Extracting prog: 31m12.24973984s
Minimizing prog: 39m26.375987701s
Simplifying prog options: 0s
Extracting C: 40.428858543s
Simplifying C: 9m3.224491978s


extracting reproducer from 59 programs
testing a last program of every proc
single: executing 17 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): prlimit64-sched_setscheduler-prctl$PR_SCHED_CORE-getpid-sched_setscheduler-mmap-syz_clone-prctl$PR_SCHED_CORE-syz_open_dev$MSR-read$msr-ioctl$IOMMU_IOAS_ALLOC-ioctl$IOMMU_TEST_OP_MOCK_DOMAIN-ioctl$IOMMU_IOAS_MAP$PAGES
detailed listing:
executing program 0:
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000)
r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0)
r2 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0)
ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(0xffffffffffffffff, 0x3ba0, &(0x7f0000000740)={0x48})
ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f00000007c0)={0x28, 0x5, 0x0, 0x0, &(0x7f0000000000/0x800000)=nil, 0x800000, 0x1004000})

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS
detailed listing:
executing program 0:
r0 = socket$inet6_sctp(0xa, 0x1, 0x84)
setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10)
setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE-openat$tun-openat$nullb-openat-prctl$PR_SCHED_CORE-sched_setattr-sendfile-openat$nullb-sched_setattr-mremap-sendmsg$RDMA_NLDEV_CMD_STAT_GET-syz_open_dev$video-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setattr-openat$adsp1-ioctl$SNDCTL_DSP_SPEED-write$dsp-sendmsg$nl_xfrm-openat$cgroup_ro-ioctl$int_in
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x109180)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f0000000140)=0x8)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
sendfile(r3, r3, 0x0, 0x20000005)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x10000024, 0x3, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0x20fa11, 0x1}, 0x0)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x801)
syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, 0x0, 0x0)
sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x8, 0x4, 0x0, 0x9, 0x0, 0x100000000000006, 0xfa11, 0xffffffff}, 0x0)
r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000080))
write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x4000000)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$int_in(r4, 0x5452, &(0x7f0000000180)=0x7)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-prlimit64-sched_setscheduler-getpid-getpid-sched_setaffinity-sched_setscheduler-mmap-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-socket$inet_tcp-setsockopt$inet_tcp_TCP_REPAIR-setsockopt$inet_tcp_TCP_REPAIR_QUEUE-connect$inet-sendto
detailed listing:
executing program 0:
bpf$MAP_CREATE(0x0, 0x0, 0x50)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r0 = getpid()
getpid()
sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2)
sched_setscheduler(r0, 0x2, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000080)=0x1, 0x4)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000100)=0x2, 0x4)
connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x58}}, 0x10)
sendto(r3, &(0x7f0000000140)='A', 0xfffff, 0x40008c1, 0x0, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$nl_netfilter-sendmsg$NFT_BATCH-syz_open_dev$sndctrl-ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE-openat$tun-openat$nullb-openat-prctl$PR_SCHED_CORE-sched_setattr-sendfile-openat$nullb-sched_setattr-mremap-sendmsg$RDMA_NLDEV_CMD_STAT_GET-syz_open_dev$video-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-sched_setattr-openat$adsp1-ioctl$SNDCTL_DSP_SPEED-write$dsp-sendmsg$nl_xfrm-openat$cgroup_ro-ioctl$int_in
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000000600)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a28000000000a010200000000000000000200000908000240000000030900010073797a300000000098000000160a030000000000000000000200000a6c000380180003801400010064756d6d7930000000000000000000000800014000000000400003801400010073797a6b616c6c65723100000000000014000100697036677265746170edffadf3000000140001006970366772657461703000000000000008000240000000020900020073797a31000000000900010073797a300000000014000000110001"], 0xe8}, 0x1, 0x0, 0x0, 0x4000000}, 0x80)
r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x2, 0x109180)
ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r2, 0xc0045540, &(0x7f0000000140)=0x8)
openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0)
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x1c3902, 0x0)
openat(0xffffffffffffff9c, 0x0, 0x0, 0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x3, 0x0, 0x9, 0x1, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
sendfile(r3, r3, 0x0, 0x20000005)
openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0xa4242, 0x0)
sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x10000024, 0x3, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0x20fa11, 0x1}, 0x0)
mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x20}}, 0x801)
syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, 0x0, 0x0)
sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x0, 0x8, 0x4, 0x0, 0x9, 0x0, 0x100000000000006, 0xfa11, 0xffffffff}, 0x0)
r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0)
ioctl$SNDCTL_DSP_SPEED(r6, 0xc0045002, &(0x7f0000000080))
write$dsp(r6, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8801}, 0x4000000)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0)
ioctl$int_in(r4, 0x5452, &(0x7f0000000180)=0x7)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-ioctl$CEC_ADAP_S_LOG_ADDRS-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
r2 = syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0, &(0x7f0000000080)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}})
io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]})
close(r1)

program crashed: WARNING in smb2_add_credits
single: successfully extracted reproducer
found reproducer with 18 syscalls
minimizing guilty program
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-ioctl$CEC_ADAP_S_LOG_ADDRS
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
r2 = syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0, &(0x7f0000000080)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}})
io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0)
ioctl$CEC_ADAP_S_LOG_ADDRS(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000140)={"4497acf4", 0xb, 0x4, 0x0, 0x3, 0x1000006, "5500578ea5f4ffffffeb00001000", "1575b859", '\x00', '\'q6O', ["aabe8459c62224475793e8a7", "7f9ce2d2c4f439ff80e1d1c8", "fa0700f22b42a3023be516d1"]})

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-syz_io_uring_setup-syz_io_uring_submit-io_uring_enter-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
r2 = syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0, &(0x7f0000000080)=<r5=>0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}})
io_uring_enter(r2, 0x1000001, 0xfffffffd, 0x4b, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-syz_io_uring_setup-syz_io_uring_submit-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=<r2=>0x0, &(0x7f0000000140)=<r3=>0x0, &(0x7f0000000080)=<r4=>0x0)
syz_io_uring_submit(r2, r3, r4, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}})
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-syz_io_uring_setup-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000080))
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-recvmmsg-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000007c0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000006c0)=""/198, 0xc6}, 0x5}], 0x1, 0x40010082, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-bind$inet-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
bind$inet(0xffffffffffffffff, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-sendmsg$nl_route-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-sendto$inet-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030004e544c4d535350000200000000000000000000000002082000"/124, 0x7c, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
sendto$inet(0xffffffffffffffff, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0)
close(0xffffffffffffffff)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(0xffffffffffffffff, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') (async)
syz_emit_vhci(0x0, 0x0)
r0 = accept(0xffffffffffffffff, 0x0, 0x0)
sendto$inet(r0, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r0)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, 0x0, 0x0)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', 0x0, &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', 0x0, 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, 0x0)
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000), 0x0, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
simplifying C reproducer
testing compiled C program (duration=1m16.449913126s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program did not crash
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program did not crash
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
testing compiled C program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
program crashed: WARNING in smb2_add_credits
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
validation run: crashed=true
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
validation run: crashed=true
testing program (duration=1m16.449913126s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-listen-mkdirat-mount-syz_emit_vhci-accept-sendto$inet-recvfrom-close
detailed listing:
executing program 0:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10)
listen(r0, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff)
mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', &(0x7f0000000200)='cifs\x00', 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00')
syz_emit_vhci(0x0, 0x0)
r1 = accept(r0, 0x0, 0x0)
sendto$inet(r1, &(0x7f0000002000)="00000080fe534d42400001000000000000000100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000410001000003000000000000000000000000000000000000000000000000100000001000000010000000000000000000000000000000000000008000000000000000", 0x84, 0x0, 0x0, 0x0)
recvfrom(r1, 0x0, 0x0, 0x0, 0x0, 0x0)
close(r1)

program crashed: WARNING in smb2_add_credits
validation run: crashed=true
reproducing took 1h25m43.819662379s
repro crashed as (corrupted=false):
CIFS: VFS: \\127.0.0.1 Error -32 sending data on socket to server
------------[ cut here ]------------
server->in_flight == 0
WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104, CPU#1: syz.1.197/6735
Modules linked in:
CPU: 1 UID: 0 PID: 6735 Comm: syz.1.197 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104
Code: c6 e8 c1 64 b0 fe 84 db 0f 85 0a fb ff ff e8 a4 6a b0 fe 48 8d 3d ed e4 f0 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 8e 6a b0 fe 90 <0f> 0b 90 0f b6 05 29 5e d1 0d 31 ff 89 c6 88 44 24 28 e8 86 64 b0
RSP: 0018:ffffc900058ff1d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807d6e8300 RCX: 0000000000000001
RDX: ffff88802bd44b00 RSI: ffffffff835bb802 RDI: ffff88802bd44b00
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900058ff418
R13: 0000000000002000 R14: 0000000000000001 R15: ffff88807d6e8000
FS:  00007fcc55c406c0(0000) GS:ffff888123c53000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 000000007d108000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 add_credits fs/smb/client/cifsglob.h:894 [inline]
 compound_send_recv+0x1030/0x2a10 fs/smb/client/transport.c:978
 cifs_send_recv+0x43/0x60 fs/smb/client/transport.c:1105
 SMB2_sess_sendreceive+0x235/0x950 fs/smb/client/smb2pdu.c:1655
 SMB2_sess_auth_rawntlmssp_negotiate+0x775/0xbf0 fs/smb/client/smb2pdu.c:1851
 SMB2_sess_setup+0x314/0x640 fs/smb/client/smb2pdu.c:2045
 cifs_setup_session+0x434/0xfe0 fs/smb/client/connect.c:4170
 cifs_get_smb_ses+0x1813/0x2170 fs/smb/client/connect.c:2503
 cifs_mount_get_session+0xf8/0x460 fs/smb/client/connect.c:3587
 get_session fs/smb/client/dfs.c:65 [inline]
 dfs_mount_share+0x200/0x1e20 fs/smb/client/dfs.c:275
 cifs_mount+0xc4/0xdb0 fs/smb/client/connect.c:3869
 cifs_smb3_do_mount+0x2c0/0x1b10 fs/smb/client/cifsfs.c:1026
 smb3_get_tree_common fs/smb/client/fs_context.c:897 [inline]
 smb3_get_tree fs/smb/client/fs_context.c:917 [inline]
 smb3_get_tree+0x1fd/0x440 fs/smb/client/fs_context.c:909
 vfs_get_tree+0x92/0x320 fs/super.c:1933
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3772 [inline]
 do_new_mount fs/namespace.c:3848 [inline]
 path_mount+0x7d0/0x24c0 fs/namespace.c:4168
 do_mount fs/namespace.c:4181 [inline]
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount fs/namespace.c:4374 [inline]
 __x64_sys_mount+0x293/0x310 fs/namespace.c:4374
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcc54d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc55c40028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fcc55025fa0 RCX: 00007fcc54d9e159
RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500
RBP: 00007fcc54e3506b R08: 0000200000000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc55026038 R14: 00007fcc55025fa0 R15: 00007ffced69eff8
 </TASK>

final repro crashed as (corrupted=false):
CIFS: VFS: \\127.0.0.1 Error -32 sending data on socket to server
------------[ cut here ]------------
server->in_flight == 0
WARNING: fs/smb/client/smb2ops.c:104 at smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104, CPU#1: syz.1.197/6735
Modules linked in:
CPU: 1 UID: 0 PID: 6735 Comm: syz.1.197 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:smb2_add_credits+0x1213/0x1790 fs/smb/client/smb2ops.c:104
Code: c6 e8 c1 64 b0 fe 84 db 0f 85 0a fb ff ff e8 a4 6a b0 fe 48 8d 3d ed e4 f0 0d 67 48 0f b9 3a e9 f4 fa ff ff e8 8e 6a b0 fe 90 <0f> 0b 90 0f b6 05 29 5e d1 0d 31 ff 89 c6 88 44 24 28 e8 86 64 b0
RSP: 0018:ffffc900058ff1d8 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff88807d6e8300 RCX: 0000000000000001
RDX: ffff88802bd44b00 RSI: ffffffff835bb802 RDI: ffff88802bd44b00
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc900058ff418
R13: 0000000000002000 R14: 0000000000000001 R15: ffff88807d6e8000
FS:  00007fcc55c406c0(0000) GS:ffff888123c53000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 000000007d108000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 add_credits fs/smb/client/cifsglob.h:894 [inline]
 compound_send_recv+0x1030/0x2a10 fs/smb/client/transport.c:978
 cifs_send_recv+0x43/0x60 fs/smb/client/transport.c:1105
 SMB2_sess_sendreceive+0x235/0x950 fs/smb/client/smb2pdu.c:1655
 SMB2_sess_auth_rawntlmssp_negotiate+0x775/0xbf0 fs/smb/client/smb2pdu.c:1851
 SMB2_sess_setup+0x314/0x640 fs/smb/client/smb2pdu.c:2045
 cifs_setup_session+0x434/0xfe0 fs/smb/client/connect.c:4170
 cifs_get_smb_ses+0x1813/0x2170 fs/smb/client/connect.c:2503
 cifs_mount_get_session+0xf8/0x460 fs/smb/client/connect.c:3587
 get_session fs/smb/client/dfs.c:65 [inline]
 dfs_mount_share+0x200/0x1e20 fs/smb/client/dfs.c:275
 cifs_mount+0xc4/0xdb0 fs/smb/client/connect.c:3869
 cifs_smb3_do_mount+0x2c0/0x1b10 fs/smb/client/cifsfs.c:1026
 smb3_get_tree_common fs/smb/client/fs_context.c:897 [inline]
 smb3_get_tree fs/smb/client/fs_context.c:917 [inline]
 smb3_get_tree+0x1fd/0x440 fs/smb/client/fs_context.c:909
 vfs_get_tree+0x92/0x320 fs/super.c:1933
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3772 [inline]
 do_new_mount fs/namespace.c:3848 [inline]
 path_mount+0x7d0/0x24c0 fs/namespace.c:4168
 do_mount fs/namespace.c:4181 [inline]
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount fs/namespace.c:4374 [inline]
 __x64_sys_mount+0x293/0x310 fs/namespace.c:4374
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcc54d9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcc55c40028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fcc55025fa0 RCX: 00007fcc54d9e159
RDX: 0000200000000200 RSI: 0000200000000100 RDI: 0000200000000500
RBP: 00007fcc54e3506b R08: 0000200000000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcc55026038 R14: 00007fcc55025fa0 R15: 00007ffced69eff8
 </TASK>