signalfd4(r6, &(0x7f0000000240)={[0x5]}, 0x8, 0x800) ioctl$LOOP_CLR_FD(0xffffffffffffffff, 0x4c01) openat$cgroup_procs(r7, &(0x7f0000000280)='tasks\x00', 0x2, 0x0) msgsnd(0xffffffffffffffff, &(0x7f00000002c0)={0x1, "3762130342b24834bb2db8cd17b6c53e37e91edab939fcc2cdc83067c482eccef764152a205992b31bb2f0ea28c79017b14e365491"}, 0x3d, 0x0) openat$autofs(0xffffffffffffff9c, &(0x7f0000000300), 0x10100, 0x0) r8 = openat$incfs(r4, &(0x7f0000000340)='.log\x00', 0x200000, 0x120) r9 = fork() write$cgroup_pid(r8, &(0x7f0000000380)=r9, 0x12) 00:44:23 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1679.073311] Bluetooth: hci1: HCI_REQ-0x0401 00:44:23 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:23 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1679.480815] Bluetooth: hci1: command 0x0401 tx timeout 00:44:23 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:24 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x0, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) getuid() [ 1679.895761] Bluetooth: hci1: HCI_REQ-0x0401 [ 1679.896424] Bluetooth: hci1: HCI_REQ-0x0401 00:44:24 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1679.928459] Bluetooth: hci1: HCI_REQ-0x0401 [ 1679.929847] Bluetooth: hci1: HCI_REQ-0x0401 00:44:24 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400), 0x0) [ 1679.939784] Bluetooth: hci1: HCI_REQ-0x0401 [ 1679.943803] Bluetooth: hci1: HCI_REQ-0x0401 [ 1679.944447] Bluetooth: hci1: HCI_REQ-0x0401 00:44:24 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xb0, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:24 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:24 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0), 0x0, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1680.040415] Bluetooth: hci1: HCI_REQ-0x0401 [ 1680.176098] Bluetooth: hci1: HCI_REQ-0x0401 [ 1680.850242] Bluetooth: hci1: HCI_REQ-0x0401 [ 1680.893765] Bluetooth: hci1: HCI_REQ-0x0401 [ 1681.528879] Bluetooth: hci1: command 0x0401 tx timeout [ 1683.576825] Bluetooth: hci1: command 0x0401 tx timeout [ 1685.624964] Bluetooth: hci1: command 0x0401 tx timeout [ 1687.672911] Bluetooth: hci1: command 0x0401 tx timeout [ 1689.720888] Bluetooth: hci1: command 0x0401 tx timeout [ 1691.768806] Bluetooth: hci1: command 0x0401 tx timeout [ 1693.816845] Bluetooth: hci1: command 0x0401 tx timeout [ 1695.864819] Bluetooth: hci1: command 0x0401 tx timeout 00:44:40 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 2: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) 00:44:40 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r4}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:40 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1696.603534] Bluetooth: hci1: HCI_REQ-0x0401 [ 1696.724887] Bluetooth: hci1: HCI_REQ-0x0401 00:44:41 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(&(0x7f0000002800), 0x0, 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1697.416776] Bluetooth: hci1: HCI_REQ-0x0401 [ 1697.424060] Bluetooth: hci1: HCI_REQ-0x0401 [ 1697.438933] Bluetooth: hci1: HCI_REQ-0x0401 [ 1697.441768] Bluetooth: hci1: HCI_REQ-0x0401 [ 1697.442483] Bluetooth: hci1: HCI_REQ-0x0401 00:44:41 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:44:41 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:41 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1697.577210] Bluetooth: hci1: HCI_REQ-0x0401 [ 1697.913799] Bluetooth: hci1: command 0x0401 tx timeout [ 1698.402991] Bluetooth: hci1: HCI_REQ-0x0401 [ 1698.405839] Bluetooth: hci1: HCI_REQ-0x0401 [ 1698.409052] Bluetooth: hci1: HCI_REQ-0x0401 [ 1698.414999] Bluetooth: hci1: HCI_REQ-0x0401 [ 1699.960827] Bluetooth: hci1: command 0x0401 tx timeout [ 1702.008798] Bluetooth: hci1: command 0x0401 tx timeout [ 1704.056850] Bluetooth: hci1: command 0x0401 tx timeout [ 1706.104868] Bluetooth: hci1: command 0x0401 tx timeout [ 1708.152844] Bluetooth: hci1: command 0x0401 tx timeout [ 1710.200801] Bluetooth: hci1: command 0x0401 tx timeout [ 1712.248820] Bluetooth: hci1: command 0x0401 tx timeout 00:44:58 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 1: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1713.899724] Bluetooth: hci1: HCI_REQ-0x0401 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1714.296792] Bluetooth: hci1: command 0x0401 tx timeout 00:44:58 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:44:58 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1714.732781] Bluetooth: hci1: HCI_REQ-0x0401 [ 1714.754891] Bluetooth: hci1: HCI_REQ-0x0401 [ 1714.756767] Bluetooth: hci1: HCI_REQ-0x0401 [ 1714.760608] Bluetooth: hci1: HCI_REQ-0x0401 [ 1714.805586] Bluetooth: hci1: HCI_REQ-0x0401 [ 1716.344815] Bluetooth: hci1: command 0x0401 tx timeout [ 1718.392809] Bluetooth: hci1: command 0x0401 tx timeout [ 1720.440864] Bluetooth: hci1: command 0x0401 tx timeout [ 1722.488808] Bluetooth: hci1: command 0x0401 tx timeout [ 1724.536815] Bluetooth: hci1: command 0x0401 tx timeout 00:45:10 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1726.280191] Bluetooth: hci1: HCI_REQ-0x0401 00:45:10 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:45:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:45:10 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:10 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1726.584784] Bluetooth: hci1: command 0x0401 tx timeout [ 1727.112363] Bluetooth: hci1: HCI_REQ-0x0401 [ 1727.154163] Bluetooth: hci1: HCI_REQ-0x0401 [ 1727.154814] Bluetooth: hci1: HCI_REQ-0x0401 [ 1728.632804] Bluetooth: hci1: command 0x0401 tx timeout [ 1730.680817] Bluetooth: hci1: command 0x0401 tx timeout [ 1732.728928] Bluetooth: hci1: command 0x0401 tx timeout [ 1734.776815] Bluetooth: hci1: command 0x0401 tx timeout [ 1736.824840] Bluetooth: hci1: command 0x0401 tx timeout [ 1738.872890] Bluetooth: hci1: command 0x0401 tx timeout [ 1740.983142] Bluetooth: hci1: command 0x0401 tx timeout 00:45:25 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x9}}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x25dfdbfd, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:45:25 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1741.291977] Bluetooth: hci1: HCI_REQ-0x0401 00:45:25 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:25 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1742.097100] Bluetooth: hci1: HCI_REQ-0x0401 [ 1742.100062] Bluetooth: hci1: HCI_REQ-0x0401 [ 1742.107807] Bluetooth: hci1: HCI_REQ-0x0401 [ 1743.032849] Bluetooth: hci1: command 0x0401 tx timeout [ 1745.080800] Bluetooth: hci1: command 0x0401 tx timeout [ 1747.128803] Bluetooth: hci1: command 0x0401 tx timeout [ 1749.176863] Bluetooth: hci1: command 0x0401 tx timeout [ 1751.224800] Bluetooth: hci1: command 0x0401 tx timeout [ 1753.272808] Bluetooth: hci1: command 0x0401 tx timeout 00:45:38 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:45:38 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x2, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1754.350141] Bluetooth: hci1: HCI_REQ-0x0401 00:45:38 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:38 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1755.166344] Bluetooth: hci1: HCI_REQ-0x0401 [ 1755.189765] Bluetooth: hci1: HCI_REQ-0x0401 [ 1755.190304] Bluetooth: hci1: HCI_REQ-0x0401 [ 1755.321170] Bluetooth: hci1: command 0x0401 tx timeout [ 1757.368773] Bluetooth: hci1: command 0x0401 tx timeout [ 1759.416803] Bluetooth: hci1: command 0x0401 tx timeout [ 1761.464827] Bluetooth: hci1: command 0x0401 tx timeout [ 1763.512806] Bluetooth: hci1: command 0x0401 tx timeout [ 1765.560806] Bluetooth: hci1: command 0x0401 tx timeout [ 1767.625676] Bluetooth: hci1: command 0x0401 tx timeout 00:45:52 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 4: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:45:52 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1768.074909] Bluetooth: hci1: HCI_REQ-0x0401 00:45:52 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 4: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:45:52 executing program 4: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1768.897603] Bluetooth: hci1: HCI_REQ-0x0401 [ 1768.898296] Bluetooth: hci1: HCI_REQ-0x0401 [ 1768.901814] Bluetooth: hci1: HCI_REQ-0x0401 [ 1769.656846] Bluetooth: hci1: command 0x0401 tx timeout [ 1771.704823] Bluetooth: hci1: command 0x0401 tx timeout [ 1773.752844] Bluetooth: hci1: command 0x0401 tx timeout [ 1775.800784] Bluetooth: hci1: command 0x0401 tx timeout [ 1777.912157] Bluetooth: hci1: command 0x0401 tx timeout [ 1779.960788] Bluetooth: hci1: command 0x0401 tx timeout [ 1782.008811] Bluetooth: hci1: command 0x0401 tx timeout 00:46:07 executing program 0: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xe4, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r0}, {0x8}]}]}, 0xe4}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r4 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r4}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 1: io_uring_setup(0x34e4, &(0x7f0000000040)) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 4: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 2: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 5: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:46:07 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1783.024898] Bluetooth: hci1: HCI_REQ-0x0401 00:46:07 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 1: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:07 executing program 4: io_uring_setup(0x0, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1783.824510] Bluetooth: hci1: HCI_REQ-0x0401 [ 1783.852087] Bluetooth: hci1: HCI_REQ-0x0401 [ 1783.854761] Bluetooth: hci1: HCI_REQ-0x0401 [ 1784.061856] Bluetooth: hci1: command 0x0401 tx timeout [ 1786.104811] Bluetooth: hci1: command 0x0401 tx timeout [ 1788.152822] Bluetooth: hci1: command 0x0401 tx timeout [ 1790.200898] Bluetooth: hci1: command 0x0401 tx timeout [ 1792.248792] Bluetooth: hci1: command 0x0401 tx timeout [ 1794.296808] Bluetooth: hci1: command 0x0401 tx timeout 00:46:19 executing program 7: io_uring_setup(0x34e4, &(0x7f0000000040)={0x0, 0x9e0b, 0x0, 0x3, 0xe6}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) pipe2(&(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000440)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) sendmsg$NBD_CMD_DISCONNECT(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f0000000480)={0xdc, r2, 0x800, 0x70bd2c, 0x0, {}, [@NBD_ATTR_TIMEOUT={0xc, 0x4, 0x8}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7ff}, @NBD_ATTR_SOCKETS={0x34, 0x7, 0x0, 0x1, [{0x8}, {0x8, 0x1, r0}, {0x8, 0x1, r3}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x7}, @NBD_ATTR_SOCKETS={0x3c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}, {0x8}]}, @NBD_ATTR_SOCKETS={0x2c, 0x7, 0x0, 0x1, [{0x8}, {0x8}, {0x8}, {0x8}, {0x8, 0x1, r4}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x40001}, 0x0) r5 = getuid() syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt={'fowner>', r5}}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 0: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 3: io_uring_setup(0x34e4, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 1: io_uring_setup(0x0, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 4: io_uring_setup(0x34e4, 0x0) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 5: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x9, "cd3cdf", 0x7, 0x9}) 00:46:19 executing program 6: pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000300)={0x1, 0x0, "cd3cdf", 0x7}) syz_genetlink_get_family_id$nbd(&(0x7f00000003c0), 0xffffffffffffffff) syz_mount_image$nfs(&(0x7f0000002800), &(0x7f0000002840)='./file0\x00', 0x0, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {0x0, 0x0, 0x9}, {&(0x7f00000029c0)='5', 0x1}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1795.302546] Bluetooth: hci1: HCI_REQ-0x0401 00:46:19 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 1: io_uring_setup(0x0, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 2: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 4: io_uring_setup(0x34e4, 0x0) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 1: io_uring_setup(0x0, &(0x7f0000000040)) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 2: io_uring_setup(0x0, &(0x7f0000000040)) pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 1: io_uring_setup(0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) 00:46:19 executing program 3: pipe2(0x0, 0x0) syz_mount_image$nfs(0x0, &(0x7f0000002840)='./file0\x00', 0x6, 0x3, &(0x7f0000002a00)=[{&(0x7f0000002880), 0x0, 0x5}, {&(0x7f00000028c0)="0870dc9807906ce6f1def84adf02ad9340f29c2ff496cdf79f5894fe7ae3e285ad4b73642c256cb5ded319b7858f3a8674a4897d112e9cd33505edea792d117b6b4157b1f23ce615698aa07059d859160d8ddc2392f32a8f46eda001b6b0b84d85da6f4a833fd0effe1a0bbc0e2f269ed59ebe8e33b7ffc03e6a209810775fbcbdb32b3954c8fce74b66cf029da8f93d100b87b94ea9c48edd6ad2ac238d98ff0a73e0a334d1a2b94ecca8473ae28c04c47fe3c3123205688dd1e2480cb9274cdfb36f054adf", 0xc6, 0x9}, {&(0x7f00000029c0)="35c7b38fc2fcb98ebdce5fe72295a2a3241ab843191b3b30c3fab7dcc1a30264b79760c058b64aa4dceffb03d0345c592f3e666fca0e", 0x36, 0x7}], 0x1010010, &(0x7f0000002a80)={[{'\x00'}], [{@fowner_gt}, {@smackfstransmute}, {@subj_type={'subj_type', 0x3d, '\xb0\x80s\xe8\xd4N\x91\xe3\xda\x92,\"C\x82D\xbb\x88\\i\xe2i\xc8\xe9\xd85\xb1\x14):M\xdcn'}}, {@dont_appraise}, {@fowner_eq}, {@dont_hash}]}) [ 1796.132761] Bluetooth: hci1: HCI_REQ-0x0401 [ 1796.141763] Bluetooth: hci1: HCI_REQ-0x0401 [ 1796.142562] Bluetooth: hci1: HCI_REQ-0x0401 [ 1796.380332] Bluetooth: hci1: command 0x0401 tx timeout [ 1796.631589] ================================================================== [ 1796.632600] BUG: KASAN: use-after-free in __lock_acquire+0x42c9/0x5e70 [ 1796.633475] Read of size 8 at addr ffff88800ec541c8 by task syz-executor/50739 [ 1796.634423] [ 1796.634661] CPU: 1 PID: 50739 Comm: syz-executor Not tainted 6.0.0-rc5-next-20220916 #1 [ 1796.635714] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 1796.637159] Call Trace: [ 1796.637501] [ 1796.637812] dump_stack_lvl+0x8b/0xb3 [ 1796.638329] print_report+0x172/0x475 [ 1796.638852] ? __lock_acquire+0x42c9/0x5e70 [ 1796.639433] kasan_report+0xbb/0x1c0 [ 1796.639936] ? __lock_acquire+0x42c9/0x5e70 [ 1796.640511] __lock_acquire+0x42c9/0x5e70 [ 1796.641077] ? lock_chain_count+0x20/0x20 [ 1796.641631] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 1796.642327] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 1796.643025] ? finish_task_switch.isra.0+0x22d/0x8a0 [ 1796.643703] lock_acquire+0x1a2/0x530 [ 1796.644221] ? kmemleak_scan+0x21d/0x16f0 [ 1796.644767] ? rcu_read_unlock+0x40/0x40 [ 1796.645305] ? mark_held_locks+0x9e/0xe0 [ 1796.645851] ? call_rcu+0x589/0xa30 [ 1796.646340] ? call_rcu+0x589/0xa30 [ 1796.646841] ? _raw_spin_lock_irq+0x41/0x50 [ 1796.647437] _raw_spin_lock_irq+0x32/0x50 [ 1796.647977] ? kmemleak_scan+0x21d/0x16f0 [ 1796.648762] kmemleak_scan+0x21d/0x16f0 [ 1796.649836] ? paint_ptr+0xc0/0xc0 [ 1796.650705] ? strncpy_from_user+0x204/0x3e0 [ 1796.651320] kmemleak_write+0x570/0x680 [ 1796.651850] ? kmemleak_scan+0x16f0/0x16f0 [ 1796.652412] ? debugfs_file_get+0x1ce/0x450 [ 1796.652980] ? debugfs_file_put+0xd0/0xd0 [ 1796.653532] full_proxy_write+0x11d/0x190 [ 1796.654083] vfs_write+0x2cb/0xd90 [ 1796.654569] ? full_proxy_poll+0x180/0x180 [ 1796.655147] ? __ia32_sys_pread64+0x220/0x220 [ 1796.655753] ? lock_release+0x3b2/0x750 [ 1796.656289] ? __up_read+0x192/0x730 [ 1796.656789] ? handle_mm_fault+0x6fd/0xa20 [ 1796.657342] ? up_write+0x480/0x480 [ 1796.657830] ? __fget_light+0x212/0x280 [ 1796.658370] ksys_write+0x127/0x250 [ 1796.658878] ? __ia32_sys_read+0xb0/0xb0 [ 1796.659424] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1796.660105] ? syscall_enter_from_user_mode+0x1d/0x50 [ 1796.660794] do_syscall_64+0x3b/0x90 [ 1796.661298] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1796.661982] RIP: 0033:0x7f609a8d35c3 [ 1796.662473] Code: 16 00 00 00 eb ae 90 b8 6e 00 00 00 eb a6 e8 44 ef 04 00 0f 1f 40 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 1796.664817] RSP: 002b:00007ffcbd728c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1796.665880] RAX: ffffffffffffffda RBX: 00007ffcbd729278 RCX: 00007f609a8d35c3 [ 1796.666812] RDX: 0000000000000004 RSI: 00007f609a989ed9 RDI: 0000000000000003 [ 1796.667728] RBP: 0000000000000002 R08: 0000000000000704 R09: 00007ffcbd793080 [ 1796.668653] R10: 00007ffcbd793090 R11: 0000000000000246 R12: 00000000fffffff6 [ 1796.669573] R13: 00007ffcbd72aef1 R14: 0000000000000000 R15: 00000000001b67dc [ 1796.670514] [ 1796.670838] [ 1796.671066] Allocated by task 127: [ 1796.671530] kasan_save_stack+0x1e/0x40 [ 1796.672069] kasan_set_track+0x21/0x30 [ 1796.672593] __kasan_slab_alloc+0x58/0x70 [ 1796.673149] kmem_cache_alloc+0x1b1/0x3e0 [ 1796.673700] __create_object+0x3d/0xc10 [ 1796.674262] kmem_cache_alloc+0x23c/0x3e0 [ 1796.674858] __alloc_file+0x21/0x240 [ 1796.675378] alloc_empty_file+0x6d/0x170 [ 1796.675950] path_openat+0xd4/0x2800 [ 1796.676477] do_filp_open+0x1b6/0x410 [ 1796.677013] do_sys_openat2+0x171/0x4c0 [ 1796.677564] __x64_sys_openat+0x13f/0x1f0 [ 1796.678150] do_syscall_64+0x3b/0x90 [ 1796.678676] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1796.679397] [ 1796.679642] Freed by task 13: [ 1796.680082] kasan_save_stack+0x1e/0x40 [ 1796.680650] kasan_set_track+0x21/0x30 [ 1796.681201] kasan_save_free_info+0x2a/0x50 [ 1796.681801] __kasan_slab_free+0x106/0x190 [ 1796.682391] kmem_cache_free+0xf7/0x610 [ 1796.682952] rcu_core+0x7e2/0x2080 [ 1796.683448] __do_softirq+0x1c8/0x8d0 [ 1796.683973] [ 1796.684209] Last potentially related work creation: [ 1796.684879] kasan_save_stack+0x1e/0x40 [ 1796.685427] __kasan_record_aux_stack+0x95/0xb0 [ 1796.686081] call_rcu+0x6a/0xa30 [ 1796.686559] kmem_cache_free+0xbd/0x610 [ 1796.687122] rcu_core+0x7e2/0x2080 [ 1796.687621] __do_softirq+0x1c8/0x8d0 [ 1796.688145] [ 1796.688386] Second to last potentially related work creation: [ 1796.689168] kasan_save_stack+0x1e/0x40 [ 1796.689726] __kasan_record_aux_stack+0x95/0xb0 [ 1796.690381] call_rcu+0x6a/0xa30 [ 1796.690865] kmem_cache_free+0xbd/0x610 [ 1796.691416] security_file_free+0xaa/0xd0 [ 1796.691996] __fput+0x3db/0xa40 [ 1796.692455] task_work_run+0x170/0x280 [ 1796.693001] exit_to_user_mode_prepare+0x199/0x1a0 [ 1796.693682] syscall_exit_to_user_mode+0x19/0x40 [ 1796.694345] do_syscall_64+0x48/0x90 [ 1796.694887] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 1796.695606] [ 1796.695848] The buggy address belongs to the object at ffff88800ec541b0 [ 1796.695848] which belongs to the cache kmemleak_object of size 368 [ 1796.697514] The buggy address is located 24 bytes inside of [ 1796.697514] 368-byte region [ffff88800ec541b0, ffff88800ec54320) [ 1796.699039] [ 1796.699266] The buggy address belongs to the physical page: [ 1796.700016] page:00000000596faf41 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xec54 [ 1796.701262] head:00000000596faf41 order:1 compound_mapcount:0 compound_pincount:0 [ 1796.702289] flags: 0x100000000010200(slab|head|node=0|zone=1) [ 1796.703109] raw: 0100000000010200 dead000000000100 dead000000000122 ffff888007c4f780 [ 1796.704170] raw: 0000000000000000 0000000000120012 00000001ffffffff 0000000000000000 [ 1796.705212] page dumped because: kasan: bad access detected [ 1796.705974] [ 1796.706210] Memory state around the buggy address: [ 1796.706890] ffff88800ec54080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1796.707873] ffff88800ec54100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc [ 1796.708845] >ffff88800ec54180: fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb fb [ 1796.709818] ^ [ 1796.710573] ffff88800ec54200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1796.711550] ffff88800ec54280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1796.712528] ================================================================== [ 1796.713499] Disabling lock debugging due to kernel taint VM DIAGNOSIS: 00:46:21 Registers: info registers vcpu 0 RAX=ffffffff84261cc0 RBX=ffffffff85232980 RCX=ffffffff84243b52 RDX=0000000000000000 RSI=0000000000000001 RDI=0000000000000000 RBP=0000000000000000 RSP=ffffffff85207e18 R8 =0000000000000001 R9 =ffff88806ce33b63 R10=ffffed100d9c676c R11=0000000000000001 R12=fffffbfff0a46530 R13=ffffffff85b02f10 R14=0000000000000000 R15=dffffc0000000000 RIP=ffffffff84261ccb RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000000000000000 00000000 00000000 GS =0000 ffff88806ce00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=000056449685a7f0 CR3=000000000f1bc000 CR4=00350ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 6576652d7372656b 726f772d6c6c696b YMM02=0000000000000000 0000000000000000 0000000000000000 00000000000000ff YMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM05=0000000000000000 0000000000000000 0000000600000003 000056449688a030 YMM06=0000000000000000 0000000000000000 00005644968819e0 0000000900000004 YMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM08=0000000000000000 0000000000000000 2064616572206f74 2064656c69614600 YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 RAX=0000000000000069 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff822b3251 RDI=ffffffff87641ba0 RBP=ffffffff87641b60 RSP=ffff8880388cf250 R8 =0000000000000001 R9 =000000000000000a R10=0000000000000069 R11=0000000000000001 R12=0000000000000069 R13=ffffffff87641b60 R14=0000000000000010 R15=ffffffff822b3240 RIP=ffffffff822b32a9 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 00000000 00000000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 00000000 00000000 FS =0000 0000555556f1b400 00000000 00000000 GS =0000 ffff88806cf00000 00000000 00000000 LDT=0000 fffffe0000000000 00000000 00000000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00007f00c1be8344 CR3=00000000384d6000 CR4=00350ee0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM01=0000000000000000 0000000000000000 ffffffff00000006 0000564496889370 YMM02=0000000000000000 0000000000000000 ffffff0f0e0d0c0b 0a09080706050403 YMM03=0000000000000000 0000000000000000 696e656420737365 636341002f737973 YMM04=0000000000000000 0000000000000000 323d44455a494c41 4954494e495f4345 YMM05=0000000000000000 0000000000000000 3d5145534b534944 006b7369643d4550 YMM06=0000000000000000 0000000000000000 3d454d414e564544 00303d444955555f YMM07=0000000000000000 0000000000000000 5953425553003470 6f6f6c2f6b636f6c YMM08=0000000000000000 0000000000000000 49006d756e203c20 69000a313a56000a YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000