program:
r0 = socket(0x2, 0x1, 0x6)
bind(r0, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10)
syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff)
listen(r0, 0x1)
r1 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, &(0x7f0000000240)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, 0x0, 0x0, 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000380)='port\x00', &(0x7f00000003c0)='12345\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0)
r2 = accept(r0, 0x0, 0x0)
write(r2, &(0x7f0000000400)="00000088fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004100010010020000000000000000000000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000008000", 0x8c)
r3 = openat$sndseq(0xffffffffffffff9c, 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, 0x0)
ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r3, 0x4040534e, 0x0)
splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x5)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000))
[ 94.476008][ T5286] Bluetooth: hci0: command tx timeout
[ 94.609337][ T5323] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[ 94.697089][ T5323] CIFS: Attempting to mount //127.0.0.1/share
[ 94.751439][ T5331] CIFS: VFS: Invalid response size 0 for command 0
[ 94.762023][ T5331] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1
[ 95.420388][ T5323] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server
[ 95.428609][ T5323] ------------[ cut here ]------------
[ 95.431443][ T5323] server->in_flight == 0
[ 95.431457][ T5323] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5323
[ 95.438834][ T5323] Modules linked in:
[ 95.441383][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.445125][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.449806][ T5323] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 95.452297][ T5323] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c7 a4 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49
[ 95.460781][ T5323] RSP: 0018:ffffc9000f077318 EFLAGS: 00010246
[ 95.463300][ T5323] RAX: ffffffff830a8718 RBX: 1ffff110068b1461 RCX: 0000000000000002
[ 95.466508][ T5323] RDX: ffff88803889ca80 RSI: 0000000000000000 RDI: 0000000000000000
[ 95.469753][ T5323] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 95.472989][ T5323] R10: dffffc0000000000 R11: ffffffff830ab470 R12: ffff88803458a308
[ 95.476221][ T5323] R13: ffffc9000f077530 R14: ffff88803458a000 R15: 0000000000000000
[ 95.479425][ T5323] FS: 00007fa90522b6c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000
[ 95.483010][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 95.485612][ T5323] CR2: 000055b971ae1780 CR3: 0000000013700000 CR4: 0000000000352ef0
[ 95.488957][ T5323] Call Trace:
[ 95.490385][ T5323]
[ 95.491599][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.493743][ T5323] compound_send_recv+0x13b4/0x2b90
[ 95.495944][ T5323] ? __asan_memset+0x22/0x50
[ 95.497900][ T5323] ? __pfx_compound_send_recv+0x10/0x10
[ 95.500322][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.502341][ T5323] ? __mutex_unlock_slowpath+0x731/0x900
[ 95.505135][ T5323] ? cifs_strtoUTF16+0x315/0x400
[ 95.507160][ T5323] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.510082][ T5323] ? __pfx_cifs_strtoUTF16+0x10/0x10
[ 95.512108][ T5323] cifs_send_recv+0x42/0x60
[ 95.514166][ T5323] SMB2_negotiate+0x164d/0x4030
[ 95.516304][ T5323] ? __pfx_SMB2_negotiate+0x10/0x10
[ 95.518568][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.520696][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.522837][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 95.524934][ T5323] cifs_negotiate_protocol+0x45d/0x680
[ 95.527198][ T5323] cifs_get_smb_ses+0x1104/0x1ff0
[ 95.529476][ T5323] cifs_mount_get_session+0xf1/0x450
[ 95.531783][ T5323] dfs_mount_share+0x22e/0x990
[ 95.533769][ T5323] cifs_mount+0xcc/0xbf0
[ 95.535513][ T5323] ? __pfx_cifs_mount+0x10/0x10
[ 95.537369][ T5323] ? smb3_update_mnt_flags+0x2df/0x410
[ 95.540883][ T5323] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 95.542987][ T5323] cifs_smb3_do_mount+0x2d0/0x8a0
[ 95.545005][ T5323] ? smb3_get_tree+0x2bf/0x400
[ 95.547031][ T5323] ? __pfx___mutex_lock+0x10/0x10
[ 95.549194][ T5323] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 95.551454][ T5323] smb3_get_tree+0x2dd/0x400
[ 95.553380][ T5323] vfs_get_tree+0x92/0x2a0
[ 95.555411][ T5323] vfs_cmd_create+0xa2/0x200
[ 95.557402][ T5323] __se_sys_fsconfig+0x6b9/0x810
[ 95.559570][ T5323] ? __pfx___se_sys_fsconfig+0x10/0x10
[ 95.561786][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.563854][ T5323] ? __x64_sys_fsconfig+0x20/0xc0
[ 95.565949][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.568628][ T5323] do_syscall_64+0x174/0x580
[ 95.570742][ T5323] ? trace_irq_disable+0x3b/0x140
[ 95.572847][ T5323] ? clear_bhb_loop+0x40/0x90
[ 95.574742][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.577308][ T5323] RIP: 0033:0x7fa90439de99
[ 95.579269][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.587511][ T5323] RSP: 002b:00007fa90522afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
[ 95.590985][ T5323] RAX: ffffffffffffffda RBX: 00007fa904625fa0 RCX: 00007fa90439de99
[ 95.594084][ T5323] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
[ 95.597432][ T5323] RBP: 00007fa904433eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.600659][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.603832][ T5323] R13: 00007fa904626038 R14: 00007fa904625fa0 R15: 00007ffe288a3948
[ 95.607505][ T5323]
[ 95.609556][ T5323] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 95.612828][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.616591][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.621411][ T5323] Call Trace:
[ 95.622978][ T5323]
[ 95.624245][ T5323] vpanic+0x56c/0xa60
[ 95.626076][ T5323] ? __pfx__printk+0x10/0x10
[ 95.628007][ T5323] ? __pfx_vpanic+0x10/0x10
[ 95.629966][ T5323] ? is_bpf_text_address+0x292/0x2b0
[ 95.632065][ T5323] ? is_bpf_text_address+0x26/0x2b0
[ 95.634251][ T5323] panic+0xc5/0xd0
[ 95.635845][ T5323] ? __pfx_panic+0x10/0x10
[ 95.637735][ T5323] __warn+0x315/0x4c0
[ 95.639391][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 95.641558][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 95.643708][ T5323] __report_bug+0x276/0x570
[ 95.645782][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 95.647887][ T5323] ? __pfx___report_bug+0x10/0x10
[ 95.650012][ T5323] ? __lock_acquire+0x683/0x2cf0
[ 95.652070][ T5323] ? __pfx___schedule+0x10/0x10
[ 95.654407][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 95.656748][ T5323] report_bug+0x16a/0x220
[ 95.658583][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 95.661121][ T5323] ? smb2_add_credits+0x124b/0x2b70
[ 95.663959][ T5323] handle_bug+0x9c/0x200
[ 95.666288][ T5323] exc_invalid_op+0x1a/0x50
[ 95.668797][ T5323] asm_exc_invalid_op+0x1a/0x20
[ 95.671248][ T5323] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 95.673791][ T5323] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c7 a4 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49
[ 95.681426][ T5323] RSP: 0018:ffffc9000f077318 EFLAGS: 00010246
[ 95.684024][ T5323] RAX: ffffffff830a8718 RBX: 1ffff110068b1461 RCX: 0000000000000002
[ 95.687439][ T5323] RDX: ffff88803889ca80 RSI: 0000000000000000 RDI: 0000000000000000
[ 95.690631][ T5323] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 95.693804][ T5323] R10: dffffc0000000000 R11: ffffffff830ab470 R12: ffff88803458a308
[ 95.697166][ T5323] R13: ffffc9000f077530 R14: ffff88803458a000 R15: 0000000000000000
[ 95.700378][ T5323] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 95.702861][ T5323] ? smb2_add_credits+0x3f8/0x2b70
[ 95.705047][ T5323] ? smb2_add_credits+0x3f8/0x2b70
[ 95.707167][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.709257][ T5323] compound_send_recv+0x13b4/0x2b90
[ 95.711472][ T5323] ? __asan_memset+0x22/0x50
[ 95.713427][ T5323] ? __pfx_compound_send_recv+0x10/0x10
[ 95.715725][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.717720][ T5323] ? __mutex_unlock_slowpath+0x731/0x900
[ 95.719923][ T5323] ? cifs_strtoUTF16+0x315/0x400
[ 95.721896][ T5323] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 95.724339][ T5323] ? __pfx_cifs_strtoUTF16+0x10/0x10
[ 95.726512][ T5323] cifs_send_recv+0x42/0x60
[ 95.728390][ T5323] SMB2_negotiate+0x164d/0x4030
[ 95.730481][ T5323] ? __pfx_SMB2_negotiate+0x10/0x10
[ 95.732614][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.734745][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 95.736851][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 95.738824][ T5323] cifs_negotiate_protocol+0x45d/0x680
[ 95.741115][ T5323] cifs_get_smb_ses+0x1104/0x1ff0
[ 95.743175][ T5323] cifs_mount_get_session+0xf1/0x450
[ 95.745371][ T5323] dfs_mount_share+0x22e/0x990
[ 95.747367][ T5323] cifs_mount+0xcc/0xbf0
[ 95.749128][ T5323] ? __pfx_cifs_mount+0x10/0x10
[ 95.751195][ T5323] ? smb3_update_mnt_flags+0x2df/0x410
[ 95.753447][ T5323] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 95.755562][ T5323] cifs_smb3_do_mount+0x2d0/0x8a0
[ 95.757659][ T5323] ? smb3_get_tree+0x2bf/0x400
[ 95.759919][ T5323] ? __pfx___mutex_lock+0x10/0x10
[ 95.762040][ T5323] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 95.764536][ T5323] smb3_get_tree+0x2dd/0x400
[ 95.766438][ T5323] vfs_get_tree+0x92/0x2a0
[ 95.768335][ T5323] vfs_cmd_create+0xa2/0x200
[ 95.770241][ T5323] __se_sys_fsconfig+0x6b9/0x810
[ 95.772192][ T5323] ? __pfx___se_sys_fsconfig+0x10/0x10
[ 95.774394][ T5323] ? rcu_is_watching+0x15/0xb0
[ 95.776311][ T5323] ? __x64_sys_fsconfig+0x20/0xc0
[ 95.778343][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.780809][ T5323] do_syscall_64+0x174/0x580
[ 95.782800][ T5323] ? trace_irq_disable+0x3b/0x140
[ 95.784934][ T5323] ? clear_bhb_loop+0x40/0x90
[ 95.786873][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.789158][ T5323] RIP: 0033:0x7fa90439de99
[ 95.791094][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.798779][ T5323] RSP: 002b:00007fa90522afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af
[ 95.802137][ T5323] RAX: ffffffffffffffda RBX: 00007fa904625fa0 RCX: 00007fa90439de99
[ 95.805300][ T5323] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000005
[ 95.809221][ T5323] RBP: 00007fa904433eaf R08: 0000000000000000 R09: 0000000000000000
[ 95.812471][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.815763][ T5323] R13: 00007fa904626038 R14: 00007fa904625fa0 R15: 00007ffe288a3948
[ 95.819052][ T5323]
[ 95.820765][ T5323] Kernel Offset: disabled
[ 95.822574][ T5323] Rebooting in 86400 seconds..