program:
syz_mount_image$squashfs(&(0x7f0000000940), &(0x7f00000001c0)='./file1\x00', 0x2000000, &(0x7f00000003c0)=ANY=[], 0x1, 0x183, &(0x7f0000000700)="$eJzskL9OKkEUxr/ZXfbCLW4uya1oILlGsVCWRY2x0RJ7H0ACKxIX/7AkAqFYYmFhYSx9Al7DxBfQwhBrOhMKKiuDmZ2zw8ArOL9iz+yZ73znnDkNroJfAL6m/SoOEGHiD14ZgwUgy0RuYoj4QPGN4r0IeCHdIeVvKGaCbu+s4vteK7eXQ3qemLHPmQCQmmB/YGASWY2m/So/HAPgKhtADfhIA1A15rsVNRJOQMYC/kVLzKSGK/jPGoBCu3lZCLq9jUazUvfq3rnrlnacLcfZdgsnDd9zxNemvXg5rQIe1wHw90opIyQox/mtnEFt49Honqm1tvKG+f9YwEBKnmMPhidZG/cxARxhFUkA1yGbZ0fCxUK0UhkMJv0ULWU+oUpGF5vVC792CwYWlw1hSY/iGAMq8D13jIS8Ke2GWGKFYpniUHlGTtZeTFiRwx395cN4xFaRCzvJ2LdTabdbri1Pf0MoRrzro7G43LOxPJtGo9FoNBqNRqPR/Di+AwAA//+9QXiK")
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1bd, @empty}, 0x10)
listen(r0, 0xa)
mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/share,user=root,pass=root,port=445,vers=3.0\x00')
r1 = accept(r0, 0x0, 0x0)
write(r1, &(0x7f0000000400)="00000080fe534d4240000000080000000000010001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000041000100000300000000000000000000000000000000000000000000000010000000100000001000000000000000000000000000000000008000000000000000", 0x84)
[ 93.251900][ T46] Bluetooth: hci0: command tx timeout
[ 93.265780][ T10] cfg80211: failed to load regulatory.db
[ 93.371737][ T5321] loop0: detected capacity change from 0 to 8
[ 93.475595][ T5321] CIFS: Attempting to mount //127.0.0.1/share
[ 93.523734][ T5323] CIFS: VFS: \\127.0.0.1 No task to wake, unknown frame received! NumMids 1
[ 94.097049][ T5321] CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server
[ 94.110304][ T5321] ------------[ cut here ]------------
[ 94.110318][ T5321] server->in_flight == 0
[ 94.110325][ T5321] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5321
[ 94.119217][ T5321] Modules linked in:
[ 94.121679][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.125547][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.130147][ T5321] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.133447][ T5321] Code: de 83 e6 01 31 ff e8 a6 26 b7 fe f6 c3 01 75 0a e8 9c 21 b7 fe e9 22 13 00 00 0f 1f 44 00 00 e8 8d 21 b7 fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c2 27 53 0d 01 0f 85 9e 03 00 00 e8 72 21 b7 fe 49
[ 94.141448][ T5321] RSP: 0018:ffffc9000dfdf238 EFLAGS: 00010246
[ 94.143980][ T5321] RAX: ffffffff8310b188 RBX: 1ffff110080ee461 RCX: ffff888033092580
[ 94.147289][ T5321] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.150623][ T5321] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.154082][ T5321] R10: dffffc0000000000 R11: ffffffff8310dee0 R12: ffff888040772308
[ 94.157471][ T5321] R13: ffffc9000dfdf450 R14: ffff888040772000 R15: 0000000000000000
[ 94.160834][ T5321] FS: 00007fa8814bb6c0(0000) GS:ffff88808c2c6000(0000) knlGS:0000000000000000
[ 94.164677][ T5321] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.167485][ T5321] CR2: 00007fa88149a9a0 CR3: 0000000043f4a000 CR4: 0000000000352ef0
[ 94.170864][ T5321] Call Trace:
[ 94.172390][ T5321]
[ 94.173687][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.175994][ T5321] compound_send_recv+0x13b4/0x2b90
[ 94.178303][ T5321] ? __pfx_compound_send_recv+0x10/0x10
[ 94.180848][ T5321] ? mempool_alloc_noprof+0x1bf/0x300
[ 94.183611][ T5321] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.186221][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.188419][ T5321] cifs_send_recv+0x42/0x60
[ 94.190564][ T5321] SMB2_negotiate+0x164d/0x4030
[ 94.192687][ T5321] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.194648][ T5321] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.196650][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.198867][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 94.201158][ T5321] cifs_negotiate_protocol+0x45d/0x680
[ 94.203435][ T5321] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.205642][ T5321] cifs_mount_get_session+0xf1/0x450
[ 94.208014][ T5321] dfs_mount_share+0x22e/0x990
[ 94.210276][ T5321] cifs_mount+0xcc/0xbf0
[ 94.212199][ T5321] ? __pfx_cifs_mount+0x10/0x10
[ 94.214389][ T5321] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.216827][ T5321] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.219200][ T5321] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.221429][ T5321] ? smb3_get_tree+0x2bf/0x400
[ 94.223608][ T5321] ? __pfx___mutex_lock+0x10/0x10
[ 94.225849][ T5321] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.228273][ T5321] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.231006][ T5321] smb3_get_tree+0x2dd/0x400
[ 94.233015][ T5321] vfs_get_tree+0x92/0x2a0
[ 94.235035][ T5321] do_new_mount+0x319/0xdc0
[ 94.237029][ T5321] ? __pfx_do_new_mount+0x10/0x10
[ 94.239551][ T5321] ? ns_capable+0x89/0xe0
[ 94.241611][ T5321] ? path_mount+0x647/0x1050
[ 94.243669][ T5321] ? user_path_at+0xd4/0x160
[ 94.245832][ T5321] __se_sys_mount+0x31d/0x420
[ 94.248113][ T5321] ? __pfx___se_sys_mount+0x10/0x10
[ 94.250605][ T5321] ? __x64_sys_mount+0x20/0xc0
[ 94.252767][ T5321] do_syscall_64+0x166/0x520
[ 94.254934][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.257709][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 94.260027][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.262940][ T5321] RIP: 0033:0x7fa88059e159
[ 94.264870][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.273222][ T5321] RSP: 002b:00007fa8814bafe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.276833][ T5321] RAX: ffffffffffffffda RBX: 00007fa880825fa0 RCX: 00007fa88059e159
[ 94.280465][ T5321] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000000000000000
[ 94.283924][ T5321] RBP: 00007fa88063503b R08: 0000200000000300 R09: 0000000000000000
[ 94.287842][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.291990][ T5321] R13: 00007fa880826038 R14: 00007fa880825fa0 R15: 00007ffdc32869b8
[ 94.296060][ T5321]
[ 94.297486][ T5321] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.300727][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.304477][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.308912][ T5321] Call Trace:
[ 94.310348][ T5321]
[ 94.311620][ T5321] vpanic+0x56d/0xa60
[ 94.313283][ T5321] ? __pfx__printk+0x10/0x10
[ 94.315140][ T5321] ? __pfx_vpanic+0x10/0x10
[ 94.317004][ T5321] ? is_bpf_text_address+0x292/0x2b0
[ 94.319073][ T5321] ? is_bpf_text_address+0x26/0x2b0
[ 94.321152][ T5321] panic+0xc5/0xd0
[ 94.322775][ T5321] ? __pfx_panic+0x10/0x10
[ 94.324808][ T5321] __warn+0x315/0x4c0
[ 94.326535][ T5321] ? smb2_add_credits+0x1249/0x2b70
[ 94.328703][ T5321] ? smb2_add_credits+0x1249/0x2b70
[ 94.330980][ T5321] __report_bug+0x276/0x570
[ 94.332996][ T5321] ? smb2_add_credits+0x1249/0x2b70
[ 94.335100][ T5321] ? __pfx___report_bug+0x10/0x10
[ 94.337142][ T5321] ? __lock_acquire+0x747/0x2de0
[ 94.339135][ T5321] ? __pfx___schedule+0x10/0x10
[ 94.341092][ T5321] ? smb2_add_credits+0x1249/0x2b70
[ 94.343186][ T5321] report_bug+0x16b/0x220
[ 94.345008][ T5321] ? smb2_add_credits+0x1249/0x2b70
[ 94.347103][ T5321] ? smb2_add_credits+0x124b/0x2b70
[ 94.350142][ T5321] handle_bug+0x9c/0x200
[ 94.352050][ T5321] exc_invalid_op+0x1a/0x50
[ 94.354254][ T5321] asm_exc_invalid_op+0x1a/0x20
[ 94.356449][ T5321] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.359082][ T5321] Code: de 83 e6 01 31 ff e8 a6 26 b7 fe f6 c3 01 75 0a e8 9c 21 b7 fe e9 22 13 00 00 0f 1f 44 00 00 e8 8d 21 b7 fe e9 13 13 00 00 90 <0f> 0b 90 80 3d c2 27 53 0d 01 0f 85 9e 03 00 00 e8 72 21 b7 fe 49
[ 94.367521][ T5321] RSP: 0018:ffffc9000dfdf238 EFLAGS: 00010246
[ 94.370117][ T5321] RAX: ffffffff8310b188 RBX: 1ffff110080ee461 RCX: ffff888033092580
[ 94.373564][ T5321] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.376942][ T5321] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.380272][ T5321] R10: dffffc0000000000 R11: ffffffff8310dee0 R12: ffff888040772308
[ 94.383660][ T5321] R13: ffffc9000dfdf450 R14: ffff888040772000 R15: 0000000000000000
[ 94.387072][ T5321] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 94.389517][ T5321] ? smb2_add_credits+0x3f8/0x2b70
[ 94.391760][ T5321] ? smb2_add_credits+0x3f8/0x2b70
[ 94.393950][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.396142][ T5321] compound_send_recv+0x13b4/0x2b90
[ 94.398347][ T5321] ? __pfx_compound_send_recv+0x10/0x10
[ 94.400756][ T5321] ? mempool_alloc_noprof+0x1bf/0x300
[ 94.403046][ T5321] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.405249][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.407481][ T5321] cifs_send_recv+0x42/0x60
[ 94.409544][ T5321] SMB2_negotiate+0x164d/0x4030
[ 94.411655][ T5321] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.414023][ T5321] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.416251][ T5321] ? do_raw_spin_unlock+0x4d/0x200
[ 94.418546][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 94.420668][ T5321] cifs_negotiate_protocol+0x45d/0x680
[ 94.423093][ T5321] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.425341][ T5321] cifs_mount_get_session+0xf1/0x450
[ 94.427689][ T5321] dfs_mount_share+0x22e/0x990
[ 94.429791][ T5321] cifs_mount+0xcc/0xbf0
[ 94.431798][ T5321] ? __pfx_cifs_mount+0x10/0x10
[ 94.433957][ T5321] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.436271][ T5321] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.438489][ T5321] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.440623][ T5321] ? smb3_get_tree+0x2bf/0x400
[ 94.442634][ T5321] ? __pfx___mutex_lock+0x10/0x10
[ 94.444646][ T5321] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.446751][ T5321] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.449561][ T5321] smb3_get_tree+0x2dd/0x400
[ 94.451659][ T5321] vfs_get_tree+0x92/0x2a0
[ 94.453633][ T5321] do_new_mount+0x319/0xdc0
[ 94.455450][ T5321] ? __pfx_do_new_mount+0x10/0x10
[ 94.457575][ T5321] ? ns_capable+0x89/0xe0
[ 94.459412][ T5321] ? path_mount+0x647/0x1050
[ 94.461432][ T5321] ? user_path_at+0xd4/0x160
[ 94.463488][ T5321] __se_sys_mount+0x31d/0x420
[ 94.465375][ T5321] ? __pfx___se_sys_mount+0x10/0x10
[ 94.467676][ T5321] ? __x64_sys_mount+0x20/0xc0
[ 94.469807][ T5321] do_syscall_64+0x166/0x520
[ 94.471817][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.474488][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 94.476639][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.479266][ T5321] RIP: 0033:0x7fa88059e159
[ 94.481244][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.489683][ T5321] RSP: 002b:00007fa8814bafe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.493478][ T5321] RAX: ffffffffffffffda RBX: 00007fa880825fa0 RCX: 00007fa88059e159
[ 94.496938][ T5321] RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000000000000000
[ 94.500464][ T5321] RBP: 00007fa88063503b R08: 0000200000000300 R09: 0000000000000000
[ 94.503823][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.507253][ T5321] R13: 00007fa880826038 R14: 00007fa880825fa0 R15: 00007ffdc32869b8
[ 94.510585][ T5321]
[ 94.512422][ T5321] Kernel Offset: disabled
[ 94.514364][ T5321] Rebooting in 86400 seconds..