program:
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000480)={0x73622a85, 0x0, 0x2})
r0 = socket$unix(0x1, 0x1, 0x0)
connect$unix(r0, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e)
listen(0xffffffffffffffff, 0x802)
r1 = socket$netlink(0x10, 0x3, 0x4)
write(r1, &(0x7f0000000440)="29000000140005b7ff000000040860eb0101b6ff02159f02c26ed638eeb738256e06a40e07fff0797e", 0x29)
r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0xffffffffffffff9a, 0x1000000, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000640)={0x8, 0x0, &(0x7f0000000000)=[@decrefs={0x400c6314}], 0x0, 0x0, 0x0})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r3, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10)
listen(r3, 0xa)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='username=guest,password=guest,nodfs,vers=3.0\x00')
accept4$inet(r3, 0x0, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0)
[ 86.757104][ T5324] CIFS: Attempting to mount //127.0.0.1/share
[ 86.800315][ T1367] cfg80211: failed to load regulatory.db
[ 86.893503][ T4653] Bluetooth: hci0: command tx timeout
[ 87.595602][ T5324] CIFS: VFS: \\127.0.0.1 Error -512 sending data on socket to server
[ 87.602496][ T5324] ------------[ cut here ]------------
[ 87.605579][ T5324] server->in_flight == 0
[ 87.605592][ T5324] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5324
[ 87.612503][ T5324] Modules linked in:
[ 87.614471][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.618986][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.623304][ T5324] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 87.626077][ T5324] Code: de 83 e6 01 31 ff e8 c6 7f bc fe f6 c3 01 75 0a e8 7c 7b bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 6d 7b bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc 9d 36 0d 01 0f 85 9e 03 00 00 e8 52 7b bc fe 49
[ 87.634762][ T5324] RSP: 0018:ffffc9000e5f7238 EFLAGS: 00010246
[ 87.637519][ T5324] RAX: ffffffff830a9928 RBX: 1ffff11006828861 RCX: 0000000000000002
[ 87.640893][ T5324] RDX: ffff8880007aca80 RSI: 0000000000000000 RDI: 0000000000000000
[ 87.644302][ T5324] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 87.647646][ T5324] R10: dffffc0000000000 R11: ffffffff830ac680 R12: ffff888034144308
[ 87.651162][ T5324] R13: ffffc9000e5f7450 R14: ffff888034144000 R15: 0000000000000000
[ 87.654667][ T5324] FS: 00007f980d6da6c0(0000) GS:ffff88808c540000(0000) knlGS:0000000000000000
[ 87.658537][ T5324] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 87.661297][ T5324] CR2: 000055b6476b4168 CR3: 0000000012ff4000 CR4: 0000000000352ef0
[ 87.664872][ T5324] Call Trace:
[ 87.666375][ T5324]
[ 87.667736][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.669956][ T5324] compound_send_recv+0x13b4/0x2b90
[ 87.672105][ T5324] ? __pfx_compound_send_recv+0x10/0x10
[ 87.674422][ T5324] ? rcu_is_watching+0x15/0xb0
[ 87.676365][ T5324] ? add_memory_resource+0x130/0xd00
[ 87.678515][ T5324] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.680681][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.682734][ T5324] cifs_send_recv+0x42/0x60
[ 87.685223][ T5324] SMB2_negotiate+0x164d/0x4030
[ 87.687465][ T5324] ? __pfx_SMB2_negotiate+0x10/0x10
[ 87.689959][ T5324] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.692336][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.694912][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.697307][ T5324] cifs_negotiate_protocol+0x45d/0x680
[ 87.699736][ T5324] cifs_get_smb_ses+0x1104/0x1ff0
[ 87.701997][ T5324] cifs_mount_get_session+0xf1/0x450
[ 87.704455][ T5324] dfs_mount_share+0x22e/0x990
[ 87.706583][ T5324] cifs_mount+0xcc/0xbf0
[ 87.708612][ T5324] ? __pfx_cifs_mount+0x10/0x10
[ 87.710880][ T5324] ? smb3_update_mnt_flags+0x2df/0x410
[ 87.713462][ T5324] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 87.715838][ T5324] cifs_smb3_do_mount+0x2d0/0x8a0
[ 87.718062][ T5324] ? smb3_get_tree+0x2bf/0x400
[ 87.720351][ T5324] ? __pfx___mutex_lock+0x10/0x10
[ 87.722664][ T5324] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 87.725324][ T5324] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 87.728396][ T5324] smb3_get_tree+0x2dd/0x400
[ 87.730786][ T5324] vfs_get_tree+0x92/0x2a0
[ 87.732790][ T5324] do_new_mount+0x319/0xdc0
[ 87.734847][ T5324] ? __pfx_do_new_mount+0x10/0x10
[ 87.737086][ T5324] ? ns_capable+0x89/0xe0
[ 87.739140][ T5324] ? path_mount+0x647/0x1040
[ 87.741219][ T5324] ? user_path_at+0xd4/0x160
[ 87.743401][ T5324] __se_sys_mount+0x31d/0x420
[ 87.745732][ T5324] ? __pfx___se_sys_mount+0x10/0x10
[ 87.748483][ T5324] ? __x64_sys_mount+0x20/0xc0
[ 87.750928][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.753688][ T5324] do_syscall_64+0x174/0x580
[ 87.756106][ T5324] ? trace_irq_disable+0x3b/0x140
[ 87.758494][ T5324] ? clear_bhb_loop+0x40/0x90
[ 87.760882][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.763777][ T5324] RIP: 0033:0x7f980c79e0d9
[ 87.766463][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.776128][ T5324] RSP: 002b:00007f980d6d9fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 87.780121][ T5324] RAX: ffffffffffffffda RBX: 00007f980ca25fa0 RCX: 00007f980c79e0d9
[ 87.783678][ T5324] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 87.787652][ T5324] RBP: 00007f980c835024 R08: 0000200000000500 R09: 0000000000000000
[ 87.791562][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.795031][ T5324] R13: 00007f980ca26038 R14: 00007f980ca25fa0 R15: 00007ffcb5f76de8
[ 87.798715][ T5324]
[ 87.800296][ T5324] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 87.803868][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.807758][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.812377][ T5324] Call Trace:
[ 87.813951][ T5324]
[ 87.815563][ T5324] vpanic+0x56c/0xa60
[ 87.817797][ T5324] ? __pfx__printk+0x10/0x10
[ 87.820447][ T5324] ? __pfx_vpanic+0x10/0x10
[ 87.822589][ T5324] ? is_bpf_text_address+0x292/0x2b0
[ 87.825037][ T5324] ? is_bpf_text_address+0x26/0x2b0
[ 87.827399][ T5324] panic+0xc5/0xd0
[ 87.829190][ T5324] ? __pfx_panic+0x10/0x10
[ 87.831563][ T5324] __warn+0x315/0x4c0
[ 87.833475][ T5324] ? smb2_add_credits+0x1249/0x2b70
[ 87.835828][ T5324] ? smb2_add_credits+0x1249/0x2b70
[ 87.838302][ T5324] __report_bug+0x276/0x570
[ 87.840778][ T5324] ? smb2_add_credits+0x1249/0x2b70
[ 87.843411][ T5324] ? __pfx___report_bug+0x10/0x10
[ 87.845810][ T5324] ? __lock_acquire+0x683/0x2cf0
[ 87.848112][ T5324] ? __pfx___schedule+0x10/0x10
[ 87.850199][ T5324] ? smb2_add_credits+0x1249/0x2b70
[ 87.852668][ T5324] report_bug+0x16a/0x220
[ 87.854955][ T5324] ? smb2_add_credits+0x1249/0x2b70
[ 87.857698][ T5324] ? smb2_add_credits+0x124b/0x2b70
[ 87.860087][ T5324] handle_bug+0x9c/0x200
[ 87.861999][ T5324] exc_invalid_op+0x1a/0x50
[ 87.863911][ T5324] asm_exc_invalid_op+0x1a/0x20
[ 87.865909][ T5324] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 87.868531][ T5324] Code: de 83 e6 01 31 ff e8 c6 7f bc fe f6 c3 01 75 0a e8 7c 7b bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 6d 7b bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc 9d 36 0d 01 0f 85 9e 03 00 00 e8 52 7b bc fe 49
[ 87.876910][ T5324] RSP: 0018:ffffc9000e5f7238 EFLAGS: 00010246
[ 87.879689][ T5324] RAX: ffffffff830a9928 RBX: 1ffff11006828861 RCX: 0000000000000002
[ 87.883603][ T5324] RDX: ffff8880007aca80 RSI: 0000000000000000 RDI: 0000000000000000
[ 87.887118][ T5324] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 87.890395][ T5324] R10: dffffc0000000000 R11: ffffffff830ac680 R12: ffff888034144308
[ 87.893858][ T5324] R13: ffffc9000e5f7450 R14: ffff888034144000 R15: 0000000000000000
[ 87.897877][ T5324] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 87.901283][ T5324] ? smb2_add_credits+0x3f8/0x2b70
[ 87.903632][ T5324] ? smb2_add_credits+0x3f8/0x2b70
[ 87.905879][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.908119][ T5324] compound_send_recv+0x13b4/0x2b90
[ 87.910657][ T5324] ? __pfx_compound_send_recv+0x10/0x10
[ 87.913308][ T5324] ? rcu_is_watching+0x15/0xb0
[ 87.915460][ T5324] ? add_memory_resource+0x130/0xd00
[ 87.917884][ T5324] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.920225][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.922536][ T5324] cifs_send_recv+0x42/0x60
[ 87.924662][ T5324] SMB2_negotiate+0x164d/0x4030
[ 87.927016][ T5324] ? __pfx_SMB2_negotiate+0x10/0x10
[ 87.929479][ T5324] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.932034][ T5324] ? do_raw_spin_unlock+0x4d/0x210
[ 87.934347][ T5324] ? _raw_spin_unlock+0x28/0x50
[ 87.936760][ T5324] cifs_negotiate_protocol+0x45d/0x680
[ 87.939189][ T5324] cifs_get_smb_ses+0x1104/0x1ff0
[ 87.941519][ T5324] cifs_mount_get_session+0xf1/0x450
[ 87.944199][ T5324] dfs_mount_share+0x22e/0x990
[ 87.946876][ T5324] cifs_mount+0xcc/0xbf0
[ 87.948944][ T5324] ? __pfx_cifs_mount+0x10/0x10
[ 87.951328][ T5324] ? smb3_update_mnt_flags+0x2df/0x410
[ 87.953865][ T5324] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 87.956443][ T5324] cifs_smb3_do_mount+0x2d0/0x8a0
[ 87.959040][ T5324] ? smb3_get_tree+0x2bf/0x400
[ 87.961522][ T5324] ? __pfx___mutex_lock+0x10/0x10
[ 87.963779][ T5324] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 87.966303][ T5324] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 87.969259][ T5324] smb3_get_tree+0x2dd/0x400
[ 87.971506][ T5324] vfs_get_tree+0x92/0x2a0
[ 87.973615][ T5324] do_new_mount+0x319/0xdc0
[ 87.975588][ T5324] ? __pfx_do_new_mount+0x10/0x10
[ 87.977760][ T5324] ? ns_capable+0x89/0xe0
[ 87.979516][ T5324] ? path_mount+0x647/0x1040
[ 87.981405][ T5324] ? user_path_at+0xd4/0x160
[ 87.983244][ T5324] __se_sys_mount+0x31d/0x420
[ 87.985525][ T5324] ? __pfx___se_sys_mount+0x10/0x10
[ 87.988042][ T5324] ? __x64_sys_mount+0x20/0xc0
[ 87.990485][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.993090][ T5324] do_syscall_64+0x174/0x580
[ 87.995222][ T5324] ? trace_irq_disable+0x3b/0x140
[ 87.997720][ T5324] ? clear_bhb_loop+0x40/0x90
[ 88.000228][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.003084][ T5324] RIP: 0033:0x7f980c79e0d9
[ 88.005222][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.014365][ T5324] RSP: 002b:00007f980d6d9fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 88.018295][ T5324] RAX: ffffffffffffffda RBX: 00007f980ca25fa0 RCX: 00007f980c79e0d9
[ 88.021912][ T5324] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 88.025909][ T5324] RBP: 00007f980c835024 R08: 0000200000000500 R09: 0000000000000000
[ 88.029673][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.033265][ T5324] R13: 00007f980ca26038 R14: 00007f980ca25fa0 R15: 00007ffcb5f76de8
[ 88.037049][ T5324]
[ 88.039006][ T5324] Kernel Offset: disabled
[ 88.041370][ T5324] Rebooting in 86400 seconds..