program: r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e22, 0x400082, @dev={0xfe, 0x80, '\x00', 0x31}, 0xc7}, 0x1c) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) (async) mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config/dlm/cluster1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00', 0x1ff) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./config\x00', 0x200001, 0x131) mkdir(&(0x7f0000000100)='./debug\x00', 0x0) write(r2, &(0x7f0000000200)='0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 0x80) (async) write(r2, &(0x7f0000000200)='0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 0x80) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./debug\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000300)='./debug\x00', &(0x7f0000000340)='debugfs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./debug/dlm/comms/1/rawmsg\x00', 0x1, 0x0) write(r3, &(0x7f0000000400)='\x00'/16, 0x10) rmdir(&(0x7f0000000140)='./config/dlm/cluster1/comms/1\x00') ioctl(r1, 0x8b2c, &(0x7f0000000040)) (async) ioctl(r1, 0x8b2c, &(0x7f0000000040)) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) (async) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x8, &(0x7f0000000300)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r4}, @generic={0xb7, 0x3, 0x0, 0x0, 0xfffffc00}, @generic={0xbf, 0x4, 0xa}, @generic={0x7, 0x4, 0x0, 0x0, 0xfffffff8}, @generic={0xb7, 0x5}, @generic={0x85, 0x0, 0x0, 0x0, 0x19}, @generic={0x95}], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r5, r4}, 0xc) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r3, 0xc0406618, &(0x7f0000000180)={@desc={0x1, 0x0, @desc2}}) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f00000011c0)={0x0, "2a27d66f1190ec3c8977d7fd5914ae63"}) (async) ioctl$BTRFS_IOC_DEV_INFO(r0, 0xd000941e, &(0x7f00000011c0)={0x0, "2a27d66f1190ec3c8977d7fd5914ae63"}) ioctl$BTRFS_IOC_SCRUB(r1, 0xc400941b, &(0x7f00000021c0)={r6, 0xfd, 0xffc0}) sendto$inet6(r0, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000003440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000f80)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0x1c, 0x0, 0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="14a80da87ca76c9ef679f300000000000000290000003600"], 0x14}}], 0x2, 0x40000000) (async) sendmmsg$inet6(r0, &(0x7f0000003440)=[{{0x0, 0x0, 0x0}}, {{&(0x7f0000000f80)={0xa, 0x4e21, 0x0, @empty, 0x3}, 0x1c, 0x0, 0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="14a80da87ca76c9ef679f300000000000000290000003600"], 0x14}}], 0x2, 0x40000000) [ 94.981837][ T5285] Bluetooth: hci0: command tx timeout [ 95.281008][ T5322] dlm: closing connection to node 1 [ 95.281734][ T5322] ------------[ cut here ]------------ [ 95.281742][ T5322] !con [ 95.281747][ T5322] WARNING: fs/dlm/lowcomms.c:1455 at dlm_lowcomms_close+0x12d/0x440, CPU#0: syz.0.0/5322 [ 95.291638][ T5322] Modules linked in: [ 95.293575][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.297281][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.302121][ T5322] RIP: 0010:dlm_lowcomms_close+0x12d/0x440 [ 95.304990][ T5322] Code: 99 5e 9f 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 52 fd 10 01 eb a2 e8 7b 5e 9f 00 eb 05 e8 74 5e 9f 00 90 <0f> 0b 90 44 89 f7 e8 c8 61 5a 01 b8 fe ff ff ff 48 83 c4 20 5b 41 [ 95.313746][ T5322] RSP: 0018:ffffc9000f73fc40 EFLAGS: 00010293 [ 95.316687][ T5322] RAX: ffffffff81287d45 RBX: 0000000000000001 RCX: ffff88801261a580 [ 95.320229][ T5322] RDX: 0000000000000000 RSI: ffffffff8e702f39 RDI: ffffffff8c6dbc80 [ 95.323770][ T5322] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff96bb7068 [ 95.327222][ T5322] R10: 00000000b8a5a85b R11: 00000000296d98fe R12: 0000000000000000 [ 95.330670][ T5322] R13: ffffffff81287c78 R14: 0000000000000000 R15: 0000000000000000 [ 95.333652][ T5322] FS: 00007f04b3b496c0(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000 [ 95.337376][ T5322] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 95.340288][ T5322] CR2: 00007f04b2df22e0 CR3: 0000000042bcd000 CR4: 0000000000352ef0 [ 95.343634][ T5322] Call Trace: [ 95.345270][ T5322] [ 95.346649][ T5322] ? dlm_midcomms_close+0x3a9/0x4c0 [ 95.348943][ T5322] ? dlm_midcomms_close+0x4b/0x4c0 [ 95.351236][ T5322] drop_comm+0x61/0x190 [ 95.353060][ T5322] ? configfs_rmdir+0x850/0x950 [ 95.355068][ T5322] ? __pfx_drop_comm+0x10/0x10 [ 95.357434][ T5322] configfs_rmdir+0x85f/0x950 [ 95.359843][ T5322] vfs_rmdir+0x3e6/0x6a0 [ 95.361736][ T5322] ? bpf_lsm_path_rmdir+0x9/0x20 [ 95.363968][ T5322] filename_rmdir+0x292/0x520 [ 95.366091][ T5322] ? __pfx_filename_rmdir+0x10/0x10 [ 95.368399][ T5322] ? do_getname+0x151/0x250 [ 95.370530][ T5322] __se_sys_rmdir+0x2e/0x140 [ 95.372586][ T5322] do_syscall_64+0x166/0x520 [ 95.374600][ T5322] ? trace_irq_disable+0x3b/0x140 [ 95.376766][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.379420][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 95.381486][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.384076][ T5322] RIP: 0033:0x7f04b2b9e159 [ 95.386090][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.394366][ T5322] RSP: 002b:00007f04b3b48fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 95.398095][ T5322] RAX: ffffffffffffffda RBX: 00007f04b2e25fa0 RCX: 00007f04b2b9e159 [ 95.401748][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 95.405157][ T5322] RBP: 00007f04b2c3503b R08: 0000000000000000 R09: 0000000000000000 [ 95.408453][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.412105][ T5322] R13: 00007f04b2e26038 R14: 00007f04b2e25fa0 R15: 00007ffd02257668 [ 95.415609][ T5322] [ 95.416957][ T5322] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 95.420016][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.423613][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.427749][ T5322] Call Trace: [ 95.429115][ T5322] [ 95.430287][ T5322] vpanic+0x56d/0xa60 [ 95.431912][ T5322] ? __pfx__printk+0x10/0x10 [ 95.433906][ T5322] ? __pfx_vpanic+0x10/0x10 [ 95.435926][ T5322] ? is_bpf_text_address+0x292/0x2b0 [ 95.438224][ T5322] ? is_bpf_text_address+0x26/0x2b0 [ 95.440521][ T5322] panic+0xc5/0xd0 [ 95.442164][ T5322] ? __pfx_panic+0x10/0x10 [ 95.444106][ T5322] __warn+0x315/0x4c0 [ 95.445947][ T5322] ? dlm_lowcomms_close+0x12d/0x440 [ 95.448149][ T5322] ? dlm_lowcomms_close+0x12d/0x440 [ 95.450954][ T5322] __report_bug+0x276/0x570 [ 95.453202][ T5322] ? dlm_lowcomms_close+0x12d/0x440 [ 95.455497][ T5322] ? __pfx___report_bug+0x10/0x10 [ 95.457844][ T5322] ? lockdep_unlock+0x5c/0xd0 [ 95.459960][ T5322] ? __lock_acquire+0x1511/0x2de0 [ 95.462192][ T5322] ? irqentry_exit+0x218/0x910 [ 95.464333][ T5322] ? lockdep_hardirqs_on+0x7b/0x110 [ 95.466709][ T5322] ? dlm_lowcomms_close+0x12d/0x440 [ 95.469140][ T5322] report_bug+0x16b/0x220 [ 95.471429][ T5322] ? dlm_lowcomms_close+0x12d/0x440 [ 95.474227][ T5322] ? dlm_lowcomms_close+0x12f/0x440 [ 95.476599][ T5322] handle_bug+0x9c/0x200 [ 95.478445][ T5322] exc_invalid_op+0x1a/0x50 [ 95.480498][ T5322] asm_exc_invalid_op+0x1a/0x20 [ 95.482670][ T5322] RIP: 0010:dlm_lowcomms_close+0x12d/0x440 [ 95.485270][ T5322] Code: 99 5e 9f 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 52 fd 10 01 eb a2 e8 7b 5e 9f 00 eb 05 e8 74 5e 9f 00 90 <0f> 0b 90 44 89 f7 e8 c8 61 5a 01 b8 fe ff ff ff 48 83 c4 20 5b 41 [ 95.493530][ T5322] RSP: 0018:ffffc9000f73fc40 EFLAGS: 00010293 [ 95.496148][ T5322] RAX: ffffffff81287d45 RBX: 0000000000000001 RCX: ffff88801261a580 [ 95.499363][ T5322] RDX: 0000000000000000 RSI: ffffffff8e702f39 RDI: ffffffff8c6dbc80 [ 95.502672][ T5322] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff96bb7068 [ 95.506024][ T5322] R10: 00000000b8a5a85b R11: 00000000296d98fe R12: 0000000000000000 [ 95.509492][ T5322] R13: ffffffff81287c78 R14: 0000000000000000 R15: 0000000000000000 [ 95.512888][ T5322] ? dlm_lowcomms_close+0x58/0x440 [ 95.515171][ T5322] ? dlm_lowcomms_close+0x125/0x440 [ 95.517403][ T5322] ? dlm_midcomms_close+0x3a9/0x4c0 [ 95.519673][ T5322] ? dlm_midcomms_close+0x4b/0x4c0 [ 95.521915][ T5322] drop_comm+0x61/0x190 [ 95.523784][ T5322] ? configfs_rmdir+0x850/0x950 [ 95.525889][ T5322] ? __pfx_drop_comm+0x10/0x10 [ 95.528034][ T5322] configfs_rmdir+0x85f/0x950 [ 95.530219][ T5322] vfs_rmdir+0x3e6/0x6a0 [ 95.532074][ T5322] ? bpf_lsm_path_rmdir+0x9/0x20 [ 95.534195][ T5322] filename_rmdir+0x292/0x520 [ 95.536293][ T5322] ? __pfx_filename_rmdir+0x10/0x10 [ 95.538506][ T5322] ? do_getname+0x151/0x250 [ 95.540468][ T5322] __se_sys_rmdir+0x2e/0x140 [ 95.542567][ T5322] do_syscall_64+0x166/0x520 [ 95.544589][ T5322] ? trace_irq_disable+0x3b/0x140 [ 95.546692][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.549156][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 95.551262][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.553833][ T5322] RIP: 0033:0x7f04b2b9e159 [ 95.555839][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.563891][ T5322] RSP: 002b:00007f04b3b48fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054 [ 95.567470][ T5322] RAX: ffffffffffffffda RBX: 00007f04b2e25fa0 RCX: 00007f04b2b9e159 [ 95.570959][ T5322] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000140 [ 95.574326][ T5322] RBP: 00007f04b2c3503b R08: 0000000000000000 R09: 0000000000000000 [ 95.577870][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.581373][ T5322] R13: 00007f04b2e26038 R14: 00007f04b2e25fa0 R15: 00007ffd02257668 [ 95.584940][ T5322] [ 95.586784][ T5322] Kernel Offset: disabled [ 95.588725][ T5322] Rebooting in 86400 seconds..