program:
r0 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
socket$nl_generic(0x10, 0x3, 0x10) (async)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$IPVS_CMD_NEW_SERVICE(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000080)={0x50, r0, 0x1, 0x70bd2b, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_SCHED_NAME={0xa, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x64}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}]}]}, 0x50}}, 0x0)
socket$inet6(0xa, 0x3, 0x5) (async)
r2 = socket$inet6(0xa, 0x3, 0x5)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r1) (async)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), r1)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm/cluster1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00', 0x1ff)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./config/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0)
write(r3, &(0x7f0000000200)='0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 0x80)
mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000300)='./debug\x00', &(0x7f0000000340)='debugfs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./debug/dlm/comms/1/rawmsg\x00', 0x1, 0x0)
write(r4, &(0x7f0000000400)='\x00'/16, 0x10)
rmdir(&(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00') (async)
rmdir(&(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00')
sendmmsg(r2, &(0x7f0000002c00)=[{{&(0x7f0000000340)=@l2tp6={0xa, 0x500, 0x0, @dev}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0)
[ 101.993478][ T4645] Bluetooth: hci0: command tx timeout
[ 102.098070][ T5327] dlm: closing connection to node 1
[ 102.099069][ T45] IPVS: starting estimator thread 0...
[ 102.099943][ T5327] dlm: io handling for node: 1 stopped
[ 102.100118][ T5327] dlm: closing connection to node 1 done
[ 102.120644][ T5329] dlm: closing connection to node 1
[ 102.120912][ T5329] ------------[ cut here ]------------
[ 102.120920][ T5329] !con
[ 102.120925][ T5329] WARNING: fs/dlm/lowcomms.c:1455 at dlm_lowcomms_close+0x12d/0x440, CPU#0: syz.0.0/5329
[ 102.132285][ T5329] Modules linked in:
[ 102.134790][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.138866][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.143572][ T5329] RIP: 0010:dlm_lowcomms_close+0x12d/0x440
[ 102.146344][ T5329] Code: 99 5e 9f 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 52 fd 10 01 eb a2 e8 7b 5e 9f 00 eb 05 e8 74 5e 9f 00 90 <0f> 0b 90 44 89 f7 e8 c8 61 5a 01 b8 fe ff ff ff 48 83 c4 20 5b 41
[ 102.155365][ T5329] RSP: 0018:ffffc9000e2efc40 EFLAGS: 00010293
[ 102.158458][ T5329] RAX: ffffffff81287d45 RBX: 0000000000000001 RCX: ffff888000478000
[ 102.162138][ T5329] RDX: 0000000000000000 RSI: ffffffff8e69fddc RDI: ffffffff8c6dc080
[ 102.165874][ T5329] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff96bb8430
[ 102.169069][ T5329] R10: 000000008b48b9ca R11: 00000000676fce14 R12: 0000000000000000
[ 102.172681][ T5329] R13: ffffffff81287c78 R14: 0000000000000001 R15: 0000000000000000
[ 102.176147][ T5329] FS: 00007f3633cb66c0(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000
[ 102.180270][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 102.183530][ T5329] CR2: 00007f3632ff36b8 CR3: 00000000430af000 CR4: 0000000000352ef0
[ 102.187128][ T5329] Call Trace:
[ 102.188713][ T5329]
[ 102.190154][ T5329] ? dlm_midcomms_close+0x3a9/0x4c0
[ 102.192435][ T5329] ? dlm_midcomms_close+0x4b/0x4c0
[ 102.194672][ T5329] drop_comm+0x61/0x190
[ 102.196629][ T5329] ? configfs_rmdir+0x850/0x950
[ 102.198874][ T5329] ? __pfx_drop_comm+0x10/0x10
[ 102.201344][ T5329] configfs_rmdir+0x85f/0x950
[ 102.203526][ T5329] vfs_rmdir+0x3e6/0x6a0
[ 102.205443][ T5329] ? bpf_lsm_path_rmdir+0x9/0x20
[ 102.207685][ T5329] filename_rmdir+0x292/0x520
[ 102.210014][ T5329] ? __pfx_filename_rmdir+0x10/0x10
[ 102.212262][ T5329] ? do_getname+0x151/0x250
[ 102.213986][ T5329] __se_sys_rmdir+0x2e/0x140
[ 102.215982][ T5329] do_syscall_64+0x166/0x520
[ 102.218214][ T5329] ? trace_irq_disable+0x3b/0x140
[ 102.220695][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.223458][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 102.225588][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.228286][ T5329] RIP: 0033:0x7f3632d9e159
[ 102.230480][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.238459][ T5329] RSP: 002b:00007f3633cb5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[ 102.242131][ T5329] RAX: ffffffffffffffda RBX: 00007f3633026180 RCX: 00007f3632d9e159
[ 102.245735][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140
[ 102.249059][ T5329] RBP: 00007f3632e3503b R08: 0000000000000000 R09: 0000000000000000
[ 102.253029][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.256913][ T5329] R13: 00007f3633026218 R14: 00007f3633026180 R15: 00007ffc04eafda8
[ 102.260692][ T5329]
[ 102.262106][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 102.265445][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.269479][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.273959][ T5329] Call Trace:
[ 102.275447][ T5329]
[ 102.276683][ T5329] vpanic+0x56d/0xa60
[ 102.278283][ T5329] ? __pfx__printk+0x10/0x10
[ 102.280425][ T5329] ? __pfx_vpanic+0x10/0x10
[ 102.282368][ T5329] ? is_bpf_text_address+0x292/0x2b0
[ 102.284627][ T5329] ? is_bpf_text_address+0x26/0x2b0
[ 102.286773][ T5329] panic+0xc5/0xd0
[ 102.288281][ T5329] ? __pfx_panic+0x10/0x10
[ 102.290271][ T5329] __warn+0x315/0x4c0
[ 102.292125][ T5329] ? dlm_lowcomms_close+0x12d/0x440
[ 102.294490][ T5329] ? dlm_lowcomms_close+0x12d/0x440
[ 102.296880][ T5329] __report_bug+0x276/0x570
[ 102.299006][ T5329] ? check_path+0x21/0x40
[ 102.301043][ T5329] ? dlm_lowcomms_close+0x12d/0x440
[ 102.303446][ T5329] ? __pfx___report_bug+0x10/0x10
[ 102.305748][ T5329] ? lockdep_unlock+0x5c/0xd0
[ 102.307774][ T5329] ? __lock_acquire+0x1511/0x2de0
[ 102.310001][ T5329] ? dlm_lowcomms_close+0x12d/0x440
[ 102.312337][ T5329] report_bug+0x16b/0x220
[ 102.314313][ T5329] ? dlm_lowcomms_close+0x12d/0x440
[ 102.316710][ T5329] ? dlm_lowcomms_close+0x12f/0x440
[ 102.319068][ T5329] handle_bug+0x9c/0x200
[ 102.321041][ T5329] exc_invalid_op+0x1a/0x50
[ 102.323126][ T5329] asm_exc_invalid_op+0x1a/0x20
[ 102.325320][ T5329] RIP: 0010:dlm_lowcomms_close+0x12d/0x440
[ 102.327734][ T5329] Code: 99 5e 9f 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 52 fd 10 01 eb a2 e8 7b 5e 9f 00 eb 05 e8 74 5e 9f 00 90 <0f> 0b 90 44 89 f7 e8 c8 61 5a 01 b8 fe ff ff ff 48 83 c4 20 5b 41
[ 102.335931][ T5329] RSP: 0018:ffffc9000e2efc40 EFLAGS: 00010293
[ 102.338642][ T5329] RAX: ffffffff81287d45 RBX: 0000000000000001 RCX: ffff888000478000
[ 102.341916][ T5329] RDX: 0000000000000000 RSI: ffffffff8e69fddc RDI: ffffffff8c6dc080
[ 102.345204][ T5329] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff96bb8430
[ 102.348529][ T5329] R10: 000000008b48b9ca R11: 00000000676fce14 R12: 0000000000000000
[ 102.351794][ T5329] R13: ffffffff81287c78 R14: 0000000000000001 R15: 0000000000000000
[ 102.355221][ T5329] ? dlm_lowcomms_close+0x58/0x440
[ 102.357502][ T5329] ? dlm_lowcomms_close+0x125/0x440
[ 102.359804][ T5329] ? dlm_midcomms_close+0x3a9/0x4c0
[ 102.362162][ T5329] ? dlm_midcomms_close+0x4b/0x4c0
[ 102.364531][ T5329] drop_comm+0x61/0x190
[ 102.366466][ T5329] ? configfs_rmdir+0x850/0x950
[ 102.368752][ T5329] ? __pfx_drop_comm+0x10/0x10
[ 102.371002][ T5329] configfs_rmdir+0x85f/0x950
[ 102.373149][ T5329] vfs_rmdir+0x3e6/0x6a0
[ 102.375058][ T5329] ? bpf_lsm_path_rmdir+0x9/0x20
[ 102.377392][ T5329] filename_rmdir+0x292/0x520
[ 102.379596][ T5329] ? __pfx_filename_rmdir+0x10/0x10
[ 102.381942][ T5329] ? do_getname+0x151/0x250
[ 102.384060][ T5329] __se_sys_rmdir+0x2e/0x140
[ 102.386182][ T5329] do_syscall_64+0x166/0x520
[ 102.388331][ T5329] ? trace_irq_disable+0x3b/0x140
[ 102.390611][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.393319][ T5329] ? clear_bhb_loop+0x70/0xc0
[ 102.395615][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.398376][ T5329] RIP: 0033:0x7f3632d9e159
[ 102.400461][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.409079][ T5329] RSP: 002b:00007f3633cb5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[ 102.412920][ T5329] RAX: ffffffffffffffda RBX: 00007f3633026180 RCX: 00007f3632d9e159
[ 102.416523][ T5329] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140
[ 102.420173][ T5329] RBP: 00007f3632e3503b R08: 0000000000000000 R09: 0000000000000000
[ 102.423744][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.427386][ T5329] R13: 00007f3633026218 R14: 00007f3633026180 R15: 00007ffc04eafda8
[ 102.430967][ T5329]
[ 102.432852][ T5329] Kernel Offset: disabled
[ 102.434855][ T5329] Rebooting in 86400 seconds..