program:
connect$unix(0xffffffffffffffff, 0x0, 0x0)
write(0xffffffffffffffff, &(0x7f0000000440)="29000000140005b7ff00", 0xa)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10)
listen(r0, 0xa)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='username=guest,password=guest,nodfs,vers=3.0\x00')
r1 = accept4$inet(r0, 0x0, 0x0, 0x0)
write(r1, &(0x7f0000000600)="00000081fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000008100000000000000000000000000000400000049fe534d4", 0x85)
openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0)
[ 87.318419][ T4652] Bluetooth: hci0: command tx timeout
[ 87.419860][ T5323] CIFS: Attempting to mount //127.0.0.1/share
[ 88.246836][ T5323] CIFS: VFS: \\127.0.0.1 Error -512 sending data on socket to server
[ 88.254608][ T5323] ------------[ cut here ]------------
[ 88.257249][ T5323] server->in_flight == 0
[ 88.257267][ T5323] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5323
[ 88.266054][ T5323] Modules linked in:
[ 88.268072][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.272157][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.276559][ T5323] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 88.279149][ T5323] Code: de 83 e6 01 31 ff e8 c6 7f bc fe f6 c3 01 75 0a e8 7c 7b bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 6d 7b bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc 9d 36 0d 01 0f 85 9e 03 00 00 e8 52 7b bc fe 49
[ 88.287956][ T5323] RSP: 0018:ffffc9000e4a7238 EFLAGS: 00010246
[ 88.290915][ T5323] RAX: ffffffff830a9928 RBX: 1ffff11002429461 RCX: 0000000000000002
[ 88.294356][ T5323] RDX: ffff8880004b4a80 RSI: 0000000000000000 RDI: 0000000000000000
[ 88.297677][ T5323] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 88.301091][ T5323] R10: dffffc0000000000 R11: ffffffff830ac680 R12: ffff88801214a308
[ 88.304709][ T5323] R13: ffffc9000e4a7450 R14: ffff88801214a000 R15: 0000000000000000
[ 88.308507][ T5323] FS: 00007f0cbcc196c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 88.312467][ T5323] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 88.315698][ T5323] CR2: 00007f0cbc025fc0 CR3: 0000000012239000 CR4: 0000000000352ef0
[ 88.319597][ T5323] Call Trace:
[ 88.321170][ T5323]
[ 88.322515][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.324721][ T5323] compound_send_recv+0x13b4/0x2b90
[ 88.326980][ T5323] ? __pfx_compound_send_recv+0x10/0x10
[ 88.329775][ T5323] ? rcu_is_watching+0x15/0xb0
[ 88.331885][ T5323] ? add_memory_resource+0x130/0xd00
[ 88.334222][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 88.336729][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.339167][ T5323] cifs_send_recv+0x42/0x60
[ 88.341200][ T5323] SMB2_negotiate+0x164d/0x4030
[ 88.343290][ T5323] ? __pfx_SMB2_negotiate+0x10/0x10
[ 88.345431][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 88.347881][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.350070][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 88.352281][ T5323] cifs_negotiate_protocol+0x45d/0x680
[ 88.354557][ T5323] cifs_get_smb_ses+0x1104/0x1ff0
[ 88.356566][ T5323] cifs_mount_get_session+0xf1/0x450
[ 88.358919][ T5323] dfs_mount_share+0x22e/0x990
[ 88.361050][ T5323] cifs_mount+0xcc/0xbf0
[ 88.362815][ T5323] ? __pfx_cifs_mount+0x10/0x10
[ 88.364819][ T5323] ? smb3_update_mnt_flags+0x2df/0x410
[ 88.366910][ T5323] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 88.369126][ T5323] cifs_smb3_do_mount+0x2d0/0x8a0
[ 88.371116][ T5323] ? smb3_get_tree+0x2bf/0x400
[ 88.373008][ T5323] ? __pfx___mutex_lock+0x10/0x10
[ 88.375199][ T5323] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 88.377644][ T5323] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 88.380771][ T5323] smb3_get_tree+0x2dd/0x400
[ 88.383009][ T5323] vfs_get_tree+0x92/0x2a0
[ 88.384831][ T5323] do_new_mount+0x319/0xdc0
[ 88.386766][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 88.390241][ T5323] ? ns_capable+0x89/0xe0
[ 88.392051][ T5323] ? path_mount+0x647/0x1040
[ 88.393915][ T5323] ? user_path_at+0xd4/0x160
[ 88.395868][ T5323] __se_sys_mount+0x31d/0x420
[ 88.398092][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 88.400488][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 88.402549][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.405072][ T5323] do_syscall_64+0x174/0x580
[ 88.407012][ T5323] ? trace_irq_disable+0x3b/0x140
[ 88.409225][ T5323] ? clear_bhb_loop+0x40/0x90
[ 88.412003][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.416044][ T5323] RIP: 0033:0x7f0cbbd9e0d9
[ 88.419146][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.427469][ T5323] RSP: 002b:00007f0cbcc18fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 88.431981][ T5323] RAX: ffffffffffffffda RBX: 00007f0cbc025fa0 RCX: 00007f0cbbd9e0d9
[ 88.435978][ T5323] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 88.439411][ T5323] RBP: 00007f0cbbe35024 R08: 0000200000000500 R09: 0000000000000000
[ 88.442700][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.446535][ T5323] R13: 00007f0cbc026038 R14: 00007f0cbc025fa0 R15: 00007fffce159198
[ 88.451208][ T5323]
[ 88.452607][ T5323] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 88.455685][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 88.459717][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 88.465141][ T5323] Call Trace:
[ 88.466994][ T5323]
[ 88.468397][ T5323] vpanic+0x56c/0xa60
[ 88.470238][ T5323] ? __pfx__printk+0x10/0x10
[ 88.472153][ T5323] ? __pfx_vpanic+0x10/0x10
[ 88.474526][ T5323] ? is_bpf_text_address+0x292/0x2b0
[ 88.477490][ T5323] ? is_bpf_text_address+0x26/0x2b0
[ 88.480129][ T5323] panic+0xc5/0xd0
[ 88.481952][ T5323] ? __pfx_panic+0x10/0x10
[ 88.484046][ T5323] __warn+0x315/0x4c0
[ 88.485900][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 88.488281][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 88.491436][ T5323] __report_bug+0x276/0x570
[ 88.494042][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 88.496916][ T5323] ? __pfx___report_bug+0x10/0x10
[ 88.499304][ T5323] ? __lock_acquire+0x683/0x2cf0
[ 88.501622][ T5323] ? __pfx___schedule+0x10/0x10
[ 88.503956][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 88.506535][ T5323] report_bug+0x16a/0x220
[ 88.508454][ T5323] ? smb2_add_credits+0x1249/0x2b70
[ 88.510706][ T5323] ? smb2_add_credits+0x124b/0x2b70
[ 88.513102][ T5323] handle_bug+0x9c/0x200
[ 88.515216][ T5323] exc_invalid_op+0x1a/0x50
[ 88.517449][ T5323] asm_exc_invalid_op+0x1a/0x20
[ 88.519986][ T5323] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 88.522745][ T5323] Code: de 83 e6 01 31 ff e8 c6 7f bc fe f6 c3 01 75 0a e8 7c 7b bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 6d 7b bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc 9d 36 0d 01 0f 85 9e 03 00 00 e8 52 7b bc fe 49
[ 88.531575][ T5323] RSP: 0018:ffffc9000e4a7238 EFLAGS: 00010246
[ 88.534432][ T5323] RAX: ffffffff830a9928 RBX: 1ffff11002429461 RCX: 0000000000000002
[ 88.538145][ T5323] RDX: ffff8880004b4a80 RSI: 0000000000000000 RDI: 0000000000000000
[ 88.542396][ T5323] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 88.546235][ T5323] R10: dffffc0000000000 R11: ffffffff830ac680 R12: ffff88801214a308
[ 88.550150][ T5323] R13: ffffc9000e4a7450 R14: ffff88801214a000 R15: 0000000000000000
[ 88.553904][ T5323] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 88.557020][ T5323] ? smb2_add_credits+0x3f8/0x2b70
[ 88.559544][ T5323] ? smb2_add_credits+0x3f8/0x2b70
[ 88.562629][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.565799][ T5323] compound_send_recv+0x13b4/0x2b90
[ 88.569023][ T5323] ? __pfx_compound_send_recv+0x10/0x10
[ 88.571717][ T5323] ? rcu_is_watching+0x15/0xb0
[ 88.574131][ T5323] ? add_memory_resource+0x130/0xd00
[ 88.576663][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 88.579666][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.582367][ T5323] cifs_send_recv+0x42/0x60
[ 88.584630][ T5323] SMB2_negotiate+0x164d/0x4030
[ 88.587034][ T5323] ? __pfx_SMB2_negotiate+0x10/0x10
[ 88.589904][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 88.592401][ T5323] ? do_raw_spin_unlock+0x4d/0x210
[ 88.595149][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 88.598243][ T5323] cifs_negotiate_protocol+0x45d/0x680
[ 88.602038][ T5323] cifs_get_smb_ses+0x1104/0x1ff0
[ 88.605039][ T5323] cifs_mount_get_session+0xf1/0x450
[ 88.607662][ T5323] dfs_mount_share+0x22e/0x990
[ 88.610049][ T5323] cifs_mount+0xcc/0xbf0
[ 88.612242][ T5323] ? __pfx_cifs_mount+0x10/0x10
[ 88.614700][ T5323] ? smb3_update_mnt_flags+0x2df/0x410
[ 88.617717][ T5323] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 88.620828][ T5323] cifs_smb3_do_mount+0x2d0/0x8a0
[ 88.623883][ T5323] ? smb3_get_tree+0x2bf/0x400
[ 88.626906][ T5323] ? __pfx___mutex_lock+0x10/0x10
[ 88.629435][ T5323] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 88.632190][ T5323] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 88.635454][ T5323] smb3_get_tree+0x2dd/0x400
[ 88.638168][ T5323] vfs_get_tree+0x92/0x2a0
[ 88.640870][ T5323] do_new_mount+0x319/0xdc0
[ 88.643526][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 88.646197][ T5323] ? ns_capable+0x89/0xe0
[ 88.648354][ T5323] ? path_mount+0x647/0x1040
[ 88.650729][ T5323] ? user_path_at+0xd4/0x160
[ 88.653110][ T5323] __se_sys_mount+0x31d/0x420
[ 88.655692][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 88.658038][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 88.660131][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.662748][ T5323] do_syscall_64+0x174/0x580
[ 88.664757][ T5323] ? trace_irq_disable+0x3b/0x140
[ 88.667344][ T5323] ? clear_bhb_loop+0x40/0x90
[ 88.670216][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.673282][ T5323] RIP: 0033:0x7f0cbbd9e0d9
[ 88.675217][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.684201][ T5323] RSP: 002b:00007f0cbcc18fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 88.688570][ T5323] RAX: ffffffffffffffda RBX: 00007f0cbc025fa0 RCX: 00007f0cbbd9e0d9
[ 88.692059][ T5323] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 88.695568][ T5323] RBP: 00007f0cbbe35024 R08: 0000200000000500 R09: 0000000000000000
[ 88.699211][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.702552][ T5323] R13: 00007f0cbc026038 R14: 00007f0cbc025fa0 R15: 00007fffce159198
[ 88.705885][ T5323]
[ 88.707976][ T5323] Kernel Offset: disabled
[ 88.710372][ T5323] Rebooting in 86400 seconds..