program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4)
add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, 0x0, 0x1ff)
mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') (fail_nth: 31)
[ 92.749546][ T4647] Bluetooth: hci0: command tx timeout
[ 92.788518][ T9] cfg80211: failed to load regulatory.db
[ 92.871834][ T5320] Could not find key with description: [syz]
[ 92.871847][ T5320] process_request_key_err: No key
[ 92.871852][ T5320] Could not find valid key in user session keyring for sig specified in mount option: [syz]
[ 92.871858][ T5320] One or more global auth toks could not properly register; rc = [-2]
[ 92.871891][ T5320] Error validating options; rc = [-2]
[ 92.885756][ T5319] FAULT_INJECTION: forcing a failure.
[ 92.885756][ T5319] name failslab, interval 1, probability 0, space 0, times 1
[ 92.885810][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.885825][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.885833][ T5319] Call Trace:
[ 92.885849][ T5319]
[ 92.885856][ T5319] dump_stack_lvl+0xe8/0x150
[ 92.886042][ T5319] should_fail_ex+0x410/0x560
[ 92.886196][ T5319] should_failslab+0xa8/0x100
[ 92.886264][ T5319] __kmalloc_cache_node_noprof+0xaa/0x620
[ 92.886299][ T5319] ? bdi_alloc+0x51/0x110
[ 92.886335][ T5319] ? bdi_alloc+0x51/0x110
[ 92.886351][ T5319] bdi_alloc+0x51/0x110
[ 92.886365][ T5319] super_setup_bdi_name+0xa8/0x210
[ 92.886401][ T5319] ? __pfx_set_anon_super_fc+0x10/0x10
[ 92.886430][ T5319] ? __pfx_super_setup_bdi_name+0x10/0x10
[ 92.886448][ T5319] ? ecryptfs_get_tree+0x5ba/0x1370
[ 92.886485][ T5319] ecryptfs_get_tree+0x641/0x1370
[ 92.886503][ T5319] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 92.886524][ T5319] vfs_get_tree+0x92/0x2a0
[ 92.886543][ T5319] do_new_mount+0x319/0xdc0
[ 92.886577][ T5319] ? __pfx_do_new_mount+0x10/0x10
[ 92.886594][ T5319] ? ns_capable+0x89/0xe0
[ 92.886656][ T5319] ? path_mount+0x647/0x1050
[ 92.886675][ T5319] ? user_path_at+0xd4/0x160
[ 92.886695][ T5319] __se_sys_mount+0x31d/0x420
[ 92.886715][ T5319] ? __pfx___se_sys_mount+0x10/0x10
[ 92.886734][ T5319] ? __x64_sys_mount+0x20/0xc0
[ 92.886752][ T5319] do_syscall_64+0x166/0x520
[ 92.886876][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.886904][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 92.886919][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.886931][ T5319] RIP: 0033:0x7f64c7f9e159
[ 92.886945][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.886955][ T5319] RSP: 002b:00007f64c8f02fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 92.886994][ T5319] RAX: ffffffffffffffda RBX: 00007f64c8225fa0 RCX: 00007f64c7f9e159
[ 92.887002][ T5319] RDX: 0000200000000480 RSI: 0000200000000000 RDI: 0000200000000400
[ 92.887009][ T5319] RBP: 00007f64c8f03050 R08: 0000200000000500 R09: 0000000000000000
[ 92.887017][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 92.887033][ T5319] R13: 00007f64c8226038 R14: 00007f64c8225fa0 R15: 00007ffeac2c5bd8
[ 92.887050][ T5319]
[ 92.887163][ T5319] ==================================================================
[ 92.887184][ T5319] BUG: KASAN: slab-use-after-free in ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.887201][ T5319] Read of size 4 at addr ffff88800bf53910 by task syz.0.0/5319
[ 92.887211][ T5319]
[ 92.887219][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.887231][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.887238][ T5319] Call Trace:
[ 92.887243][ T5319]
[ 92.887248][ T5319] dump_stack_lvl+0xe8/0x150
[ 92.887266][ T5319] print_address_description+0x55/0x1e0
[ 92.887297][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.887310][ T5319] print_report+0x58/0x70
[ 92.887324][ T5319] kasan_report+0x117/0x150
[ 92.887340][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.887356][ T5319] ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.887370][ T5319] ? put_super+0x295/0x2f0
[ 92.887385][ T5319] ecryptfs_get_tree+0x1069/0x1370
[ 92.887398][ T5319] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 92.887412][ T5319] vfs_get_tree+0x92/0x2a0
[ 92.887429][ T5319] do_new_mount+0x319/0xdc0
[ 92.887447][ T5319] ? __pfx_do_new_mount+0x10/0x10
[ 92.887461][ T5319] ? ns_capable+0x89/0xe0
[ 92.887478][ T5319] ? path_mount+0x647/0x1050
[ 92.887492][ T5319] ? user_path_at+0xd4/0x160
[ 92.887509][ T5319] __se_sys_mount+0x31d/0x420
[ 92.887524][ T5319] ? __pfx___se_sys_mount+0x10/0x10
[ 92.887539][ T5319] ? __x64_sys_mount+0x20/0xc0
[ 92.887554][ T5319] do_syscall_64+0x166/0x520
[ 92.887572][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.887584][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 92.887597][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.887609][ T5319] RIP: 0033:0x7f64c7f9e159
[ 92.887619][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.887629][ T5319] RSP: 002b:00007f64c8f02fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 92.887640][ T5319] RAX: ffffffffffffffda RBX: 00007f64c8225fa0 RCX: 00007f64c7f9e159
[ 92.887649][ T5319] RDX: 0000200000000480 RSI: 0000200000000000 RDI: 0000200000000400
[ 92.887656][ T5319] RBP: 00007f64c8f03050 R08: 0000200000000500 R09: 0000000000000000
[ 92.887663][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 92.887670][ T5319] R13: 00007f64c8226038 R14: 00007f64c8225fa0 R15: 00007ffeac2c5bd8
[ 92.887681][ T5319]
[ 92.887686][ T5319]
[ 92.887689][ T5319] Allocated by task 5319:
[ 92.887695][ T5319] kasan_save_track+0x3e/0x80
[ 92.887706][ T5319] __kasan_slab_alloc+0x6c/0x80
[ 92.887718][ T5319] kmem_cache_alloc_noprof+0x2b9/0x600
[ 92.887734][ T5319] ecryptfs_init_fs_context+0x70/0x1b0
[ 92.887744][ T5319] alloc_fs_context+0x9a3/0xd00
[ 92.887760][ T5319] do_new_mount+0x17f/0xdc0
[ 92.887772][ T5319] __se_sys_mount+0x31d/0x420
[ 92.887785][ T5319] do_syscall_64+0x166/0x520
[ 92.887799][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.887809][ T5319]
[ 92.887811][ T5319] Freed by task 5319:
[ 92.887817][ T5319] kasan_save_track+0x3e/0x80
[ 92.887827][ T5319] kasan_save_free_info+0x40/0x50
[ 92.887843][ T5319] __kasan_slab_free+0x5c/0x80
[ 92.887853][ T5319] kmem_cache_free+0x182/0x650
[ 92.887862][ T5319] deactivate_locked_super+0xbe/0x110
[ 92.887884][ T5319] ecryptfs_get_tree+0xff6/0x1370
[ 92.887895][ T5319] vfs_get_tree+0x92/0x2a0
[ 92.887911][ T5319] do_new_mount+0x319/0xdc0
[ 92.887923][ T5319] __se_sys_mount+0x31d/0x420
[ 92.887935][ T5319] do_syscall_64+0x166/0x520
[ 92.887950][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.887960][ T5319]
[ 92.887963][ T5319] The buggy address belongs to the object at ffff88800bf53900
[ 92.887963][ T5319] which belongs to the cache ecryptfs_sb_cache of size 280
[ 92.887973][ T5319] The buggy address is located 16 bytes inside of
[ 92.887973][ T5319] freed 280-byte region [ffff88800bf53900, ffff88800bf53a18)
[ 92.887983][ T5319]
[ 92.887986][ T5319] The buggy address belongs to the physical page:
[ 92.888011][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88800bf53c00 pfn:0xbf53
[ 92.888023][ T5319] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 92.888043][ T5319] page_type: f5(slab)
[ 92.888054][ T5319] raw: 00fff00000000200 ffff888031bd4000 ffff88800088a4c8 ffff88800088a4c8
[ 92.888063][ T5319] raw: ffff88800bf53c00 00000002000a0008 00000000f5000000 0000000000000000
[ 92.888068][ T5319] page dumped because: kasan: bad access detected
[ 92.888075][ T5319] page_owner tracks the page as allocated
[ 92.888079][ T5319] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5320, tgid 5318 (syz.0.0), ts 92870744580
[ 92.888097][ T5319] post_alloc_hook+0x1f9/0x250
[ 92.888114][ T5319] get_page_from_freelist+0x2209/0x2280
[ 92.888126][ T5319] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 92.888137][ T5319] allocate_slab+0x7d/0x620
[ 92.888150][ T5319] refill_objects+0x2d5/0x350
[ 92.888165][ T5319] __pcs_replace_empty_main+0x2c8/0x6c0
[ 92.888178][ T5319] kmem_cache_alloc_noprof+0x399/0x600
[ 92.888196][ T5319] ecryptfs_init_fs_context+0x70/0x1b0
[ 92.888206][ T5319] alloc_fs_context+0x9a3/0xd00
[ 92.888224][ T5319] do_new_mount+0x17f/0xdc0
[ 92.888237][ T5319] __se_sys_mount+0x31d/0x420
[ 92.888250][ T5319] do_syscall_64+0x166/0x520
[ 92.888264][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.888274][ T5319] page last free pid 30 tgid 30 ts 90149551931 stack trace:
[ 92.888283][ T5319] __free_frozen_pages+0xc93/0xd90
[ 92.888299][ T5319] __folio_put+0x4b3/0x590
[ 92.888327][ T5319] migrate_pages_batch+0x3c61/0x4f50
[ 92.888342][ T5319] migrate_pages+0x1b9f/0x2920
[ 92.888355][ T5319] compact_zone+0x34ba/0x4ca0
[ 92.888372][ T5319] compact_node+0x210/0x310
[ 92.888387][ T5319] kcompactd+0xc0b/0x12c0
[ 92.888400][ T5319] kthread+0x38b/0x480
[ 92.888412][ T5319] ret_from_fork+0x514/0xb70
[ 92.888434][ T5319] ret_from_fork_asm+0x1a/0x30
[ 92.888451][ T5319]
[ 92.888455][ T5319] Memory state around the buggy address:
[ 92.888461][ T5319] ffff88800bf53800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.888468][ T5319] ffff88800bf53880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.888475][ T5319] >ffff88800bf53900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 92.888480][ T5319] ^
[ 92.888486][ T5319] ffff88800bf53980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 92.888493][ T5319] ffff88800bf53a00: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.888499][ T5319] ==================================================================
[ 92.888506][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.282050][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.285833][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.289936][ T5319] Call Trace:
[ 93.291365][ T5319]
[ 93.292630][ T5319] vpanic+0x56d/0xa60
[ 93.294374][ T5319] ? __pfx_vpanic+0x10/0x10
[ 93.296309][ T5319] panic+0xc5/0xd0
[ 93.297912][ T5319] ? __pfx_panic+0x10/0x10
[ 93.299727][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.302393][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.304991][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.307523][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.310289][ T5319] check_panic_on_warn+0x89/0xb0
[ 93.312339][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.315079][ T5319] end_report+0x73/0x170
[ 93.316967][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.319435][ T5319] kasan_report+0x128/0x150
[ 93.321237][ T5319] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.324129][ T5319] ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.327069][ T5319] ? put_super+0x295/0x2f0
[ 93.328774][ T5319] ecryptfs_get_tree+0x1069/0x1370
[ 93.331039][ T5319] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 93.333317][ T5319] vfs_get_tree+0x92/0x2a0
[ 93.335002][ T5319] do_new_mount+0x319/0xdc0
[ 93.336794][ T5319] ? __pfx_do_new_mount+0x10/0x10
[ 93.338883][ T5319] ? ns_capable+0x89/0xe0
[ 93.340816][ T5319] ? path_mount+0x647/0x1050
[ 93.342763][ T5319] ? user_path_at+0xd4/0x160
[ 93.344610][ T5319] __se_sys_mount+0x31d/0x420
[ 93.346299][ T5319] ? __pfx___se_sys_mount+0x10/0x10
[ 93.348227][ T5319] ? __x64_sys_mount+0x20/0xc0
[ 93.350134][ T5319] do_syscall_64+0x166/0x520
[ 93.352035][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.354440][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 93.356262][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.358684][ T5319] RIP: 0033:0x7f64c7f9e159
[ 93.360466][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.368378][ T5319] RSP: 002b:00007f64c8f02fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 93.372128][ T5319] RAX: ffffffffffffffda RBX: 00007f64c8225fa0 RCX: 00007f64c7f9e159
[ 93.375638][ T5319] RDX: 0000200000000480 RSI: 0000200000000000 RDI: 0000200000000400
[ 93.379078][ T5319] RBP: 00007f64c8f03050 R08: 0000200000000500 R09: 0000000000000000
[ 93.382536][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 93.385994][ T5319] R13: 00007f64c8226038 R14: 00007f64c8225fa0 R15: 00007ffeac2c5bd8
[ 93.390229][ T5319]
[ 93.392537][ T5319] Kernel Offset: disabled
[ 93.394696][ T5319] Rebooting in 86400 seconds..