program:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1a85, @loopback}, 0x10)
listen(r0, 0x5)
r1 = fsopen(&(0x7f0000000100)='ceph\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000140)='source\x00', &(0x7f0000000180)='127.0.0.1:6789:/\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
r2 = accept$inet(r0, &(0x7f0000000200), &(0x7f0000000210)=0x10)
nanosleep(&(0x7f0000000400)={0x0, 0x989680}, 0x0)
write(r2, &(0x7f0000000300)='ceph v027\x00'/278, 0x119)
nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0)
write(r2, &(0x7f0000000800)="01ffffffffffffffff00"/29, 0x1e)
nanosleep(&(0x7f0000000400)={0x0, 0x1312d00}, 0x0)
write(r2, &(0x7f0000000c00)="070100000000000000000000000000000030000000000000000000000000000000000000000100000000000000000000000000000028d7b3ad00"/74, 0x48)
nanosleep(&(0x7f0000000400)={0x0, 0x2faf080}, 0x0)
[ 117.454754][ T44] Bluetooth: hci0: command tx timeout
[ 117.615748][ T9] ------------[ cut here ]------------
[ 117.618476][ T9] con->v1.connect_seq != le32_to_cpu(con->v1.in_reply.connect_seq)
[ 117.618490][ T9] WARNING: net/ceph/messenger_v1.c:902 at ceph_con_v1_try_read+0x3335/0x6eb0, CPU#0: kworker/0:0/9
[ 117.627023][ T9] Modules linked in:
[ 117.629108][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 117.632900][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 117.637037][ T9] Workqueue: ceph-msgr ceph_con_workfn
[ 117.639455][ T9] RIP: 0010:ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.642213][ T9] Code: 45 31 e4 e9 3f d1 ff ff e8 68 d0 30 f6 90 0f 0b 90 e9 cd d3 ff ff e8 5a d0 30 f6 90 0f 0b 90 e9 dd e6 ff ff e8 4c d0 30 f6 90 <0f> 0b 90 e9 f4 e7 ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 30 d1
[ 117.650452][ T9] RSP: 0018:ffffc9000022f180 EFLAGS: 00010293
[ 117.652918][ T9] RAX: ffffffff8b9654e4 RBX: 0000000000000001 RCX: ffff88801bf0ca80
[ 117.656160][ T9] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
[ 117.659660][ T9] RBP: ffffc9000022fa78 R08: ffff88801bf0ca80 R09: 0000000000000009
[ 117.663299][ T9] R10: 000000000000000d R11: 0000000000000000 R12: ffff88803f070418
[ 117.666667][ T9] R13: fffff52000045e70 R14: dffffc0000000000 R15: 0000000000000000
[ 117.670180][ T9] FS: 0000000000000000(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 117.673988][ T9] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 117.676690][ T9] CR2: 00007f5c7e051fe8 CR3: 000000003752d000 CR4: 0000000000352ef0
[ 117.680266][ T9] Call Trace:
[ 117.681783][ T9]
[ 117.682997][ T9] ? __tcp_push_pending_frames+0xd1/0x380
[ 117.685225][ T9] ? __pfx_ceph_con_v1_try_read+0x10/0x10
[ 117.687523][ T9] ? reacquire_held_locks+0x104/0x190
[ 117.689912][ T9] ? release_sock+0x2f/0x260
[ 117.691905][ T9] ? tcp_sendmsg+0x39/0x50
[ 117.693940][ T9] ? __local_bh_enable_ip+0xd0/0x130
[ 117.696093][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.698467][ T9] ? __pfx_inet_sendmsg+0x10/0x10
[ 117.700549][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.702538][ T9] ? __pfx_inet_sendmsg+0x10/0x10
[ 117.704555][ T9] ? sock_sendmsg_nosec+0xc2/0x180
[ 117.707182][ T9] ? sock_sendmsg+0x1ca/0x2d0
[ 117.709901][ T9] ? kvm_clock_get_cycles+0x47/0x60
[ 117.712068][ T9] ? __pfx_sock_sendmsg+0x10/0x10
[ 117.714543][ T9] ? clockevents_program_event+0x491/0x630
[ 117.717061][ T9] ? iov_iter_kvec+0xb8/0x180
[ 117.719403][ T9] ? ceph_con_flag_clear+0x38/0x50
[ 117.721588][ T9] ? ceph_con_v1_try_write+0x3808/0x3dc0
[ 117.724221][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.726444][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.728711][ T9] ? __mutex_trylock_common+0x15f/0x270
[ 117.731180][ T9] ? __pfx___mutex_trylock_common+0x10/0x10
[ 117.733737][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.735748][ T9] ? trace_contention_end+0x3d/0x140
[ 117.737845][ T9] ? __mutex_lock+0x30d/0x1550
[ 117.739994][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.742120][ T9] ? ceph_con_workfn+0x3b/0x14a0
[ 117.744290][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 117.746419][ T9] ? do_raw_spin_lock+0x12b/0x2f0
[ 117.749920][ T9] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 117.752213][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 117.754669][ T9] ceph_con_workfn+0x208/0x14a0
[ 117.756783][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.759021][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 117.761511][ T9] process_scheduled_works+0xa8e/0x14e0
[ 117.763852][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 117.766444][ T9] ? assign_work+0x3cf/0x5d0
[ 117.769115][ T9] worker_thread+0xa47/0xfb0
[ 117.771338][ T9] kthread+0x388/0x470
[ 117.773252][ T9] ? __pfx_worker_thread+0x10/0x10
[ 117.775366][ T9] ? __pfx_kthread+0x10/0x10
[ 117.777256][ T9] ret_from_fork+0x514/0xb70
[ 117.779369][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 117.781562][ T9] ? __switch_to+0xc89/0x1420
[ 117.783599][ T9] ? __pfx_kthread+0x10/0x10
[ 117.785541][ T9] ret_from_fork_asm+0x1a/0x30
[ 117.787539][ T9]
[ 117.788954][ T9] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 117.792065][ T9] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted syzkaller #0 PREEMPT(full)
[ 117.795938][ T9] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 117.799780][ T9] Workqueue: ceph-msgr ceph_con_workfn
[ 117.801958][ T9] Call Trace:
[ 117.803341][ T9]
[ 117.804541][ T9] vpanic+0x56c/0xa60
[ 117.806072][ T9] ? __pfx__printk+0x10/0x10
[ 117.808089][ T9] ? __pfx_vpanic+0x10/0x10
[ 117.809993][ T9] ? is_bpf_text_address+0x292/0x2b0
[ 117.812218][ T9] ? is_bpf_text_address+0x26/0x2b0
[ 117.814542][ T9] panic+0xc5/0xd0
[ 117.816190][ T9] ? __pfx_panic+0x10/0x10
[ 117.818151][ T9] ? ret_from_fork_asm+0x1a/0x30
[ 117.820248][ T9] __warn+0x315/0x4c0
[ 117.822001][ T9] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.824376][ T9] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.826706][ T9] __report_bug+0x276/0x570
[ 117.828674][ T9] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.831046][ T9] ? __pfx___report_bug+0x10/0x10
[ 117.833139][ T9] ? tcp_recvmsg+0x213/0x7f0
[ 117.835148][ T9] ? __local_bh_enable_ip+0xd0/0x130
[ 117.837430][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.839611][ T9] ? tcp_recvmsg+0x213/0x7f0
[ 117.841604][ T9] ? tcp_recvmsg+0x288/0x7f0
[ 117.843753][ T9] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.846276][ T9] report_bug+0x16a/0x220
[ 117.848149][ T9] ? ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.850586][ T9] ? ceph_con_v1_try_read+0x3337/0x6eb0
[ 117.853020][ T9] handle_bug+0x9c/0x200
[ 117.854946][ T9] exc_invalid_op+0x1a/0x50
[ 117.856874][ T9] asm_exc_invalid_op+0x1a/0x20
[ 117.859003][ T9] RIP: 0010:ceph_con_v1_try_read+0x3335/0x6eb0
[ 117.861595][ T9] Code: 45 31 e4 e9 3f d1 ff ff e8 68 d0 30 f6 90 0f 0b 90 e9 cd d3 ff ff e8 5a d0 30 f6 90 0f 0b 90 e9 dd e6 ff ff e8 4c d0 30 f6 90 <0f> 0b 90 e9 f4 e7 ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 30 d1
[ 117.869744][ T9] RSP: 0018:ffffc9000022f180 EFLAGS: 00010293
[ 117.872131][ T9] RAX: ffffffff8b9654e4 RBX: 0000000000000001 RCX: ffff88801bf0ca80
[ 117.875555][ T9] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
[ 117.879199][ T9] RBP: ffffc9000022fa78 R08: ffff88801bf0ca80 R09: 0000000000000009
[ 117.882557][ T9] R10: 000000000000000d R11: 0000000000000000 R12: ffff88803f070418
[ 117.886120][ T9] R13: fffff52000045e70 R14: dffffc0000000000 R15: 0000000000000000
[ 117.889491][ T9] ? ceph_con_v1_try_read+0x3334/0x6eb0
[ 117.891888][ T9] ? __tcp_push_pending_frames+0xd1/0x380
[ 117.894598][ T9] ? __pfx_ceph_con_v1_try_read+0x10/0x10
[ 117.897034][ T9] ? reacquire_held_locks+0x104/0x190
[ 117.899441][ T9] ? release_sock+0x2f/0x260
[ 117.901513][ T9] ? tcp_sendmsg+0x39/0x50
[ 117.903471][ T9] ? __local_bh_enable_ip+0xd0/0x130
[ 117.905693][ T9] ? lockdep_hardirqs_on+0x7a/0x110
[ 117.907991][ T9] ? __pfx_inet_sendmsg+0x10/0x10
[ 117.910210][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.912302][ T9] ? __pfx_inet_sendmsg+0x10/0x10
[ 117.914575][ T9] ? sock_sendmsg_nosec+0xc2/0x180
[ 117.917013][ T9] ? sock_sendmsg+0x1ca/0x2d0
[ 117.919354][ T9] ? kvm_clock_get_cycles+0x47/0x60
[ 117.921660][ T9] ? __pfx_sock_sendmsg+0x10/0x10
[ 117.923996][ T9] ? clockevents_program_event+0x491/0x630
[ 117.926561][ T9] ? iov_iter_kvec+0xb8/0x180
[ 117.928578][ T9] ? ceph_con_flag_clear+0x38/0x50
[ 117.930982][ T9] ? ceph_con_v1_try_write+0x3808/0x3dc0
[ 117.933409][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.935526][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.937928][ T9] ? __mutex_trylock_common+0x15f/0x270
[ 117.940562][ T9] ? __pfx___mutex_trylock_common+0x10/0x10
[ 117.943345][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.945841][ T9] ? trace_contention_end+0x3d/0x140
[ 117.948487][ T9] ? __mutex_lock+0x30d/0x1550
[ 117.950639][ T9] ? __lock_acquire+0x683/0x2cf0
[ 117.952817][ T9] ? ceph_con_workfn+0x3b/0x14a0
[ 117.954961][ T9] ? __pfx___mutex_lock+0x10/0x10
[ 117.956972][ T9] ? do_raw_spin_lock+0x12b/0x2f0
[ 117.958984][ T9] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 117.961265][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 117.963710][ T9] ceph_con_workfn+0x208/0x14a0
[ 117.965776][ T9] ? rcu_is_watching+0x15/0xb0
[ 117.967777][ T9] ? process_scheduled_works+0xa20/0x14e0
[ 117.970224][ T9] process_scheduled_works+0xa8e/0x14e0
[ 117.972643][ T9] ? __pfx_process_scheduled_works+0x10/0x10
[ 117.975205][ T9] ? assign_work+0x3cf/0x5d0
[ 117.977227][ T9] worker_thread+0xa47/0xfb0
[ 117.979342][ T9] kthread+0x388/0x470
[ 117.981166][ T9] ? __pfx_worker_thread+0x10/0x10
[ 117.983493][ T9] ? __pfx_kthread+0x10/0x10
[ 117.985532][ T9] ret_from_fork+0x514/0xb70
[ 117.987601][ T9] ? __pfx_ret_from_fork+0x10/0x10
[ 117.989852][ T9] ? __switch_to+0xc89/0x1420
[ 117.991969][ T9] ? __pfx_kthread+0x10/0x10
[ 117.994162][ T9] ret_from_fork_asm+0x1a/0x30
[ 117.996466][ T9]
[ 117.998357][ T9] Kernel Offset: disabled
[ 118.000233][ T9] Rebooting in 86400 seconds..