program:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x1bd, @loopback}, 0x10)
flistxattr(r0, &(0x7f0000000680)=""/253, 0xfd)
listen(r0, 0xa)
r1 = accept4$inet(r0, 0x0, 0x0, 0x0) (async)
write(r1, &(0x7f0000000600)="00000080fe534d424000000000000000000001000100000000000000000000000000000000000000000000000000000000000000000000004100010000030000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000008000000000000000", 0x84) (async)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000200)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000300)='./mnt\x00', &(0x7f0000000400)='cifs\x00', 0x0, &(0x7f0000000500)='username=guest,password=guest,nodfs\x00')
[ 93.818034][ T5329] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount.
[ 93.828245][ T5329] CIFS: Attempting to mount //127.0.0.1/share
[ 93.840491][ T44] Bluetooth: hci0: command tx timeout
[ 94.661363][ T5329] CIFS: VFS: \\127.0.0.1 Error -512 sending data on socket to server
[ 94.667893][ T5329] ------------[ cut here ]------------
[ 94.671157][ T5329] server->in_flight == 0
[ 94.671172][ T5329] WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1249/0x2b70, CPU#0: syz.0.0/5329
[ 94.678296][ T5329] Modules linked in:
[ 94.680119][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.685086][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.689364][ T5329] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.691918][ T5329] Code: de 83 e6 01 31 ff e8 86 8b bc fe f6 c3 01 75 0a e8 3c 87 bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 2d 87 bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc a2 36 0d 01 0f 85 9e 03 00 00 e8 12 87 bc fe 49
[ 94.699820][ T5329] RSP: 0018:ffffc9000e0e7238 EFLAGS: 00010246
[ 94.702370][ T5329] RAX: ffffffff830a8fa8 RBX: 1ffff110024e0c61 RCX: 0000000000000002
[ 94.705529][ T5329] RDX: ffff88803be02540 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.708706][ T5329] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.711835][ T5329] R10: dffffc0000000000 R11: ffffffff830abd00 R12: ffff888012706308
[ 94.714727][ T5329] R13: ffffc9000e0e7450 R14: ffff888012706000 R15: 0000000000000000
[ 94.717712][ T5329] FS: 00007f154b3c36c0(0000) GS:ffff88808c53f000(0000) knlGS:0000000000000000
[ 94.720501][ T5329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 94.722798][ T5329] CR2: 00007f154b3e49a0 CR3: 00000000129ad000 CR4: 0000000000352ef0
[ 94.725603][ T5329] Call Trace:
[ 94.726913][ T5329]
[ 94.728053][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 94.729939][ T5329] compound_send_recv+0x13b4/0x2b90
[ 94.731955][ T5329] ? __asan_memset+0x22/0x50
[ 94.733602][ T5329] ? __pfx_compound_send_recv+0x10/0x10
[ 94.735607][ T5329] ? rcu_is_watching+0x15/0xb0
[ 94.737398][ T5329] ? __mutex_unlock_slowpath+0x731/0x900
[ 94.739456][ T5329] ? cifs_strtoUTF16+0x315/0x400
[ 94.741394][ T5329] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 94.743784][ T5329] ? __pfx_cifs_strtoUTF16+0x10/0x10
[ 94.745544][ T5329] cifs_send_recv+0x42/0x60
[ 94.747232][ T5329] SMB2_negotiate+0x164d/0x4030
[ 94.749218][ T5329] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.751137][ T5329] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.752925][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 94.754733][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 94.756631][ T5329] cifs_negotiate_protocol+0x45d/0x680
[ 94.758598][ T5329] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.760504][ T5329] cifs_mount_get_session+0xf1/0x450
[ 94.762682][ T5329] dfs_mount_share+0x22e/0x990
[ 94.764543][ T5329] cifs_mount+0xcc/0xbf0
[ 94.766225][ T5329] ? __pfx_cifs_mount+0x10/0x10
[ 94.767980][ T5329] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.769984][ T5329] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.771943][ T5329] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.773773][ T5329] ? smb3_get_tree+0x2bf/0x400
[ 94.775602][ T5329] ? __pfx___mutex_lock+0x10/0x10
[ 94.777446][ T5329] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.779817][ T5329] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.782440][ T5329] smb3_get_tree+0x2dd/0x400
[ 94.784150][ T5329] vfs_get_tree+0x92/0x2a0
[ 94.785672][ T5329] do_new_mount+0x319/0xdc0
[ 94.787622][ T5329] ? __pfx_do_new_mount+0x10/0x10
[ 94.789504][ T5329] ? ns_capable+0x89/0xe0
[ 94.791168][ T5329] ? path_mount+0x647/0x1040
[ 94.792885][ T5329] ? user_path_at+0xd4/0x160
[ 94.794463][ T5329] __se_sys_mount+0x31d/0x420
[ 94.796127][ T5329] ? __pfx___se_sys_mount+0x10/0x10
[ 94.798043][ T5329] ? __x64_sys_mount+0x20/0xc0
[ 94.799666][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.801759][ T5329] do_syscall_64+0x174/0x580
[ 94.803359][ T5329] ? trace_irq_disable+0x3b/0x140
[ 94.805097][ T5329] ? clear_bhb_loop+0x40/0x90
[ 94.806793][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.808850][ T5329] RIP: 0033:0x7f154a59e019
[ 94.810562][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.818314][ T5329] RSP: 002b:00007f154b3c2fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.821699][ T5329] RAX: ffffffffffffffda RBX: 00007f154a826090 RCX: 00007f154a59e019
[ 94.824873][ T5329] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 94.827974][ T5329] RBP: 00007f154a63500c R08: 0000200000000500 R09: 0000000000000000
[ 94.831148][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.834290][ T5329] R13: 00007f154a826128 R14: 00007f154a826090 R15: 00007ffda3753e18
[ 94.837387][ T5329]
[ 94.838661][ T5329] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 94.841233][ T5329] CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.844446][ T5329] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.848557][ T5329] Call Trace:
[ 94.849845][ T5329]
[ 94.850968][ T5329] vpanic+0x56c/0xa60
[ 94.852451][ T5329] ? __pfx__printk+0x10/0x10
[ 94.854035][ T5329] ? __pfx_vpanic+0x10/0x10
[ 94.855625][ T5329] ? is_bpf_text_address+0x292/0x2b0
[ 94.857658][ T5329] ? is_bpf_text_address+0x26/0x2b0
[ 94.859720][ T5329] panic+0xc5/0xd0
[ 94.861132][ T5329] ? __pfx_panic+0x10/0x10
[ 94.862731][ T5329] __warn+0x315/0x4c0
[ 94.864282][ T5329] ? smb2_add_credits+0x1249/0x2b70
[ 94.866322][ T5329] ? smb2_add_credits+0x1249/0x2b70
[ 94.868280][ T5329] __report_bug+0x276/0x570
[ 94.869852][ T5329] ? smb2_add_credits+0x1249/0x2b70
[ 94.871583][ T5329] ? __pfx___report_bug+0x10/0x10
[ 94.873244][ T5329] ? __lock_acquire+0x683/0x2cf0
[ 94.875021][ T5329] ? __pfx___schedule+0x10/0x10
[ 94.877055][ T5329] ? smb2_add_credits+0x1249/0x2b70
[ 94.881500][ T5329] report_bug+0x16a/0x220
[ 94.883169][ T5329] ? smb2_add_credits+0x1249/0x2b70
[ 94.885510][ T5329] ? smb2_add_credits+0x124b/0x2b70
[ 94.887839][ T5329] handle_bug+0x9c/0x200
[ 94.889655][ T5329] exc_invalid_op+0x1a/0x50
[ 94.891497][ T5329] asm_exc_invalid_op+0x1a/0x20
[ 94.893401][ T5329] RIP: 0010:smb2_add_credits+0x1249/0x2b70
[ 94.895671][ T5329] Code: de 83 e6 01 31 ff e8 86 8b bc fe f6 c3 01 75 0a e8 3c 87 bc fe e9 22 13 00 00 0f 1f 44 00 00 e8 2d 87 bc fe e9 13 13 00 00 90 <0f> 0b 90 80 3d bc a2 36 0d 01 0f 85 9e 03 00 00 e8 12 87 bc fe 49
[ 94.904001][ T5329] RSP: 0018:ffffc9000e0e7238 EFLAGS: 00010246
[ 94.906573][ T5329] RAX: ffffffff830a8fa8 RBX: 1ffff110024e0c61 RCX: 0000000000000002
[ 94.909943][ T5329] RDX: ffff88803be02540 RSI: 0000000000000000 RDI: 0000000000000000
[ 94.914055][ T5329] RBP: 0000000000000200 R08: 0000000000000003 R09: 0000000000000004
[ 94.917117][ T5329] R10: dffffc0000000000 R11: ffffffff830abd00 R12: ffff888012706308
[ 94.920042][ T5329] R13: ffffc9000e0e7450 R14: ffff888012706000 R15: 0000000000000000
[ 94.923079][ T5329] ? __pfx_smb2_get_credits_field+0x10/0x10
[ 94.925357][ T5329] ? smb2_add_credits+0x3f8/0x2b70
[ 94.927380][ T5329] ? smb2_add_credits+0x3f8/0x2b70
[ 94.929319][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 94.931495][ T5329] compound_send_recv+0x13b4/0x2b90
[ 94.933641][ T5329] ? __asan_memset+0x22/0x50
[ 94.935535][ T5329] ? __pfx_compound_send_recv+0x10/0x10
[ 94.937946][ T5329] ? rcu_is_watching+0x15/0xb0
[ 94.939957][ T5329] ? __mutex_unlock_slowpath+0x731/0x900
[ 94.942380][ T5329] ? cifs_strtoUTF16+0x315/0x400
[ 94.944489][ T5329] ? __pfx___mutex_unlock_slowpath+0x10/0x10
[ 94.946998][ T5329] ? __pfx_cifs_strtoUTF16+0x10/0x10
[ 94.949124][ T5329] cifs_send_recv+0x42/0x60
[ 94.951072][ T5329] SMB2_negotiate+0x164d/0x4030
[ 94.953108][ T5329] ? __pfx_SMB2_negotiate+0x10/0x10
[ 94.955260][ T5329] ? do_raw_spin_lock+0x12b/0x2f0
[ 94.957236][ T5329] ? do_raw_spin_unlock+0x4d/0x210
[ 94.959219][ T5329] ? _raw_spin_unlock+0x28/0x50
[ 94.961234][ T5329] cifs_negotiate_protocol+0x45d/0x680
[ 94.963514][ T5329] cifs_get_smb_ses+0x1104/0x1ff0
[ 94.965563][ T5329] cifs_mount_get_session+0xf1/0x450
[ 94.967802][ T5329] dfs_mount_share+0x22e/0x990
[ 94.969787][ T5329] cifs_mount+0xcc/0xbf0
[ 94.971687][ T5329] ? __pfx_cifs_mount+0x10/0x10
[ 94.973646][ T5329] ? smb3_update_mnt_flags+0x2df/0x410
[ 94.975894][ T5329] ? cifs_setup_cifs_sb+0x5d8/0x900
[ 94.978043][ T5329] cifs_smb3_do_mount+0x2d0/0x8a0
[ 94.980202][ T5329] ? smb3_get_tree+0x2bf/0x400
[ 94.982230][ T5329] ? __pfx___mutex_lock+0x10/0x10
[ 94.984607][ T5329] ? __pfx_cifs_smb3_do_mount+0x10/0x10
[ 94.986969][ T5329] ? smb3_handle_conflicting_options+0x40f/0xbf0
[ 94.989404][ T5329] smb3_get_tree+0x2dd/0x400
[ 94.991309][ T5329] vfs_get_tree+0x92/0x2a0
[ 94.993231][ T5329] do_new_mount+0x319/0xdc0
[ 94.995013][ T5329] ? __pfx_do_new_mount+0x10/0x10
[ 94.996900][ T5329] ? ns_capable+0x89/0xe0
[ 94.998665][ T5329] ? path_mount+0x647/0x1040
[ 95.000563][ T5329] ? user_path_at+0xd4/0x160
[ 95.002621][ T5329] __se_sys_mount+0x31d/0x420
[ 95.004708][ T5329] ? __pfx___se_sys_mount+0x10/0x10
[ 95.007035][ T5329] ? __x64_sys_mount+0x20/0xc0
[ 95.009024][ T5329] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.011575][ T5329] do_syscall_64+0x174/0x580
[ 95.013525][ T5329] ? trace_irq_disable+0x3b/0x140
[ 95.015574][ T5329] ? clear_bhb_loop+0x40/0x90
[ 95.017544][ T5329] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.019921][ T5329] RIP: 0033:0x7f154a59e019
[ 95.021717][ T5329] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.030380][ T5329] RSP: 002b:00007f154b3c2fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.033758][ T5329] RAX: ffffffffffffffda RBX: 00007f154a826090 RCX: 00007f154a59e019
[ 95.037104][ T5329] RDX: 0000200000000400 RSI: 0000200000000300 RDI: 0000200000000200
[ 95.040384][ T5329] RBP: 00007f154a63500c R08: 0000200000000500 R09: 0000000000000000
[ 95.043701][ T5329] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.046971][ T5329] R13: 00007f154a826128 R14: 00007f154a826090 R15: 00007ffda3753e18
[ 95.050260][ T5329]
[ 95.052115][ T5329] Kernel Offset: disabled
[ 95.054004][ T5329] Rebooting in 86400 seconds..