program:
socket$inet6_tcp(0xa, 0x1, 0x0)
bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000180)=ANY=[], 0x0, 0x28, 0xfffffffffffffda8, 0x0, 0x1f00, 0x22, '\x00', 0x0, 0x19, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x2c605, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000500050000002c0004800800010000000001200002800c000100706f6c69637930000805020000000002080003000000001e", 0x68}], 0x1}, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x804)
r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100, 0x2})
r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x6)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10)
listen(r3, 0x5)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='guest,vers=2.1\x00') (async)
accept4$inet(r3, 0x0, 0x0, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x1dcd6500}, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0})
r4 = dup3(r2, r1, 0x0)
r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r5, 0x0)
socket$key(0xf, 0x3, 0x2)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@handle={0x73682a85, 0xa, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0})
r6 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7})
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000000)={'wlan1\x00', 0x0})
io_uring_enter(r6, 0x34b7, 0x7721, 0x16, 0x0, 0x0)
[ 93.136855][ T44] Bluetooth: hci0: command tx timeout
[ 93.160802][ T9] cfg80211: failed to load regulatory.db
[ 93.234877][ T5330] netlink: 16 bytes leftover after parsing attributes in process `syz.0.0'.
[ 93.277454][ T5330] CIFS: Attempting to mount //127.0.0.1/share
[ 94.051001][ T5330] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server
[ 94.072999][ T5330] ------------[ cut here ]------------
[ 94.076381][ T5330] server->in_flight == 0
[ 94.076394][ T5330] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5330
[ 94.082593][ T5330] Modules linked in:
[ 94.085082][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.088903][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.093182][ T5330] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.095923][ T5330] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c8 94 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49
[ 94.105086][ T5330] RSP: 0018:ffffc9000f3f7238 EFLAGS: 00010246
[ 94.107722][ T5330] RAX: ffffffff830a9718 RBX: 1ffff11007ea7461 RCX: 0000000000000002
[ 94.111016][ T5330] RDX: ffff8880375f2540 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.114370][ T5330] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.117812][ T5330] R10: dffffc0000000000 R11: ffffffff830ac470 R12: ffff88803f53a308
[ 94.121263][ T5330] R13: ffffc9000f3f7450 R14: ffff88803f53a000 R15: 0000000000000000
[ 94.124619][ T5330] FS: 00007fdc472b06c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000
[ 94.128400][ T5330] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.131308][ T5330] CR2: 00007f7f5f78c468 CR3: 0000000012fa0000 CR4: 0000000000352ef0
[ 94.134811][ T5330] Call Trace:
[ 94.137757][ T5330]
[ 94.138939][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.140970][ T5330] compound_send_recv+0x13b4/0x2b90
[ 94.143116][ T5330] ? __pfx_compound_send_recv+0x10/0x10
[ 94.145625][ T5330] ? rcu_is_watching+0x15/0xb0
[ 94.147846][ T5330] ? add_memory_resource+0x1a0/0xd00
[ 94.150063][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.152359][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.154590][ T5330] cifs_send_recv+0x42/0x60
[ 94.156630][ T5330] SMB2_negotiate+0x164d/0x4030
[ 94.158752][ T5330] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.161310][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.163786][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.166194][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 94.168364][ T5330] cifs_negotiate_protocol+0x45d/0x680
[ 94.170773][ T5330] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.172996][ T5330] cifs_mount_get_session+0xf1/0x450
[ 94.175253][ T5330] dfs_mount_share+0x22e/0x990
[ 94.177381][ T5330] cifs_mount+0xcc/0xbf0
[ 94.179335][ T5330] ? __pfx_cifs_mount+0x10/0x10
[ 94.181480][ T5330] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.183967][ T5330] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.186181][ T5330] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.188211][ T5330] ? smb3_get_tree+0x2bf/0x400
[ 94.190230][ T5330] ? __pfx___mutex_lock+0x10/0x10
[ 94.192293][ T5330] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.194532][ T5330] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.197446][ T5330] smb3_get_tree+0x2dd/0x400
[ 94.199414][ T5330] vfs_get_tree+0x92/0x2a0
[ 94.201293][ T5330] do_new_mount+0x319/0xdc0
[ 94.203006][ T5330] ? __pfx_do_new_mount+0x10/0x10
[ 94.204830][ T5330] ? ns_capable+0x89/0xe0
[ 94.206471][ T5330] ? path_mount+0x647/0x1040
[ 94.208169][ T5330] ? user_path_at+0xd4/0x160
[ 94.210149][ T5330] __se_sys_mount+0x31d/0x420
[ 94.212828][ T5330] ? __pfx___se_sys_mount+0x10/0x10
[ 94.215006][ T5330] ? __x64_sys_mount+0x20/0xc0
[ 94.218314][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.220777][ T5330] do_syscall_64+0x174/0x580
[ 94.222702][ T5330] ? trace_irq_disable+0x3b/0x140
[ 94.224819][ T5330] ? clear_bhb_loop+0x40/0x90
[ 94.226927][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.229334][ T5330] RIP: 0033:0x7fdc4639df99
[ 94.231081][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.238616][ T5330] RSP: 002b:00007fdc472affe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.242141][ T5330] RAX: ffffffffffffffda RBX: 00007fdc46625fa0 RCX: 00007fdc4639df99
[ 94.245175][ T5330] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 94.248198][ T5330] RBP: 00007fdc46434ec4 R08: 0000200000000500 R09: 0000000000000000
[ 94.251293][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.254486][ T5330] R13: 00007fdc46626038 R14: 00007fdc46625fa0 R15: 00007ffd217c19e8
[ 94.257703][ T5330]
[ 94.258886][ T5330] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.261752][ T5330] CPU: 0 UID: 0 PID: 5330 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.265367][ T5330] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.269481][ T5330] Call Trace:
[ 94.270844][ T5330]
[ 94.272074][ T5330] vpanic+0x56c/0xa60
[ 94.273747][ T5330] ? __pfx__printk+0x10/0x10
[ 94.275876][ T5330] ? __pfx_vpanic+0x10/0x10
[ 94.279289][ T5330] ? is_bpf_text_address+0x292/0x2b0
[ 94.281804][ T5330] ? is_bpf_text_address+0x26/0x2b0
[ 94.284166][ T5330] panic+0xc5/0xd0
[ 94.286013][ T5330] ? __pfx_panic+0x10/0x10
[ 94.288206][ T5330] __warn+0x315/0x4c0
[ 94.289983][ T5330] ? smb2_add_credits+0x1249/0x2b70
[ 94.292106][ T5330] ? smb2_add_credits+0x1249/0x2b70
[ 94.294061][ T5330] __report_bug+0x276/0x570
[ 94.295969][ T5330] ? smb2_add_credits+0x1249/0x2b70
[ 94.298150][ T5330] ? __pfx___report_bug+0x10/0x10
[ 94.300328][ T5330] ? __lock_acquire+0x683/0x2cf0
[ 94.302224][ T5330] ? __pfx___schedule+0x10/0x10
[ 94.304169][ T5330] ? smb2_add_credits+0x1249/0x2b70
[ 94.306377][ T5330] report_bug+0x16a/0x220
[ 94.308170][ T5330] ? smb2_add_credits+0x1249/0x2b70
[ 94.310326][ T5330] ? smb2_add_credits+0x124b/0x2b70
[ 94.312473][ T5330] handle_bug+0x9c/0x200
[ 94.314204][ T5330] exc_invalid_op+0x1a/0x50
[ 94.316121][ T5330] asm_exc_invalid_op+0x1a/0x20
[ 94.318137][ T5330] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.320612][ T5330] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c8 94 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49
[ 94.327990][ T5330] RSP: 0018:ffffc9000f3f7238 EFLAGS: 00010246
[ 94.330387][ T5330] RAX: ffffffff830a9718 RBX: 1ffff11007ea7461 RCX: 0000000000000002
[ 94.333613][ T5330] RDX: ffff8880375f2540 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.336902][ T5330] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.340114][ T5330] R10: dffffc0000000000 R11: ffffffff830ac470 R12: ffff88803f53a308
[ 94.343216][ T5330] R13: ffffc9000f3f7450 R14: ffff88803f53a000 R15: 0000000000000000
[ 94.346318][ T5330] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 94.348662][ T5330] ? smb2_add_credits+0x3f8/0x2b70
[ 94.350643][ T5330] ? smb2_add_credits+0x3f8/0x2b70
[ 94.352553][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.354550][ T5330] compound_send_recv+0x13b4/0x2b90
[ 94.356752][ T5330] ? __pfx_compound_send_recv+0x10/0x10
[ 94.359224][ T5330] ? rcu_is_watching+0x15/0xb0
[ 94.361385][ T5330] ? add_memory_resource+0x1a0/0xd00
[ 94.363661][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.365821][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.367470][ T5330] cifs_send_recv+0x42/0x60
[ 94.369300][ T5330] SMB2_negotiate+0x164d/0x4030
[ 94.371273][ T5330] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.373409][ T5330] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.375404][ T5330] ? do_raw_spin_unlock+0x4d/0x210
[ 94.377242][ T5330] ? _raw_spin_unlock+0x28/0x50
[ 94.378923][ T5330] cifs_negotiate_protocol+0x45d/0x680
[ 94.380958][ T5330] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.383005][ T5330] cifs_mount_get_session+0xf1/0x450
[ 94.385153][ T5330] dfs_mount_share+0x22e/0x990
[ 94.387292][ T5330] cifs_mount+0xcc/0xbf0
[ 94.389052][ T5330] ? __pfx_cifs_mount+0x10/0x10
[ 94.390951][ T5330] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.393057][ T5330] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.395110][ T5330] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.397204][ T5330] ? smb3_get_tree+0x2bf/0x400
[ 94.399072][ T5330] ? __pfx___mutex_lock+0x10/0x10
[ 94.401109][ T5330] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.403338][ T5330] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.405865][ T5330] smb3_get_tree+0x2dd/0x400
[ 94.407796][ T5330] vfs_get_tree+0x92/0x2a0
[ 94.409695][ T5330] do_new_mount+0x319/0xdc0
[ 94.411600][ T5330] ? __pfx_do_new_mount+0x10/0x10
[ 94.413709][ T5330] ? ns_capable+0x89/0xe0
[ 94.415579][ T5330] ? path_mount+0x647/0x1040
[ 94.417576][ T5330] ? user_path_at+0xd4/0x160
[ 94.419571][ T5330] __se_sys_mount+0x31d/0x420
[ 94.421564][ T5330] ? __pfx___se_sys_mount+0x10/0x10
[ 94.423652][ T5330] ? __x64_sys_mount+0x20/0xc0
[ 94.425602][ T5330] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.427974][ T5330] do_syscall_64+0x174/0x580
[ 94.429776][ T5330] ? trace_irq_disable+0x3b/0x140
[ 94.431771][ T5330] ? clear_bhb_loop+0x40/0x90
[ 94.433694][ T5330] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.435992][ T5330] RIP: 0033:0x7fdc4639df99
[ 94.437777][ T5330] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.445634][ T5330] RSP: 002b:00007fdc472affe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.449098][ T5330] RAX: ffffffffffffffda RBX: 00007fdc46625fa0 RCX: 00007fdc4639df99
[ 94.452317][ T5330] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 94.455393][ T5330] RBP: 00007fdc46434ec4 R08: 0000200000000500 R09: 0000000000000000
[ 94.458685][ T5330] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.462556][ T5330] R13: 00007fdc46626038 R14: 00007fdc46625fa0 R15: 00007ffd217c19e8
[ 94.465960][ T5330]
[ 94.467832][ T5330] Kernel Offset: disabled
[ 94.469786][ T5330] Rebooting in 86400 seconds..