program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/370, 0x172, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x0, 0x0)
[ 124.477311][ T4648] Bluetooth: hci0: command tx timeout
[ 124.535330][ T5321] ==================================================================
[ 124.535346][ T5321] BUG: KASAN: slab-out-of-bounds in ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.535460][ T5321] Read of size 4 at addr ffff8880128e5a98 by task syz.0.0/5321
[ 124.535480][ T5321]
[ 124.535500][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.535527][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.535534][ T5321] Call Trace:
[ 124.535548][ T5321]
[ 124.535563][ T5321] dump_stack_lvl+0xe8/0x150
[ 124.535582][ T5321] print_address_description+0x55/0x1e0
[ 124.535600][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.535613][ T5321] print_report+0x58/0x70
[ 124.535626][ T5321] kasan_report+0x117/0x150
[ 124.535639][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.535655][ T5321] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.535676][ T5321] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 124.535695][ T5321] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 124.535710][ T5321] ? d_alloc_parallel+0x1535/0x16b0
[ 124.535730][ T5321] ecryptfs_lookup+0x20e/0x780
[ 124.535747][ T5321] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 124.535761][ T5321] ? d_lookup+0x1f/0xa0
[ 124.535776][ T5321] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 124.535791][ T5321] lookup_open+0x9e1/0x1a40
[ 124.535814][ T5321] path_openat+0x677/0x1d60
[ 124.535835][ T5321] do_file_open+0x23e/0x4a0
[ 124.535851][ T5321] ? __pfx_do_file_open+0x10/0x10
[ 124.535873][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 124.535932][ T5321] ? alloc_fd+0x651/0x6c0
[ 124.535949][ T5321] do_sys_openat2+0x115/0x200
[ 124.535962][ T5321] ? __se_sys_futex+0x3a8/0x450
[ 124.535978][ T5321] ? __pfx_do_sys_openat2+0x10/0x10
[ 124.535992][ T5321] ? rcu_is_watching+0x16/0xb0
[ 124.536016][ T5321] __x64_sys_openat+0x138/0x170
[ 124.536033][ T5321] do_syscall_64+0x166/0x520
[ 124.536048][ T5321] ? trace_irq_disable+0x3b/0x140
[ 124.536060][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.536072][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 124.536085][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.536097][ T5321] RIP: 0033:0x7f326779e159
[ 124.536110][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.536135][ T5321] RSP: 002b:00007f3268696fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 124.536150][ T5321] RAX: ffffffffffffffda RBX: 00007f3267a25fa0 RCX: 00007f326779e159
[ 124.536160][ T5321] RDX: 0000000000000000 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 124.536169][ T5321] RBP: 00007f326783506b R08: 0000000000000000 R09: 0000000000000000
[ 124.536177][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.536185][ T5321] R13: 00007f3267a26038 R14: 00007f3267a25fa0 R15: 00007fffc6875f28
[ 124.536198][ T5321]
[ 124.536202][ T5321]
[ 124.536205][ T5321] Allocated by task 5321:
[ 124.536222][ T5321] kasan_save_track+0x3e/0x80
[ 124.536242][ T5321] __kasan_kmalloc+0x93/0xb0
[ 124.536253][ T5321] __kmalloc_noprof+0x36b/0x720
[ 124.536270][ T5321] user_preparse+0x9e/0x160
[ 124.536282][ T5321] __key_create_or_update+0x3a9/0xa80
[ 124.536295][ T5321] key_create_or_update+0x42/0x60
[ 124.536305][ T5321] __se_sys_add_key+0x349/0x420
[ 124.536319][ T5321] do_syscall_64+0x166/0x520
[ 124.536329][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.536339][ T5321]
[ 124.536341][ T5321] The buggy address belongs to the object at ffff8880128e5800
[ 124.536341][ T5321] which belongs to the cache kmalloc-512 of size 512
[ 124.536361][ T5321] The buggy address is located 270 bytes to the right of
[ 124.536361][ T5321] allocated 394-byte region [ffff8880128e5800, ffff8880128e598a)
[ 124.536374][ T5321]
[ 124.536377][ T5321] The buggy address belongs to the physical page:
[ 124.536384][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x128e4
[ 124.536395][ T5321] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 124.536403][ T5321] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 124.536413][ T5321] page_type: f5(slab)
[ 124.536424][ T5321] raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 124.536434][ T5321] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 124.536446][ T5321] head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 124.536455][ T5321] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 124.536467][ T5321] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 124.536477][ T5321] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 124.536483][ T5321] page dumped because: kasan: bad access detected
[ 124.536491][ T5321] page_owner tracks the page as allocated
[ 124.536494][ T5321] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4977, tgid 4977 (dbus-daemon), ts 89869417367
[ 124.536514][ T5321] post_alloc_hook+0x1f9/0x250
[ 124.536529][ T5321] get_page_from_freelist+0x2209/0x2280
[ 124.536546][ T5321] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 124.536563][ T5321] allocate_slab+0x7d/0x620
[ 124.536574][ T5321] refill_objects+0x2d5/0x350
[ 124.536585][ T5321] __pcs_replace_empty_main+0x2c8/0x6c0
[ 124.536596][ T5321] __kmalloc_noprof+0x47b/0x720
[ 124.536609][ T5321] tomoyo_init_log+0x1aae/0x1fa0
[ 124.536622][ T5321] tomoyo_supervisor+0x35f/0x1560
[ 124.536633][ T5321] tomoyo_path_permission+0x262/0x3b0
[ 124.536651][ T5321] tomoyo_check_open_permission+0x2b2/0x470
[ 124.536667][ T5321] security_file_open+0xa9/0x240
[ 124.536680][ T5321] do_dentry_open+0x4a0/0x1380
[ 124.536688][ T5321] vfs_open+0x3b/0x340
[ 124.536699][ T5321] path_openat+0x1443/0x1d60
[ 124.536712][ T5321] do_file_open+0x23e/0x4a0
[ 124.536725][ T5321] page last free pid 4698 tgid 4698 ts 84954346135 stack trace:
[ 124.536733][ T5321] __free_frozen_pages+0xc93/0xd90
[ 124.536748][ T5321] tlb_remove_table_rcu+0x85/0x100
[ 124.536763][ T5321] rcu_core+0x926/0x1260
[ 124.536773][ T5321] handle_softirqs+0x226/0x860
[ 124.536788][ T5321] __irq_exit_rcu+0xcb/0x220
[ 124.536801][ T5321] irq_exit_rcu+0x9/0x30
[ 124.536813][ T5321] sysvec_apic_timer_interrupt+0x57/0xc0
[ 124.536824][ T5321] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 124.536835][ T5321]
[ 124.536838][ T5321] Memory state around the buggy address:
[ 124.536845][ T5321] ffff8880128e5980: 00 02 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.536853][ T5321] ffff8880128e5a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.536862][ T5321] >ffff8880128e5a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.536867][ T5321] ^
[ 124.536872][ T5321] ffff8880128e5b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.536879][ T5321] ffff8880128e5b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 124.536883][ T5321] ==================================================================
[ 124.538399][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 124.829362][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 124.833287][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 124.837640][ T5321] Call Trace:
[ 124.839179][ T5321]
[ 124.840498][ T5321] vpanic+0x56d/0xa60
[ 124.842256][ T5321] ? __pfx_vpanic+0x10/0x10
[ 124.844258][ T5321] panic+0xc5/0xd0
[ 124.845951][ T5321] ? __pfx_panic+0x10/0x10
[ 124.847872][ T5321] ? preempt_schedule_thunk+0x16/0x40
[ 124.850157][ T5321] ? preempt_schedule_thunk+0x16/0x40
[ 124.852507][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.855220][ T5321] check_panic_on_warn+0x89/0xb0
[ 124.857390][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.859974][ T5321] end_report+0x73/0x170
[ 124.861728][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.864367][ T5321] kasan_report+0x128/0x150
[ 124.866331][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.868908][ T5321] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 124.871547][ T5321] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 124.874462][ T5321] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 124.877432][ T5321] ? d_alloc_parallel+0x1535/0x16b0
[ 124.879716][ T5321] ecryptfs_lookup+0x20e/0x780
[ 124.881756][ T5321] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 124.884151][ T5321] ? d_lookup+0x1f/0xa0
[ 124.885907][ T5321] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 124.888721][ T5321] lookup_open+0x9e1/0x1a40
[ 124.890920][ T5321] path_openat+0x677/0x1d60
[ 124.893048][ T5321] do_file_open+0x23e/0x4a0
[ 124.895262][ T5321] ? __pfx_do_file_open+0x10/0x10
[ 124.897588][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 124.899866][ T5321] ? alloc_fd+0x651/0x6c0
[ 124.901785][ T5321] do_sys_openat2+0x115/0x200
[ 124.903918][ T5321] ? __se_sys_futex+0x3a8/0x450
[ 124.906111][ T5321] ? __pfx_do_sys_openat2+0x10/0x10
[ 124.908300][ T5321] ? rcu_is_watching+0x16/0xb0
[ 124.910321][ T5321] __x64_sys_openat+0x138/0x170
[ 124.912500][ T5321] do_syscall_64+0x166/0x520
[ 124.914562][ T5321] ? trace_irq_disable+0x3b/0x140
[ 124.916782][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.919361][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 124.921380][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 124.924023][ T5321] RIP: 0033:0x7f326779e159
[ 124.926058][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 124.934391][ T5321] RSP: 002b:00007f3268696fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 124.937866][ T5321] RAX: ffffffffffffffda RBX: 00007f3267a25fa0 RCX: 00007f326779e159
[ 124.941119][ T5321] RDX: 0000000000000000 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 124.944346][ T5321] RBP: 00007f326783506b R08: 0000000000000000 R09: 0000000000000000
[ 124.947695][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 124.951129][ T5321] R13: 00007f3267a26038 R14: 00007f3267a25fa0 R15: 00007fffc6875f28
[ 124.954668][ T5321]
[ 124.956466][ T5321] Kernel Offset: disabled
[ 124.958338][ T5321] Rebooting in 86400 seconds..