program:
syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000280)='mnt\x00', 0x4, &(0x7f0000000000), 0x0, 0x236, &(0x7f0000000300)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/370, 0x172, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0)
chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00')
[ 95.517827][ T46] Bluetooth: hci0: command tx timeout
[ 95.605220][ T5321] loop0: detected capacity change from 0 to 128
[ 95.771522][ T5321] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none.
[ 95.774447][ T5321] ext4 filesystem being mounted at /0/mnt supports timestamps until 2038-01-19 (0x7fffffff)
[ 95.803785][ T5321] ==================================================================
[ 95.803797][ T5321] BUG: KASAN: slab-out-of-bounds in ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 95.803900][ T5321] Read of size 4 at addr ffff888036ab2a98 by task syz.0.0/5321
[ 95.803911][ T5321]
[ 95.803932][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.803954][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.803963][ T5321] Call Trace:
[ 95.803969][ T5321]
[ 95.803975][ T5321] dump_stack_lvl+0xe8/0x150
[ 95.803994][ T5321] print_address_description+0x55/0x1e0
[ 95.804010][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 95.804024][ T5321] print_report+0x58/0x70
[ 95.804037][ T5321] kasan_report+0x117/0x150
[ 95.804051][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 95.804067][ T5321] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 95.804087][ T5321] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 95.804103][ T5321] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 95.804117][ T5321] ? d_alloc_parallel+0x1535/0x16b0
[ 95.804138][ T5321] ecryptfs_lookup+0x20e/0x780
[ 95.804154][ T5321] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 95.804167][ T5321] ? d_lookup+0x1f/0xa0
[ 95.804181][ T5321] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 95.804198][ T5321] lookup_open+0x9e1/0x1a40
[ 95.804218][ T5321] path_openat+0x677/0x1d60
[ 95.804237][ T5321] do_file_open+0x23e/0x4a0
[ 95.804253][ T5321] ? __pfx_do_file_open+0x10/0x10
[ 95.804274][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 95.804324][ T5321] ? alloc_fd+0x651/0x6c0
[ 95.804335][ T5321] do_sys_openat2+0x115/0x200
[ 95.804344][ T5321] ? __se_sys_futex+0x3a8/0x450
[ 95.804356][ T5321] ? __pfx_do_sys_openat2+0x10/0x10
[ 95.804368][ T5321] ? rcu_is_watching+0x16/0xb0
[ 95.804386][ T5321] __x64_sys_openat+0x138/0x170
[ 95.804398][ T5321] do_syscall_64+0x166/0x520
[ 95.804411][ T5321] ? trace_irq_disable+0x3b/0x140
[ 95.804423][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.804436][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 95.804449][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.804461][ T5321] RIP: 0033:0x7f2219f9e159
[ 95.804481][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.804488][ T5321] RSP: 002b:00007f22163f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.804502][ T5321] RAX: ffffffffffffffda RBX: 00007f221a225fa0 RCX: 00007f2219f9e159
[ 95.804512][ T5321] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 95.804521][ T5321] RBP: 00007f221a03506b R08: 0000000000000000 R09: 0000000000000000
[ 95.804529][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.804536][ T5321] R13: 00007f221a226038 R14: 00007f221a225fa0 R15: 00007ffe90ea50d8
[ 95.804549][ T5321]
[ 95.804554][ T5321]
[ 95.804557][ T5321] Allocated by task 5321:
[ 95.804564][ T5321] kasan_save_track+0x3e/0x80
[ 95.804579][ T5321] __kasan_kmalloc+0x93/0xb0
[ 95.804588][ T5321] __kmalloc_noprof+0x36b/0x720
[ 95.804605][ T5321] user_preparse+0x9e/0x160
[ 95.804618][ T5321] __key_create_or_update+0x3a9/0xa80
[ 95.804631][ T5321] key_create_or_update+0x42/0x60
[ 95.804643][ T5321] __se_sys_add_key+0x349/0x420
[ 95.804660][ T5321] do_syscall_64+0x166/0x520
[ 95.804674][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.804685][ T5321]
[ 95.804688][ T5321] The buggy address belongs to the object at ffff888036ab2800
[ 95.804688][ T5321] which belongs to the cache kmalloc-512 of size 512
[ 95.804700][ T5321] The buggy address is located 270 bytes to the right of
[ 95.804700][ T5321] allocated 394-byte region [ffff888036ab2800, ffff888036ab298a)
[ 95.804714][ T5321]
[ 95.804717][ T5321] The buggy address belongs to the physical page:
[ 95.804725][ T5321] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036ab3800 pfn:0x36ab2
[ 95.804738][ T5321] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 95.804747][ T5321] flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff)
[ 95.804760][ T5321] page_type: f5(slab)
[ 95.804773][ T5321] raw: 04fff00000000240 ffff88801b041c80 ffffea0000d4ce90 ffff8880304007c8
[ 95.804784][ T5321] raw: ffff888036ab3800 0000000000080006 00000000f5000000 0000000000000000
[ 95.804794][ T5321] head: 04fff00000000240 ffff88801b041c80 ffffea0000d4ce90 ffff8880304007c8
[ 95.804803][ T5321] head: ffff888036ab3800 0000000000080006 00000000f5000000 0000000000000000
[ 95.804813][ T5321] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 95.804821][ T5321] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 95.804826][ T5321] page dumped because: kasan: bad access detected
[ 95.804833][ T5321] page_owner tracks the page as allocated
[ 95.804837][ T5321] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 2, tgid 2 (kthreadd), ts 95749854053
[ 95.804856][ T5321] post_alloc_hook+0x1f9/0x250
[ 95.804871][ T5321] get_page_from_freelist+0x2209/0x2280
[ 95.804886][ T5321] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 95.804900][ T5321] allocate_slab+0x7d/0x620
[ 95.804911][ T5321] refill_objects+0x2d5/0x350
[ 95.804922][ T5321] __pcs_replace_empty_main+0x2c8/0x6c0
[ 95.804933][ T5321] __kmalloc_cache_noprof+0x39b/0x600
[ 95.804961][ T5321] set_kthread_struct+0xbb/0x340
[ 95.804975][ T5321] copy_process+0x17c7/0x43e0
[ 95.804989][ T5321] kernel_clone+0x2d7/0x940
[ 95.805002][ T5321] kernel_thread+0x13f/0x1b0
[ 95.805015][ T5321] kthreadd+0x4ec/0x6e0
[ 95.805029][ T5321] ret_from_fork+0x514/0xb70
[ 95.805039][ T5321] ret_from_fork_asm+0x1a/0x30
[ 95.805055][ T5321] page last free pid 1098 tgid 1098 ts 95628110853 stack trace:
[ 95.805063][ T5321] __free_frozen_pages+0xc93/0xd90
[ 95.805076][ T5321] __slab_free+0x274/0x2c0
[ 95.805092][ T5321] qlist_free_all+0x99/0x100
[ 95.805110][ T5321] kasan_quarantine_reduce+0x148/0x160
[ 95.805127][ T5321] __kasan_slab_alloc+0x22/0x80
[ 95.805137][ T5321] kmem_cache_alloc_node_noprof+0x354/0x610
[ 95.805150][ T5321] __alloc_skb+0x1db/0x7a0
[ 95.805157][ T5321] mld_newpack+0x165/0xcb0
[ 95.805165][ T5321] add_grec+0x119f/0x19d0
[ 95.805171][ T5321] mld_send_initial_cr+0x288/0x550
[ 95.805177][ T5321] ipv6_mc_dad_complete+0x87/0x410
[ 95.805183][ T5321] addrconf_dad_completed+0x8af/0xe60
[ 95.805190][ T5321] addrconf_dad_work+0xcf8/0x15c0
[ 95.805196][ T5321] process_scheduled_works+0xc3d/0x1630
[ 95.805206][ T5321] worker_thread+0xa47/0xfb0
[ 95.805219][ T5321] kthread+0x38b/0x480
[ 95.805228][ T5321]
[ 95.805231][ T5321] Memory state around the buggy address:
[ 95.805236][ T5321] ffff888036ab2980: 00 02 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.805243][ T5321] ffff888036ab2a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.805251][ T5321] >ffff888036ab2a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.805256][ T5321] ^
[ 95.805263][ T5321] ffff888036ab2b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.805270][ T5321] ffff888036ab2b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 95.805276][ T5321] ==================================================================
[ 95.805285][ T5321] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 96.113712][ T5321] CPU: 0 UID: 0 PID: 5321 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 96.117798][ T5321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 96.121463][ T5321] Call Trace:
[ 96.122996][ T5321]
[ 96.124413][ T5321] vpanic+0x56d/0xa60
[ 96.126297][ T5321] ? __pfx_vpanic+0x10/0x10
[ 96.128393][ T5321] panic+0xc5/0xd0
[ 96.130070][ T5321] ? __pfx_panic+0x10/0x10
[ 96.132141][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.134974][ T5321] ? rcu_is_watching+0x16/0xb0
[ 96.137138][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.139411][ T5321] check_panic_on_warn+0x89/0xb0
[ 96.141232][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.143540][ T5321] end_report+0x73/0x170
[ 96.145076][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.147618][ T5321] kasan_report+0x128/0x150
[ 96.149761][ T5321] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.152264][ T5321] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 96.154708][ T5321] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 96.157365][ T5321] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 96.160328][ T5321] ? d_alloc_parallel+0x1535/0x16b0
[ 96.162595][ T5321] ecryptfs_lookup+0x20e/0x780
[ 96.164623][ T5321] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 96.166710][ T5321] ? d_lookup+0x1f/0xa0
[ 96.168551][ T5321] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 96.171306][ T5321] lookup_open+0x9e1/0x1a40
[ 96.173299][ T5321] path_openat+0x677/0x1d60
[ 96.175295][ T5321] do_file_open+0x23e/0x4a0
[ 96.177298][ T5321] ? __pfx_do_file_open+0x10/0x10
[ 96.179395][ T5321] ? _raw_spin_unlock+0x28/0x50
[ 96.181418][ T5321] ? alloc_fd+0x651/0x6c0
[ 96.183396][ T5321] do_sys_openat2+0x115/0x200
[ 96.185503][ T5321] ? __se_sys_futex+0x3a8/0x450
[ 96.187655][ T5321] ? __pfx_do_sys_openat2+0x10/0x10
[ 96.189897][ T5321] ? rcu_is_watching+0x16/0xb0
[ 96.192340][ T5321] __x64_sys_openat+0x138/0x170
[ 96.194542][ T5321] do_syscall_64+0x166/0x520
[ 96.196774][ T5321] ? trace_irq_disable+0x3b/0x140
[ 96.199114][ T5321] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.201821][ T5321] ? clear_bhb_loop+0x70/0xc0
[ 96.203937][ T5321] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 96.206292][ T5321] RIP: 0033:0x7f2219f9e159
[ 96.208110][ T5321] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 96.215683][ T5321] RSP: 002b:00007f22163f4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 96.219577][ T5321] RAX: ffffffffffffffda RBX: 00007f221a225fa0 RCX: 00007f2219f9e159
[ 96.223750][ T5321] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 96.227273][ T5321] RBP: 00007f221a03506b R08: 0000000000000000 R09: 0000000000000000
[ 96.230692][ T5321] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 96.234113][ T5321] R13: 00007f221a226038 R14: 00007f221a225fa0 R15: 00007ffe90ea50d8
[ 96.237585][ T5321]
[ 96.239317][ T5321] Kernel Offset: disabled
[ 96.241209][ T5321] Rebooting in 86400 seconds..