program: mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/nd/drivers/nd_pmem/unbind\x00', 0x1, 0x0) close(r0) r1 = socket(0x2, 0x1, 0x6) bind(r1, &(0x7f00000000c0)=@in={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x1) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MIIMON={0x8, 0x3, 0x4}, @IFLA_BOND_UPDELAY={0x8, 0x4, 0x5}]}}}]}, 0x44}}, 0x0) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) r6 = fsopen(&(0x7f0000000140)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000180)='source\x00', &(0x7f00000001c0)='//127.0.0.1/share\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000200)='ip\x00', &(0x7f0000000240)='127.0.0.1\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000280)='username\x00', &(0x7f00000002c0)='guest\x00', 0x0) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000001580)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in=@private=0xa010100, @in=@empty, 0x4e24, 0x5, 0x0, 0x0, 0x0, 0x0, 0xa0, 0x87}, {@in=@empty, 0x0, 0x33}, @in6=@remote, {0x40000000000000, 0x3}, {}, {}, 0x0, 0x0, 0xa}, 0x0, 0x8000169d}}, 0xf8}}, 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000300)='password\x00', &(0x7f0000000340)='guest\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000380)='port\x00', &(0x7f00000003c0)='12345\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r8 = accept(r1, 0x0, 0x0) write(r8, &(0x7f0000000400)="00000088fe534d42400000000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004100010010020000000000000000000000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000000008000", 0x8c) close(0xffffffffffffffff) close(0xffffffffffffffff) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000000002000000000000000000000000000fe8000000000000000000000000000bb00000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000007000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000004400050020010000000000000000000000000000000000022b0000000a000000fc0100000000000000000000000000000000000004"], 0xfc}}, 0x0) syz_emit_ethernet(0x42, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0008004800003400000000000690780a210106ac1414aa8907e9e0000002070200000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5c2080009078c9e5352bbaaa07ce674d4eded9855a00003cb852f016447860a816db8bc60af130f721eed8d8106d965c6331de0027fabdead13295dc2e7df0dd1d98a0c77e43ac69a66c2d55d8e35445f10718d02c64949f9a091a753cee"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000280)='./sys/bus/nd/devices/pfn0.0/align\x00', 0x1, 0x0) [ 93.676323][ T4649] Bluetooth: hci0: command tx timeout [ 93.801643][ T5325] bond0: up delay (5) is not a multiple of miimon (4), value rounded to 4 ms [ 93.836065][ T5325] netlink: 'syz.0.0': attribute type 10 has an invalid length. [ 93.858690][ T5325] bridge0: port 2(bridge_slave_1) entered disabled state [ 93.862592][ T5325] bridge0: port 1(bridge_slave_0) entered disabled state [ 93.898467][ T5325] bridge0: port 2(bridge_slave_1) entered blocking state [ 93.902053][ T5325] bridge0: port 2(bridge_slave_1) entered forwarding state [ 93.905355][ T5325] bridge0: port 1(bridge_slave_0) entered blocking state [ 93.908166][ T5325] bridge0: port 1(bridge_slave_0) entered forwarding state [ 93.920251][ T5326] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 93.936253][ T5325] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 93.941429][ T5326] CIFS: Attempting to mount //127.0.0.1/share [ 93.982691][ T5330] CIFS: VFS: Invalid response size 0 for command 0 [ 93.988084][ T5330] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1 [ 93.994156][ T51] bond0: (slave bridge0): link status definitely up, 0 Mbps full duplex [ 94.597839][ T5326] ------------[ cut here ]------------ [ 94.601494][ T5326] server->in_flight == 0 [ 94.601507][ T5326] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5326 [ 94.608089][ T5326] Modules linked in: [ 94.610120][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.614030][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.618375][ T5326] RIP: 0010:smb2_add_credits+0x1249/0x2b70 [ 94.621068][ T5326] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c8 94 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49 [ 94.629023][ T5326] RSP: 0018:ffffc9000e13f318 EFLAGS: 00010246 [ 94.631396][ T5326] RAX: ffffffff830a9718 RBX: 1ffff1100674c461 RCX: 0000000000000002 [ 94.634587][ T5326] RDX: ffff8880008da540 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.637739][ T5326] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004 [ 94.641000][ T5326] R10: dffffc0000000000 R11: ffffffff830ac470 R12: ffff888033a62308 [ 94.644303][ T5326] R13: ffffc9000e13f530 R14: ffff888033a62000 R15: 0000000000000000 [ 94.647567][ T5326] FS: 00007fd8639c76c0(0000) GS:ffff88808c543000(0000) knlGS:0000000000000000 [ 94.651382][ T5326] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 94.654201][ T5326] CR2: 00007fd862deb0b0 CR3: 0000000012a9c000 CR4: 0000000000352ef0 [ 94.657705][ T5326] Call Trace: [ 94.659309][ T5326] [ 94.660664][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 94.662921][ T5326] compound_send_recv+0x13b4/0x2b90 [ 94.665158][ T5326] ? __asan_memset+0x22/0x50 [ 94.667219][ T5326] ? __pfx_compound_send_recv+0x10/0x10 [ 94.669719][ T5326] ? rcu_is_watching+0x15/0xb0 [ 94.671866][ T5326] ? __mutex_unlock_slowpath+0x731/0x900 [ 94.674767][ T5326] ? cifs_strtoUTF16+0x315/0x400 [ 94.676951][ T5326] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 94.679904][ T5326] ? __pfx_cifs_strtoUTF16+0x10/0x10 [ 94.682227][ T5326] cifs_send_recv+0x42/0x60 [ 94.684180][ T5326] SMB2_negotiate+0x164d/0x4030 [ 94.686355][ T5326] ? __pfx_SMB2_negotiate+0x10/0x10 [ 94.688374][ T5326] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.690394][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 94.692633][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 94.694741][ T5326] cifs_negotiate_protocol+0x45d/0x680 [ 94.697088][ T5326] cifs_get_smb_ses+0x1104/0x1ff0 [ 94.700347][ T5326] cifs_mount_get_session+0xf1/0x450 [ 94.702675][ T5326] dfs_mount_share+0x22e/0x990 [ 94.704827][ T5326] cifs_mount+0xcc/0xbf0 [ 94.706624][ T5326] ? __pfx_cifs_mount+0x10/0x10 [ 94.708747][ T5326] ? smb3_update_mnt_flags+0x2df/0x410 [ 94.711286][ T5326] ? cifs_setup_cifs_sb+0x5d8/0x900 [ 94.713605][ T5326] cifs_smb3_do_mount+0x2d0/0x8a0 [ 94.715826][ T5326] ? __pfx_cifs_smb3_do_mount+0x10/0x10 [ 94.718189][ T5326] smb3_get_tree+0x2dd/0x400 [ 94.720294][ T5326] vfs_get_tree+0x92/0x2a0 [ 94.722246][ T5326] vfs_cmd_create+0xa2/0x200 [ 94.724307][ T5326] __se_sys_fsconfig+0x6b9/0x810 [ 94.726475][ T5326] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 94.729050][ T5326] ? rcu_is_watching+0x15/0xb0 [ 94.731121][ T5326] ? __x64_sys_fsconfig+0x20/0xc0 [ 94.733321][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.736034][ T5326] do_syscall_64+0x174/0x580 [ 94.738096][ T5326] ? trace_irq_disable+0x3b/0x140 [ 94.740390][ T5326] ? clear_bhb_loop+0x40/0x90 [ 94.742456][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.749541][ T5326] RIP: 0033:0x7fd862b9df99 [ 94.751542][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.760001][ T5326] RSP: 002b:00007fd8639c6fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 94.763638][ T5326] RAX: ffffffffffffffda RBX: 00007fd862e26090 RCX: 00007fd862b9df99 [ 94.767009][ T5326] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 94.770442][ T5326] RBP: 00007fd862c34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.773821][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.777959][ T5326] R13: 00007fd862e26128 R14: 00007fd862e26090 R15: 00007ffe1a45f568 [ 94.782596][ T5326] [ 94.784015][ T5326] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 94.787182][ T5326] CPU: 0 UID: 0 PID: 5326 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.791108][ T5326] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.795439][ T5326] Call Trace: [ 94.796960][ T5326] [ 94.798304][ T5326] vpanic+0x56c/0xa60 [ 94.800094][ T5326] ? __pfx__printk+0x10/0x10 [ 94.802132][ T5326] ? __pfx_vpanic+0x10/0x10 [ 94.804174][ T5326] ? is_bpf_text_address+0x292/0x2b0 [ 94.806487][ T5326] ? is_bpf_text_address+0x26/0x2b0 [ 94.808764][ T5326] panic+0xc5/0xd0 [ 94.810424][ T5326] ? __pfx_panic+0x10/0x10 [ 94.812473][ T5326] __warn+0x315/0x4c0 [ 94.814235][ T5326] ? smb2_add_credits+0x1249/0x2b70 [ 94.816589][ T5326] ? smb2_add_credits+0x1249/0x2b70 [ 94.818894][ T5326] __report_bug+0x276/0x570 [ 94.820942][ T5326] ? smb2_add_credits+0x1249/0x2b70 [ 94.823211][ T5326] ? __pfx___report_bug+0x10/0x10 [ 94.825418][ T5326] ? __lock_acquire+0x683/0x2cf0 [ 94.827506][ T5326] ? __pfx___schedule+0x10/0x10 [ 94.829629][ T5326] ? smb2_add_credits+0x1249/0x2b70 [ 94.831896][ T5326] report_bug+0x16a/0x220 [ 94.833840][ T5326] ? smb2_add_credits+0x1249/0x2b70 [ 94.836223][ T5326] ? smb2_add_credits+0x124b/0x2b70 [ 94.838490][ T5326] handle_bug+0x9c/0x200 [ 94.840353][ T5326] exc_invalid_op+0x1a/0x50 [ 94.842416][ T5326] asm_exc_invalid_op+0x1a/0x20 [ 94.844613][ T5326] RIP: 0010:smb2_add_credits+0x1249/0x2b70 [ 94.847156][ T5326] Code: de 83 e6 01 31 ff e8 46 83 bc fe f6 c3 01 75 0a e8 fc 7e bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 ed 7e bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c8 94 36 0d 01 0f 85 9e 03 00 00 e8 d2 7e bc fe 49 [ 94.855517][ T5326] RSP: 0018:ffffc9000e13f318 EFLAGS: 00010246 [ 94.858118][ T5326] RAX: ffffffff830a9718 RBX: 1ffff1100674c461 RCX: 0000000000000002 [ 94.861585][ T5326] RDX: ffff8880008da540 RSI: 0000000000000000 RDI: 0000000000000000 [ 94.865056][ T5326] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004 [ 94.868616][ T5326] R10: dffffc0000000000 R11: ffffffff830ac470 R12: ffff888033a62308 [ 94.872013][ T5326] R13: ffffc9000e13f530 R14: ffff888033a62000 R15: 0000000000000000 [ 94.875485][ T5326] ? __pfx_smb2_get_credits_field+0x10/0x10 [ 94.878133][ T5326] ? smb2_add_credits+0x3f8/0x2b70 [ 94.880382][ T5326] ? smb2_add_credits+0x3f8/0x2b70 [ 94.882693][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 94.884907][ T5326] compound_send_recv+0x13b4/0x2b90 [ 94.887211][ T5326] ? __asan_memset+0x22/0x50 [ 94.889269][ T5326] ? __pfx_compound_send_recv+0x10/0x10 [ 94.891756][ T5326] ? rcu_is_watching+0x15/0xb0 [ 94.893917][ T5326] ? __mutex_unlock_slowpath+0x731/0x900 [ 94.896252][ T5326] ? cifs_strtoUTF16+0x315/0x400 [ 94.898390][ T5326] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 94.900899][ T5326] ? __pfx_cifs_strtoUTF16+0x10/0x10 [ 94.903154][ T5326] cifs_send_recv+0x42/0x60 [ 94.905167][ T5326] SMB2_negotiate+0x164d/0x4030 [ 94.907278][ T5326] ? __pfx_SMB2_negotiate+0x10/0x10 [ 94.909562][ T5326] ? do_raw_spin_lock+0x12b/0x2f0 [ 94.911715][ T5326] ? do_raw_spin_unlock+0x4d/0x210 [ 94.914025][ T5326] ? _raw_spin_unlock+0x28/0x50 [ 94.916227][ T5326] cifs_negotiate_protocol+0x45d/0x680 [ 94.918643][ T5326] cifs_get_smb_ses+0x1104/0x1ff0 [ 94.920732][ T5326] cifs_mount_get_session+0xf1/0x450 [ 94.922987][ T5326] dfs_mount_share+0x22e/0x990 [ 94.925072][ T5326] cifs_mount+0xcc/0xbf0 [ 94.926946][ T5326] ? __pfx_cifs_mount+0x10/0x10 [ 94.929044][ T5326] ? smb3_update_mnt_flags+0x2df/0x410 [ 94.931383][ T5326] ? cifs_setup_cifs_sb+0x5d8/0x900 [ 94.933656][ T5326] cifs_smb3_do_mount+0x2d0/0x8a0 [ 94.935883][ T5326] ? __pfx_cifs_smb3_do_mount+0x10/0x10 [ 94.938216][ T5326] smb3_get_tree+0x2dd/0x400 [ 94.940235][ T5326] vfs_get_tree+0x92/0x2a0 [ 94.942115][ T5326] vfs_cmd_create+0xa2/0x200 [ 94.944116][ T5326] __se_sys_fsconfig+0x6b9/0x810 [ 94.946207][ T5326] ? __pfx___se_sys_fsconfig+0x10/0x10 [ 94.948434][ T5326] ? rcu_is_watching+0x15/0xb0 [ 94.950357][ T5326] ? __x64_sys_fsconfig+0x20/0xc0 [ 94.952564][ T5326] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.955123][ T5326] do_syscall_64+0x174/0x580 [ 94.957079][ T5326] ? trace_irq_disable+0x3b/0x140 [ 94.959218][ T5326] ? clear_bhb_loop+0x40/0x90 [ 94.961237][ T5326] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.963677][ T5326] RIP: 0033:0x7fd862b9df99 [ 94.965545][ T5326] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.973593][ T5326] RSP: 002b:00007fd8639c6fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 94.977105][ T5326] RAX: ffffffffffffffda RBX: 00007fd862e26090 RCX: 00007fd862b9df99 [ 94.980428][ T5326] RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000007 [ 94.983781][ T5326] RBP: 00007fd862c34ec4 R08: 0000000000000000 R09: 0000000000000000 [ 94.987103][ T5326] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.990488][ T5326] R13: 00007fd862e26128 R14: 00007fd862e26090 R15: 00007ffe1a45f568 [ 94.993783][ T5326] [ 94.995539][ T5326] Kernel Offset: disabled [ 94.997376][ T5326] Rebooting in 86400 seconds..