program:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept$inet(r0, &(0x7f0000000200), &(0x7f0000000210)=0x10)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(r2, &(0x7f0000000300)='ceph v027\x00'/278, 0x119)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(r2, &(0x7f0000000800)="01ffffffffffffffffffffffffffffffff00"/30, 0x1e)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
write(r2, &(0x7f0000000c00)="070100000000000000000000000000000030000000000000000000000000000000000000000100000000000000000000000000000028d7b3ad00"/74, 0x48)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
[ 101.249318][ T5289] Bluetooth: hci0: command tx timeout
[ 101.460035][ T5313] ------------[ cut here ]------------
[ 101.466614][ T5313] con->v1.connect_seq != le32_to_cpu(con->v1.in_reply.connect_seq)
[ 101.466629][ T5313] WARNING: net/ceph/messenger_v1.c:902 at ceph_con_v1_try_read+0x3335/0x6eb0, CPU#0: kworker/0:4/5313
[ 101.475065][ T5313] Modules linked in:
[ 101.477431][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 101.481244][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.485834][ T5313] Workqueue: ceph-msgr ceph_con_workfn
[ 101.488205][ T5313] RIP: 0010:ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.490815][ T5313] Code: 45 31 e4 e9 3f d1 ff ff e8 68 d0 30 f6 90 0f 0b 90 e9 cd d3 ff ff e8 5a d0 30 f6 90 0f 0b 90 e9 dd e6 ff ff e8 4c d0 30 f6 90 <0f> 0b 90 e9 f4 e7 ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 30 d1
[ 101.498705][ T5313] RSP: 0018:ffffc9000dd27180 EFLAGS: 00010293
[ 101.501630][ T5313] RAX: ffffffff8b9654e4 RBX: 0000000000000001 RCX: ffff888012828000
[ 101.505737][ T5313] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000001
[ 101.509251][ T5313] RBP: ffffc9000dd27a78 R08: ffff888012828000 R09: 0000000000000009
[ 101.512541][ T5313] R10: 000000000000000d R11: 0000000000000000 R12: ffff88801229c418
[ 101.516137][ T5313] R13: fffff52001ba4e70 R14: dffffc0000000000 R15: 00000000ffffffff
[ 101.519508][ T5313] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 101.523070][ T5313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 101.525964][ T5313] CR2: 00007fc24f617fe8 CR3: 000000004426e000 CR4: 0000000000352ef0
[ 101.529232][ T5313] Call Trace:
[ 101.531136][ T5313]
[ 101.532431][ T5313] ? __pfx_ceph_con_v1_try_read+0x10/0x10
[ 101.535514][ T5313] ? dev_hard_start_xmit+0x7c7/0x830
[ 101.537924][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.540010][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.542250][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 101.544590][ T5313] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.546753][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.548935][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 101.551146][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.553336][ T5313] ? __dev_queue_xmit+0x1edc/0x3820
[ 101.555606][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.557793][ T5313] ? __pfx_mroute6_is_socket+0x10/0x10
[ 101.560091][ T5313] ? ipv6_chk_mcast_addr+0x2e/0x860
[ 101.562285][ T5313] ? __pfx___dev_queue_xmit+0x10/0x10
[ 101.564528][ T5313] ? ip6_finish_output+0x292/0x770
[ 101.566613][ T5313] ? ip6_finish_output+0x292/0x770
[ 101.568779][ T5313] ? ip6_finish_output2+0xb02/0x13c0
[ 101.571104][ T5313] ? __asan_memcpy+0x40/0x70
[ 101.573084][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.575312][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.577422][ T5313] ? __mutex_trylock_common+0x15f/0x270
[ 101.579733][ T5313] ? __pfx___mutex_trylock_common+0x10/0x10
[ 101.582187][ T5313] ? rcu_is_watching+0x15/0xb0
[ 101.584317][ T5313] ? trace_contention_end+0x3d/0x140
[ 101.586656][ T5313] ? __mutex_lock+0x30d/0x1550
[ 101.588642][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.590674][ T5313] ? ceph_con_workfn+0x3b/0x14a0
[ 101.592752][ T5313] ? __pfx___mutex_lock+0x10/0x10
[ 101.595082][ T5313] ? do_raw_spin_lock+0x12b/0x2f0
[ 101.597115][ T5313] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 101.599275][ T5313] ? process_scheduled_works+0xa20/0x14e0
[ 101.601721][ T5313] ceph_con_workfn+0x208/0x14a0
[ 101.603849][ T5313] ? rcu_is_watching+0x15/0xb0
[ 101.605829][ T5313] ? process_scheduled_works+0xa20/0x14e0
[ 101.608056][ T5313] process_scheduled_works+0xa8e/0x14e0
[ 101.610473][ T5313] ? __pfx_process_scheduled_works+0x10/0x10
[ 101.613246][ T5313] ? assign_work+0x3cf/0x5d0
[ 101.615386][ T5313] worker_thread+0xa47/0xfb0
[ 101.617399][ T5313] ? __kthread_parkme+0x71/0x1f0
[ 101.619575][ T5313] kthread+0x388/0x470
[ 101.621281][ T5313] ? __pfx_worker_thread+0x10/0x10
[ 101.623391][ T5313] ? __pfx_kthread+0x10/0x10
[ 101.625443][ T5313] ret_from_fork+0x514/0xb70
[ 101.627386][ T5313] ? __pfx_ret_from_fork+0x10/0x10
[ 101.629744][ T5313] ? __switch_to+0xc89/0x1420
[ 101.631732][ T5313] ? __pfx_kthread+0x10/0x10
[ 101.633954][ T5313] ret_from_fork_asm+0x1a/0x30
[ 101.636281][ T5313]
[ 101.637631][ T5313] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 101.640638][ T5313] CPU: 0 UID: 0 PID: 5313 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
[ 101.644555][ T5313] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.648615][ T5313] Workqueue: ceph-msgr ceph_con_workfn
[ 101.650805][ T5313] Call Trace:
[ 101.652173][ T5313]
[ 101.653364][ T5313] vpanic+0x56c/0xa60
[ 101.654966][ T5313] ? __pfx__printk+0x10/0x10
[ 101.656960][ T5313] ? __pfx_vpanic+0x10/0x10
[ 101.658868][ T5313] ? is_bpf_text_address+0x292/0x2b0
[ 101.660999][ T5313] ? is_bpf_text_address+0x26/0x2b0
[ 101.663089][ T5313] panic+0xc5/0xd0
[ 101.664728][ T5313] ? __pfx_panic+0x10/0x10
[ 101.666608][ T5313] ? ret_from_fork_asm+0x1a/0x30
[ 101.668728][ T5313] __warn+0x315/0x4c0
[ 101.670506][ T5313] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.672761][ T5313] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.675035][ T5313] __report_bug+0x276/0x570
[ 101.676948][ T5313] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.679269][ T5313] ? __pfx___report_bug+0x10/0x10
[ 101.681373][ T5313] ? tcp_recvmsg+0x213/0x7f0
[ 101.683304][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 101.685471][ T5313] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.687609][ T5313] ? tcp_recvmsg+0x213/0x7f0
[ 101.689515][ T5313] ? tcp_recvmsg+0x288/0x7f0
[ 101.691368][ T5313] ? ip6_finish_output+0x292/0x770
[ 101.693593][ T5313] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.696617][ T5313] report_bug+0x16a/0x220
[ 101.698480][ T5313] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.700867][ T5313] ? ceph_con_v1_try_read+0x3337/0x6eb0
[ 101.703290][ T5313] handle_bug+0x9c/0x200
[ 101.705001][ T5313] exc_invalid_op+0x1a/0x50
[ 101.706825][ T5313] asm_exc_invalid_op+0x1a/0x20
[ 101.708664][ T5313] RIP: 0010:ceph_con_v1_try_read+0x3335/0x6eb0
[ 101.711486][ T5313] Code: 45 31 e4 e9 3f d1 ff ff e8 68 d0 30 f6 90 0f 0b 90 e9 cd d3 ff ff e8 5a d0 30 f6 90 0f 0b 90 e9 dd e6 ff ff e8 4c d0 30 f6 90 <0f> 0b 90 e9 f4 e7 ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 30 d1
[ 101.719442][ T5313] RSP: 0018:ffffc9000dd27180 EFLAGS: 00010293
[ 101.722065][ T5313] RAX: ffffffff8b9654e4 RBX: 0000000000000001 RCX: ffff888012828000
[ 101.725326][ T5313] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000001
[ 101.728616][ T5313] RBP: ffffc9000dd27a78 R08: ffff888012828000 R09: 0000000000000009
[ 101.731884][ T5313] R10: 000000000000000d R11: 0000000000000000 R12: ffff88801229c418
[ 101.735159][ T5313] R13: fffff52001ba4e70 R14: dffffc0000000000 R15: 00000000ffffffff
[ 101.738375][ T5313] ? ceph_con_v1_try_read+0x3334/0x6eb0
[ 101.740732][ T5313] ? __pfx_ceph_con_v1_try_read+0x10/0x10
[ 101.743046][ T5313] ? dev_hard_start_xmit+0x7c7/0x830
[ 101.745208][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.747287][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.749364][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 101.751466][ T5313] ? lockdep_hardirqs_on+0x7a/0x110
[ 101.753673][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.755790][ T5313] ? __local_bh_enable_ip+0xd0/0x130
[ 101.757995][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.760194][ T5313] ? __dev_queue_xmit+0x1edc/0x3820
[ 101.762427][ T5313] ? __dev_queue_xmit+0x29b/0x3820
[ 101.764498][ T5313] ? __pfx_mroute6_is_socket+0x10/0x10
[ 101.766728][ T5313] ? ipv6_chk_mcast_addr+0x2e/0x860
[ 101.768846][ T5313] ? __pfx___dev_queue_xmit+0x10/0x10
[ 101.771193][ T5313] ? ip6_finish_output+0x292/0x770
[ 101.773415][ T5313] ? ip6_finish_output+0x292/0x770
[ 101.775618][ T5313] ? ip6_finish_output2+0xb02/0x13c0
[ 101.777866][ T5313] ? __asan_memcpy+0x40/0x70
[ 101.779820][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.781847][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.783779][ T5313] ? __mutex_trylock_common+0x15f/0x270
[ 101.786154][ T5313] ? __pfx___mutex_trylock_common+0x10/0x10
[ 101.789210][ T5313] ? rcu_is_watching+0x15/0xb0
[ 101.791756][ T5313] ? trace_contention_end+0x3d/0x140
[ 101.794392][ T5313] ? __mutex_lock+0x30d/0x1550
[ 101.796386][ T5313] ? __lock_acquire+0x683/0x2cf0
[ 101.798496][ T5313] ? ceph_con_workfn+0x3b/0x14a0
[ 101.800543][ T5313] ? __pfx___mutex_lock+0x10/0x10
[ 101.802686][ T5313] ? do_raw_spin_lock+0x12b/0x2f0
[ 101.804776][ T5313] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 101.807006][ T5313] ? process_scheduled_works+0xa20/0x14e0
[ 101.809571][ T5313] ceph_con_workfn+0x208/0x14a0
[ 101.811592][ T5313] ? rcu_is_watching+0x15/0xb0
[ 101.813675][ T5313] ? process_scheduled_works+0xa20/0x14e0
[ 101.816004][ T5313] process_scheduled_works+0xa8e/0x14e0
[ 101.818363][ T5313] ? __pfx_process_scheduled_works+0x10/0x10
[ 101.820943][ T5313] ? assign_work+0x3cf/0x5d0
[ 101.822923][ T5313] worker_thread+0xa47/0xfb0
[ 101.824912][ T5313] ? __kthread_parkme+0x71/0x1f0
[ 101.827051][ T5313] kthread+0x388/0x470
[ 101.828787][ T5313] ? __pfx_worker_thread+0x10/0x10
[ 101.831008][ T5313] ? __pfx_kthread+0x10/0x10
[ 101.833051][ T5313] ret_from_fork+0x514/0xb70
[ 101.835075][ T5313] ? __pfx_ret_from_fork+0x10/0x10
[ 101.837463][ T5313] ? __switch_to+0xc89/0x1420
[ 101.839486][ T5313] ? __pfx_kthread+0x10/0x10
[ 101.841507][ T5313] ret_from_fork_asm+0x1a/0x30
[ 101.843571][ T5313]
[ 101.845349][ T5313] Kernel Offset: disabled
[ 101.847216][ T5313] Rebooting in 86400 seconds..