kernel BUG in __open_session

Status: upstream: reported C repro on 2026/09/25 15:33
Reported-by: syzbot+6eb3ff903b26ba8b1ab0@syzkaller.appspotmail.com
First crash: 4d08h, last: 4d07h
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream kernel BUG in __open_session ceph prio:low -1 syz, C error 49 11h25m 19d 0/29 upstream: reported C repro on 2026/09/10 20:12

Sample crash report:
loop0: detected capacity change from 0 to 32768
XFS (loop0): Mounting V5 Filesystem
XFS (loop0): Ending clean mount
libceph: resolve '1270.0.1' (ret=-3): failed
------------[ cut here ]------------
kernel BUG at net/ceph/mon_client.c:211!
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 4523 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : pick_new_mon net/ceph/mon_client.c:211 [inline]
pc : __open_session+0x5c4/0x6dc net/ceph/mon_client.c:245
lr : pick_new_mon net/ceph/mon_client.c:211 [inline]
lr : __open_session+0x5c4/0x6dc net/ceph/mon_client.c:245
sp : ffff8000211f7980
x29: ffff8000211f7980 x28: dfff800000000000 x27: ffff0000df8d82a0
x26: 1fffe0001bf1b054 x25: 1fffe0001bf1b082 x24: ffff0000df8d8410
x23: dfff800000000000 x22: ffff0000df8d8c29 x21: 0000000000000000
x20: 00000000ffffffff x19: ffff0000df8d8298 x18: 1fffe00033e6997e
x17: 00000000ffff0000 x16: ffff800011bb65f8 x15: 0000000000000000
x14: 0000000000000001 x13: 0000000000ff0100 x12: ffff800017d14fa0
x11: ff0080001179b3c0 x10: 0000000000000000 x9 : ffff80001179b3c0
x8 : ffff0000c9948000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff8000186c50f8 x4 : 0000000000000008 x3 : ffff8000082d44f0
x2 : ffff0000c9948000 x1 : ffff800017d14f80 x0 : 0000000000000000
Call trace:
 pick_new_mon net/ceph/mon_client.c:211 [inline]
 __open_session+0x5c4/0x6dc net/ceph/mon_client.c:245
 ceph_monc_open_session+0x16c/0x418 net/ceph/mon_client.c:534
 __ceph_open_session+0x120/0x480 net/ceph/ceph_common.c:799
 ceph_real_mount fs/ceph/super.c:1083 [inline]
 ceph_get_tree+0x904/0x1134 fs/ceph/super.c:1262
 vfs_get_tree+0x90/0x278 fs/super.c:1584
 vfs_fsconfig_locked+0x1e0/0x374 fs/fsopen.c:238
 __do_sys_fsconfig fs/fsopen.c:445 [inline]
 __se_sys_fsconfig fs/fsopen.c:320 [inline]
 __arm64_sys_fsconfig+0x640/0x790 fs/fsopen.c:320
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: 52800081 97a16792 17ffff8b 97a16717 (d4210000) 
---[ end trace 0000000000000000 ]---

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/25 17:11 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-linux-6-1-kasan-arm64 kernel BUG in __open_session
2026/09/25 16:36 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in __open_session
2026/09/25 16:05 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in __open_session
2026/09/25 15:32 linux-6.1.y 1a8763b93150 f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 kernel BUG in __open_session
* Struck through repros no longer work on HEAD.