Extracting prog: 1m52.87676712s Minimizing prog: 10m29.862019393s Simplifying prog options: 0s Extracting C: 48.132742134s Simplifying C: 11m59.269212264s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program crashed: WARNING in smb2_add_credits program crashed: WARNING in smb2_add_credits single: successfully extracted reproducer found reproducer with 7 syscalls minimizing guilty program testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(0xffffffffffffffff, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r0, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, 0x0, 0x0) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, 0x0, &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', 0x0, 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits simplifying C reproducer testing compiled C program (duration=40.885476544s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program did not crash testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing compiled C program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range program crashed: WARNING in smb2_add_credits testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program crashed: WARNING in smb2_add_credits validation run: crashed=true testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program crashed: WARNING in smb2_add_credits validation run: crashed=true testing program (duration=40.885476544s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-socket$inet_tcp-bind$inet-listen-mkdirat-mount-close_range detailed listing: executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x3039, @loopback}, 0x10) listen(r1, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./cifs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./cifs\x00', &(0x7f0000000240)='cifs\x00', 0x0, &(0x7f0000000300)='source=//127.0.0.1/test,username=root,password=root,port=12345,handletimeout=1\x00') close_range(r0, 0xffffffffffffffff, 0x0) program crashed: WARNING in smb2_add_credits validation run: crashed=true reproducing took 27m30.982251937s repro crashed as (corrupted=false): CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server ------------[ cut here ]------------ server->in_flight == 0 WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104, CPU#1: syz.3.34/6095 Modules linked in: CPU: 1 UID: 0 PID: 6095 Comm: syz.3.34 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104 Code: c6 e8 81 7d b1 fe 84 db 0f 85 0a fb ff ff e8 64 83 b1 fe 48 8d 3d 2d 28 f1 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 4e 83 b1 fe 90 <0f> 0b 90 0f b6 05 3c a0 d1 0d 31 ff 89 c6 88 44 24 28 e8 46 7d b1 RSP: 0018:ffffc900032df208 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88802d01e300 RCX: 0000000000000001 RDX: ffff888027710000 RSI: ffffffff83597e82 RDI: ffff888027710000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900032df448 R13: 0000000000000200 R14: 0000000000000001 R15: ffff88802d01e000 FS: 00007f4a783956c0(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4a775eb7c0 CR3: 000000002615a000 CR4: 0000000000352ef0 Call Trace: add_credits fs/smb/client/cifsglob.h:894 [inline] compound_send_recv+0x1030/0x2a10 fs/smb/client/transport.c:979 cifs_send_recv+0x43/0x60 fs/smb/client/transport.c:1106 SMB2_negotiate+0x15c4/0x5380 fs/smb/client/smb2pdu.c:1188 cifs_negotiate_protocol fs/smb/client/connect.c:4043 [inline] cifs_negotiate_protocol+0x268/0x4c0 fs/smb/client/connect.c:4014 cifs_get_smb_ses+0xfc9/0x2170 fs/smb/client/connect.c:2492 cifs_mount_get_session+0xf8/0x460 fs/smb/client/connect.c:3578 get_session fs/smb/client/dfs.c:65 [inline] dfs_mount_share+0x200/0x1e20 fs/smb/client/dfs.c:275 cifs_mount+0xc4/0xdb0 fs/smb/client/connect.c:3860 cifs_smb3_do_mount+0x2c0/0x1b10 fs/smb/client/cifsfs.c:1026 smb3_get_tree_common fs/smb/client/fs_context.c:897 [inline] smb3_get_tree fs/smb/client/fs_context.c:917 [inline] smb3_get_tree+0x1fd/0x440 fs/smb/client/fs_context.c:909 vfs_get_tree+0x92/0x320 fs/super.c:1947 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3772 [inline] do_new_mount fs/namespace.c:3848 [inline] path_mount+0x7d0/0x24c0 fs/namespace.c:4168 do_mount fs/namespace.c:4181 [inline] __do_sys_mount fs/namespace.c:4397 [inline] __se_sys_mount fs/namespace.c:4374 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4374 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4a7759e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4a78395028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f4a77825fa0 RCX: 00007f4a7759e0d9 RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000000000000000 RBP: 00007f4a77635024 R08: 0000200000000300 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f4a77826038 R14: 00007f4a77825fa0 R15: 00007ffc94a275c8 final repro crashed as (corrupted=false): CIFS: VFS: \\127.0.0.1 Error -104 sending data on socket to server ------------[ cut here ]------------ server->in_flight == 0 WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104, CPU#1: syz.3.34/6095 Modules linked in: CPU: 1 UID: 0 PID: 6095 Comm: syz.3.34 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104 Code: c6 e8 81 7d b1 fe 84 db 0f 85 0a fb ff ff e8 64 83 b1 fe 48 8d 3d 2d 28 f1 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 4e 83 b1 fe 90 <0f> 0b 90 0f b6 05 3c a0 d1 0d 31 ff 89 c6 88 44 24 28 e8 46 7d b1 RSP: 0018:ffffc900032df208 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffff88802d01e300 RCX: 0000000000000001 RDX: ffff888027710000 RSI: ffffffff83597e82 RDI: ffff888027710000 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900032df448 R13: 0000000000000200 R14: 0000000000000001 R15: ffff88802d01e000 FS: 00007f4a783956c0(0000) GS:ffff8880d5ca2000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4a775eb7c0 CR3: 000000002615a000 CR4: 0000000000352ef0 Call Trace: add_credits fs/smb/client/cifsglob.h:894 [inline] compound_send_recv+0x1030/0x2a10 fs/smb/client/transport.c:979 cifs_send_recv+0x43/0x60 fs/smb/client/transport.c:1106 SMB2_negotiate+0x15c4/0x5380 fs/smb/client/smb2pdu.c:1188 cifs_negotiate_protocol fs/smb/client/connect.c:4043 [inline] cifs_negotiate_protocol+0x268/0x4c0 fs/smb/client/connect.c:4014 cifs_get_smb_ses+0xfc9/0x2170 fs/smb/client/connect.c:2492 cifs_mount_get_session+0xf8/0x460 fs/smb/client/connect.c:3578 get_session fs/smb/client/dfs.c:65 [inline] dfs_mount_share+0x200/0x1e20 fs/smb/client/dfs.c:275 cifs_mount+0xc4/0xdb0 fs/smb/client/connect.c:3860 cifs_smb3_do_mount+0x2c0/0x1b10 fs/smb/client/cifsfs.c:1026 smb3_get_tree_common fs/smb/client/fs_context.c:897 [inline] smb3_get_tree fs/smb/client/fs_context.c:917 [inline] smb3_get_tree+0x1fd/0x440 fs/smb/client/fs_context.c:909 vfs_get_tree+0x92/0x320 fs/super.c:1947 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3772 [inline] do_new_mount fs/namespace.c:3848 [inline] path_mount+0x7d0/0x24c0 fs/namespace.c:4168 do_mount fs/namespace.c:4181 [inline] __do_sys_mount fs/namespace.c:4397 [inline] __se_sys_mount fs/namespace.c:4374 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4374 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4a7759e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4a78395028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f4a77825fa0 RCX: 00007f4a7759e0d9 RDX: 0000200000000240 RSI: 0000200000000200 RDI: 0000000000000000 RBP: 00007f4a77635024 R08: 0000200000000300 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f4a77826038 R14: 00007f4a77825fa0 R15: 00007ffc94a275c8