program: r0 = fsopen(&(0x7f0000000000)='ceph\x00', 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x4) r2 = socket$netlink(0x10, 0x3, 0xc) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x4000003, &(0x7f0000000080)={0xffffffffffffffff}, 0x106, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r5, 0x8001}}, 0x48) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r3, &(0x7f00000001c0)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x2, {0xa, 0x4e24, 0x1000, @loopback, 0x1}, r5}}, 0x38) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,port\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x4c}}, 0x0) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x48, 0x2, 0x6, 0x5, 0x0, 0x0, {0x2, 0x0, 0x7}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'list:set\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x44800}, 0x0) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x38, 0x9, 0x6, 0x5, 0x0, 0x0, {0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_NAME={0x9, 0x12, 'syz0\x00'}]}]}, 0x38}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000400)={0x28, 0x3, 0x6, 0x201, 0x0, 0x0, {0x0, 0x0, 0x2}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000004}, 0x2000c0a0) ioctl$F2FS_IOC_DECOMPRESS_FILE(r1, 0xf517, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi1\x00', 0x2, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f00000003c0), 0x1, 0x4040c0) ioctl$SNDRV_PCM_IOCTL_DRAIN(r7, 0x4144, 0x0) ioctl(r6, 0x40946400, &(0x7f0000000100)="70633231326500000000000000000000000000000003") fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000100)='source\x00', &(0x7f0000000200)='client.admin@00000000-0000-0000-0000-000000000000.ceph=/\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='mon_addr\x00', &(0x7f0000000140)='12;..0.1:678\xfb\x06\fs\x1fp+\n\xcb\x7f)\xf4\xb8Z\xf2\xa0J,}:1y3\r\xa9\xd5\xefQ\xc8\xdf\xf1?Z\xf0\xe3W !\xec\x8a\x11\xa4\x10\xd4cS\x02\x86V\xba\xa0\x9e\xbb\x94j\x90\xf7\xb3\xc2B5\xbdp\xad\xed\x1e\x97F\xbc\f\x9a\xe9\x1b\xbd\xb0\xe0#<\xc9\xf9\xed\"\x83U\xa4Z\'~B\xcb\x1efzv\xd7\x90E\x14,\xfaPh\xb2\\\t', 0x0) r8 = fsopen(&(0x7f00000002c0)='hfs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f00000004c0)='mount_timeout\x00\xbb[\x04\xf0g\xc4\xc9z\x9aL\x12\xd3G\xaf\xa2\x82\xd4]GMxj\x95\xcc\xf5\xc2M\xd2M\xc7\xa7:\xaeT\v\xedy\x137\b\x8d\x97\xc1\b\xd2\x05\xab\xcd\x057Dx<3', &(0x7f0000000380)='i \xa1@\x9a\xea\x851\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) [ 102.068948][ T46] Bluetooth: hci0: command tx timeout [ 102.239492][ T5326] genirq: Flags mismatch irq 1. 00200000 (pc212e) vs. 00200080 (i8042) [ 102.239550][ T5326] comedi comedi1: warning! irq 1 unavailable! [ 102.272624][ T5326] libceph: resolve '12;..0.1' (ret=-3): failed [ 102.301830][ T5326] ------------[ cut here ]------------ [ 102.301848][ T5326] kernel BUG at net/ceph/mon_client.c:211! [ 102.302209][ T5326] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 102.310114][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 102.316855][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 102.321358][ T5326] RIP: 0010:__open_session+0x799/0x940 [ 102.325876][ T5326] Code: ca fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c d0 fd ff ff be 04 00 00 00 4c 89 e7 e8 d2 53 97 f6 e9 be fd ff ff e8 e8 b3 25 f6 90 <0f> 0b 4d 89 ee 48 8b 04 24 42 0f b6 04 38 84 c0 0f 85 2f 01 00 00 [ 102.334600][ T5326] RSP: 0018:ffffc9000f147ae8 EFLAGS: 00010283 [ 102.337331][ T5326] RAX: ffffffff8ba227b8 RBX: ffff888012c94290 RCX: 0000000000100000 [ 102.340744][ T5326] RDX: ffffc9000f5d9000 RSI: 0000000000003563 RDI: 0000000000003564 [ 102.344126][ T5326] RBP: 00000000ffffffff R08: ffff8880330dcb00 R09: 0000000000000002 [ 102.347802][ T5326] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000 [ 102.351327][ T5326] R13: ffff888012c94400 R14: ffff888012c94298 R15: dffffc0000000000 [ 102.354897][ T5326] FS: 00007f65daf406c0(0000) GS:ffff88808c2c7000(0000) knlGS:0000000000000000 [ 102.358758][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.361688][ T5326] CR2: 00007f65da1f22e0 CR3: 0000000012870000 CR4: 0000000000352ef0 [ 102.365083][ T5326] Call Trace: [ 102.366546][ T5326] [ 102.367832][ T5326] ceph_monc_open_session+0x56/0x1a0 [ 102.370099][ T5326] __ceph_open_session+0x16d/0x5e0 [ 102.372191][ T5326] ? bdi_register_va+0x58d/0x740 [ 102.374255][ T5326] ? ceph_get_tree+0x885/0x1a40 [ 102.376364][ T5326] ? __pfx___mutex_lock+0x10/0x10 [ 102.378574][ T5326] ? __pfx___ceph_open_session+0x10/0x10 [ 102.380949][ T5326] ? __pfx_woken_wake_function+0x10/0x10 [ 102.383413][ T5326] ? ceph_mdsc_init+0xce5/0xde0 [ 102.385499][ T5326] ceph_get_tree+0xaef/0x1a40 [ 102.387541][ T5326] vfs_get_tree+0x92/0x2a0 [ 102.389881][ T5326] vfs_cmd_create+0xa2/0x200 [ 102.391930][ T5326] __se_sys_fsconfig+0x6b9/0x810 [ 102.394063][ T5326] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 102.396390][ T5326] ? rcu_is_watching+0x16/0xb0 [ 102.398458][ T5326] ? __x64_sys_fsconfig+0x20/0xc0 [ 102.400624][ T5326] do_syscall_64+0x166/0x520 [ 102.402732][ T5326] ? trace_irq_disable+0x3b/0x140 [ 102.404904][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.407520][ T5326] ? clear_bhb_loop+0x70/0xc0 [ 102.409604][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 102.412137][ T5326] RIP: 0033:0x7f65d9f9e159 [ 102.414129][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 102.422400][ T5326] RSP: 002b:00007f65daf3ffe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 102.425896][ T5326] RAX: ffffffffffffffda RBX: 00007f65da225fa0 RCX: 00007f65d9f9e159 [ 102.429855][ T5326] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000003 [ 102.433327][ T5326] RBP: 00007f65da03503b R08: 0000000000000000 R09: 0000000000000000 [ 102.436809][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 102.440538][ T5326] R13: 00007f65da226038 R14: 00007f65da225fa0 R15: 00007fff6462a2b8 [ 102.444664][ T5326] [ 102.446030][ T5326] Modules linked in: [ 102.448773][ T5326] ---[ end trace 0000000000000000 ]--- [ 102.456527][ T5326] RIP: 0010:__open_session+0x799/0x940 [ 102.456557][ T5326] Code: ca fd ff ff 44 89 e1 80 e1 07 38 c1 0f 8c d0 fd ff ff be 04 00 00 00 4c 89 e7 e8 d2 53 97 f6 e9 be fd ff ff e8 e8 b3 25 f6 90 <0f> 0b 4d 89 ee 48 8b 04 24 42 0f b6 04 38 84 c0 0f 85 2f 01 00 00 [ 102.456567][ T5326] RSP: 0018:ffffc9000f147ae8 EFLAGS: 00010283 [ 102.456578][ T5326] RAX: ffffffff8ba227b8 RBX: ffff888012c94290 RCX: 0000000000100000 [ 102.456586][ T5326] RDX: ffffc9000f5d9000 RSI: 0000000000003563 RDI: 0000000000003564 [ 102.456595][ T5326] RBP: 00000000ffffffff R08: ffff8880330dcb00 R09: 0000000000000002 [ 102.456603][ T5326] R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000000 [ 102.456610][ T5326] R13: ffff888012c94400 R14: ffff888012c94298 R15: dffffc0000000000 [ 102.456619][ T5326] FS: 00007f65daf406c0(0000) GS:ffff88808c2c7000(0000) knlGS:0000000000000000 [ 102.456627][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 102.456634][ T5326] CR2: 00007f65da1f22e0 CR3: 0000000012870000 CR4: 0000000000352ef0 [ 102.456677][ T5326] Kernel panic - not syncing: Fatal exception [ 102.503856][ T5326] Kernel Offset: disabled [ 102.505729][ T5326] Rebooting in 86400 seconds..