program:
r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000340)='./config\x00', &(0x7f0000000380)='configfs\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/dlm\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/dlm/cluster1\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/dlm/cluster1/comms/1\x00', 0x1ff)
r1 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0)
write(r1, &(0x7f0000000500)='0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 0x80)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000640)='./debug\x00', &(0x7f0000000680)='debugfs\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f00000006c0)='./debug/dlm/comms/1/rawmsg\x00', 0x1, 0x0)
write(r2, &(0x7f0000000700)='\x00'/16, 0x10)
rmdir(&(0x7f0000000740)='./config/dlm/cluster1/comms/1\x00')
bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6)
write(r0, &(0x7f0000000280)="1b000000080011aaaaaaaaaa0100", 0xe)
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB="8800d5f892188a8000080211000001080211000000505050505050d0ffebe5"], 0x28)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_DPORT={0x6}, @RTA_IP_PROTO={0x5, 0x1b, 0x11}]}, 0x2c}}, 0x0)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYRES64=r3, @ANYRES32=r3, @ANYRES8=r3, @ANYRES64=r3, @ANYRES32=0x0, @ANYBLOB="7f94040a46dc3f6c231be1f8e5ce2897a58b5c39e02057c57db0816ec9aabc2bce215fa214c8f2f255267388c8769ce4975f1823e902d26c1be3f9387208021de3e7f0bde8dd27a8d128d9b6f3780007e3bc9feda649f475b974f8c9d33f6df194634518e7e20b3548ffe47a5f9dc69fc090d487445c195efddb56705feefc8d03551fdf3c71ec316c9c45db6b664de623551f59d9ce39f2bd4bed113e640ea175c7e424ed715c0c95841adbf81f8ee204776e2b40da592a1df5cb98be54149d72c7f95aefbc2ca3d16ca3c97ded4c368d5da11667c8c6c7bf47761652a6ea8231a2f6e9103a6d82c698", @ANYRES32=r3], 0x3c)
syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async)
mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000340)='./config\x00', &(0x7f0000000380)='configfs\x00', 0x0, 0x0) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/dlm\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./config/dlm/cluster1\x00', 0x1ff) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000480)='./config/dlm/cluster1/comms/1\x00', 0x1ff) (async)
openat(0xffffffffffffff9c, &(0x7f00000004c0)='./config/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0) (async)
write(r1, &(0x7f0000000500)='0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000', 0x80) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000600)='./debug\x00', 0x1ff) (async)
mount(0x0, &(0x7f0000000640)='./debug\x00', &(0x7f0000000680)='debugfs\x00', 0x0, 0x0) (async)
openat(0xffffffffffffff9c, &(0x7f00000006c0)='./debug/dlm/comms/1/rawmsg\x00', 0x1, 0x0) (async)
write(r2, &(0x7f0000000700)='\x00'/16, 0x10) (async)
rmdir(&(0x7f0000000740)='./config/dlm/cluster1/comms/1\x00') (async)
bind$bt_hci(r0, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) (async)
write(r0, &(0x7f0000000280)="1b000000080011aaaaaaaaaa0100", 0xe) (async)
syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000000)=ANY=[@ANYBLOB="8800d5f892188a8000080211000001080211000000505050505050d0ffebe5"], 0x28) (async)
socket$nl_route(0x10, 0x3, 0x0) (async)
sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@ipv4_newroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {0xa}, [@RTA_DPORT={0x6}, @RTA_IP_PROTO={0x5, 0x1b, 0x11}]}, 0x2c}}, 0x0) (async)
syz_80211_inject_frame(&(0x7f0000000300)=@device_b, &(0x7f0000000100)=ANY=[@ANYRES64=r3, @ANYRES32=r3, @ANYRES8=r3, @ANYRES64=r3, @ANYRES32=0x0, @ANYBLOB="7f94040a46dc3f6c231be1f8e5ce2897a58b5c39e02057c57db0816ec9aabc2bce215fa214c8f2f255267388c8769ce4975f1823e902d26c1be3f9387208021de3e7f0bde8dd27a8d128d9b6f3780007e3bc9feda649f475b974f8c9d33f6df194634518e7e20b3548ffe47a5f9dc69fc090d487445c195efddb56705feefc8d03551fdf3c71ec316c9c45db6b664de623551f59d9ce39f2bd4bed113e640ea175c7e424ed715c0c95841adbf81f8ee204776e2b40da592a1df5cb98be54149d72c7f95aefbc2ca3d16ca3c97ded4c368d5da11667c8c6c7bf47761652a6ea8231a2f6e9103a6d82c698", @ANYRES32=r3], 0x3c) (async)
[ 94.353868][ T4663] Bluetooth: hci0: command tx timeout
[ 94.457707][ T5339] dlm: closing connection to node 1
[ 94.457844][ T5339] dlm: io handling for node: 1 stopped
[ 94.458897][ T5339] dlm: closing connection to node 1 done
[ 94.462315][ T5339] Bluetooth: MGMT ver 1.23
[ 94.464987][ T5339] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 94.467022][ T5339] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[ 94.503919][ T5351] dlm: closing connection to node 1
[ 94.504202][ T5351] ------------[ cut here ]------------
[ 94.504210][ T5351] !con
[ 94.504224][ T5351] WARNING: fs/dlm/lowcomms.c:1453 at dlm_lowcomms_close+0x12d/0x440, CPU#0: syz.0.0/5351
[ 94.514097][ T5351] Modules linked in:
[ 94.516338][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.520090][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.524466][ T5351] RIP: 0010:dlm_lowcomms_close+0x12d/0x440
[ 94.527116][ T5351] Code: d9 98 a0 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 c2 3b 19 01 eb a2 e8 bb 98 a0 00 eb 05 e8 b4 98 a0 00 90 <0f> 0b 90 44 89 f7 e8 d8 8c 63 01 b8 fe ff ff ff 48 83 c4 20 5b 41
[ 94.535833][ T5351] RSP: 0018:ffffc9000f73fc40 EFLAGS: 00010293
[ 94.538672][ T5351] RAX: ffffffff812888e5 RBX: 0000000000000001 RCX: ffff8880347ccb00
[ 94.542069][ T5351] RDX: 0000000000000000 RSI: ffffffff8e9399e2 RDI: ffffffff8c8ebe80
[ 94.545511][ T5351] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff98071740
[ 94.549122][ T5351] R10: 0000000002bfc82a R11: 000000005e61bf48 R12: 0000000000000000
[ 94.552709][ T5351] R13: ffffffff81288818 R14: 0000000000000001 R15: 0000000000000000
[ 94.556062][ T5351] FS: 00007f3eec59b6c0(0000) GS:ffff88808aa01000(0000) knlGS:0000000000000000
[ 94.560006][ T5351] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.562917][ T5351] CR2: 00007f3ee7bd4d58 CR3: 000000001367d000 CR4: 0000000000352ef0
[ 94.566140][ T5351] Call Trace:
[ 94.567579][ T5351]
[ 94.568897][ T5351] ? dlm_midcomms_close+0x3a9/0x4c0
[ 94.571698][ T5351] ? dlm_midcomms_close+0x4b/0x4c0
[ 94.573840][ T5351] drop_comm+0x61/0x190
[ 94.575540][ T5351] ? configfs_rmdir+0x850/0x950
[ 94.577491][ T5351] ? __pfx_drop_comm+0x10/0x10
[ 94.579648][ T5351] configfs_rmdir+0x85f/0x950
[ 94.582062][ T5351] vfs_rmdir+0x3e6/0x6f0
[ 94.584351][ T5351] ? bpf_lsm_path_rmdir+0x9/0x20
[ 94.586737][ T5351] filename_rmdir+0x276/0x500
[ 94.588938][ T5351] ? __pfx_filename_rmdir+0x10/0x10
[ 94.591059][ T5351] ? do_getname+0x151/0x250
[ 94.593059][ T5351] __se_sys_rmdir+0x2e/0x140
[ 94.595091][ T5351] do_syscall_64+0x166/0x520
[ 94.597216][ T5351] ? trace_irq_disable+0x3b/0x140
[ 94.599384][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.602072][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 94.604163][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.606735][ T5351] RIP: 0033:0x7f3eeb79fb19
[ 94.608739][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.616743][ T5351] RSP: 002b:00007f3eec59afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[ 94.620309][ T5351] RAX: ffffffffffffffda RBX: 00007f3eeba26ae0 RCX: 00007f3eeb79fb19
[ 94.623893][ T5351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000740
[ 94.627239][ T5351] RBP: 00007f3eeb837af8 R08: 0000000000000000 R09: 0000000000000000
[ 94.630504][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.633953][ T5351] R13: 00007f3eeba26b78 R14: 00007f3eeba26ae0 R15: 00007ffc65c72ba8
[ 94.637291][ T5351]
[ 94.638606][ T5351] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.641664][ T5351] CPU: 0 UID: 0 PID: 5351 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.645260][ T5351] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.649136][ T5351] Call Trace:
[ 94.650516][ T5351]
[ 94.653467][ T5351] vpanic+0x26f/0x710
[ 94.655296][ T5351] panic+0xc5/0xd0
[ 94.657038][ T5351] ? __pfx_panic+0x10/0x10
[ 94.659151][ T5351] __warn+0x315/0x4c0
[ 94.660903][ T5351] ? dlm_lowcomms_close+0x12d/0x440
[ 94.663188][ T5351] ? dlm_lowcomms_close+0x12d/0x440
[ 94.665470][ T5351] __report_bug+0x276/0x570
[ 94.667343][ T5351] ? check_path+0x21/0x40
[ 94.669011][ T5351] ? dlm_lowcomms_close+0x12d/0x440
[ 94.671058][ T5351] ? __pfx___report_bug+0x10/0x10
[ 94.673228][ T5351] ? lockdep_unlock+0x5c/0xd0
[ 94.675169][ T5351] ? __lock_acquire+0x1511/0x2de0
[ 94.677261][ T5351] ? dlm_lowcomms_close+0x12d/0x440
[ 94.679390][ T5351] report_bug+0x16b/0x220
[ 94.681128][ T5351] ? dlm_lowcomms_close+0x12d/0x440
[ 94.683183][ T5351] ? dlm_lowcomms_close+0x12f/0x440
[ 94.685141][ T5351] handle_bug+0x9c/0x200
[ 94.686883][ T5351] exc_invalid_op+0x1a/0x50
[ 94.688633][ T5351] asm_exc_invalid_op+0x1a/0x20
[ 94.690575][ T5351] RIP: 0010:dlm_lowcomms_close+0x12d/0x440
[ 94.693052][ T5351] Code: d9 98 a0 00 eb a6 44 89 e1 80 e1 07 80 c1 03 38 c1 7c ac 4c 89 e7 e8 c2 3b 19 01 eb a2 e8 bb 98 a0 00 eb 05 e8 b4 98 a0 00 90 <0f> 0b 90 44 89 f7 e8 d8 8c 63 01 b8 fe ff ff ff 48 83 c4 20 5b 41
[ 94.700997][ T5351] RSP: 0018:ffffc9000f73fc40 EFLAGS: 00010293
[ 94.703527][ T5351] RAX: ffffffff812888e5 RBX: 0000000000000001 RCX: ffff8880347ccb00
[ 94.706753][ T5351] RDX: 0000000000000000 RSI: ffffffff8e9399e2 RDI: ffffffff8c8ebe80
[ 94.709930][ T5351] RBP: dffffc0000000000 R08: 0000000000000004 R09: ffffffff98071740
[ 94.713068][ T5351] R10: 0000000002bfc82a R11: 000000005e61bf48 R12: 0000000000000000
[ 94.716385][ T5351] R13: ffffffff81288818 R14: 0000000000000001 R15: 0000000000000000
[ 94.719766][ T5351] ? dlm_lowcomms_close+0x58/0x440
[ 94.721964][ T5351] ? dlm_lowcomms_close+0x125/0x440
[ 94.724194][ T5351] ? dlm_midcomms_close+0x3a9/0x4c0
[ 94.726394][ T5351] ? dlm_midcomms_close+0x4b/0x4c0
[ 94.728612][ T5351] drop_comm+0x61/0x190
[ 94.730377][ T5351] ? configfs_rmdir+0x850/0x950
[ 94.732437][ T5351] ? __pfx_drop_comm+0x10/0x10
[ 94.734490][ T5351] configfs_rmdir+0x85f/0x950
[ 94.736465][ T5351] vfs_rmdir+0x3e6/0x6f0
[ 94.738303][ T5351] ? bpf_lsm_path_rmdir+0x9/0x20
[ 94.740587][ T5351] filename_rmdir+0x276/0x500
[ 94.742552][ T5351] ? __pfx_filename_rmdir+0x10/0x10
[ 94.745006][ T5351] ? do_getname+0x151/0x250
[ 94.747098][ T5351] __se_sys_rmdir+0x2e/0x140
[ 94.749236][ T5351] do_syscall_64+0x166/0x520
[ 94.751332][ T5351] ? trace_irq_disable+0x3b/0x140
[ 94.753498][ T5351] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.756062][ T5351] ? clear_bhb_loop+0x70/0xc0
[ 94.758078][ T5351] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.760519][ T5351] RIP: 0033:0x7f3eeb79fb19
[ 94.762437][ T5351] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.770319][ T5351] RSP: 002b:00007f3eec59afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000054
[ 94.773830][ T5351] RAX: ffffffffffffffda RBX: 00007f3eeba26ae0 RCX: 00007f3eeb79fb19
[ 94.777693][ T5351] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000740
[ 94.781237][ T5351] RBP: 00007f3eeb837af8 R08: 0000000000000000 R09: 0000000000000000
[ 94.784554][ T5351] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.787850][ T5351] R13: 00007f3eeba26b78 R14: 00007f3eeba26ae0 R15: 00007ffc65c72ba8
[ 94.791152][ T5351]
[ 94.792906][ T5351] Kernel Offset: disabled
[ 94.794725][ T5351] Rebooting in 86400 seconds..