program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000780)='./mnt\x00', 0x1ff)
add_key$user(&(0x7f00000007c0), &(0x7f0000000800)={'syz', 0x0}, &(0x7f0000000840)="040000", 0x3, 0xfffffffffffffffd)
mount(&(0x7f0000000b80)=@filename='./lower\x00', &(0x7f0000000bc0)='./mnt\x00', &(0x7f0000000c00)='ecryptfs\x00', 0x0, &(0x7f0000000c40)='ecryptfs_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = syz_open_procfs(0x0, &(0x7f0000000240)='mountinfo\x00')
read$FUSE(r0, &(0x7f0000003480)={0x2020}, 0x2020)
[ 101.802791][ T4647] Bluetooth: hci0: command tx timeout
[ 101.876888][ T5328] ==================================================================
[ 101.876903][ T5328] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 101.877141][ T5328] Read of size 2 at addr ffff888044d5231b by task syz.0.0/5328
[ 101.877162][ T5328]
[ 101.877181][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 101.877210][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 101.877233][ T5328] Call Trace:
[ 101.877261][ T5328]
[ 101.877285][ T5328] dump_stack_lvl+0xe8/0x150
[ 101.877335][ T5328] print_address_description+0x55/0x1e0
[ 101.877353][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 101.877369][ T5328] print_report+0x58/0x70
[ 101.877384][ T5328] kasan_report+0x117/0x150
[ 101.877427][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 101.877438][ T5328] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 101.877448][ T5328] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 101.877458][ T5328] ecryptfs_get_tree+0x563/0x1370
[ 101.877466][ T5328] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 101.877475][ T5328] vfs_get_tree+0x92/0x2a0
[ 101.877490][ T5328] do_new_mount+0x325/0xb00
[ 101.877500][ T5328] ? __pfx_do_new_mount+0x10/0x10
[ 101.877508][ T5328] ? ns_capable+0x89/0xe0
[ 101.877541][ T5328] ? path_mount+0x647/0x1050
[ 101.877555][ T5328] ? user_path_at+0xd4/0x160
[ 101.877579][ T5328] __se_sys_mount+0x31d/0x420
[ 101.877596][ T5328] ? __pfx___se_sys_mount+0x10/0x10
[ 101.877612][ T5328] ? __x64_sys_mount+0x20/0xc0
[ 101.877625][ T5328] do_syscall_64+0x166/0x520
[ 101.877711][ T5328] ? trace_irq_disable+0x3b/0x140
[ 101.877749][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.877759][ T5328] ? clear_bhb_loop+0x70/0xc0
[ 101.877768][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.877776][ T5328] RIP: 0033:0x7f3f1399e2d9
[ 101.877792][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 101.877802][ T5328] RSP: 002b:00007f3f1482afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 101.877830][ T5328] RAX: ffffffffffffffda RBX: 00007f3f13c25fa0 RCX: 00007f3f1399e2d9
[ 101.877838][ T5328] RDX: 0000200000000c00 RSI: 0000200000000bc0 RDI: 0000200000000b80
[ 101.877845][ T5328] RBP: 00007f3f13a35888 R08: 0000200000000c40 R09: 0000000000000000
[ 101.877852][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 101.877858][ T5328] R13: 00007f3f13c26038 R14: 00007f3f13c25fa0 R15: 00007ffc87af47f8
[ 101.877870][ T5328]
[ 101.877875][ T5328]
[ 101.877878][ T5328] Allocated by task 5328:
[ 101.877892][ T5328] kasan_save_track+0x3e/0x80
[ 101.877904][ T5328] __kasan_kmalloc+0x93/0xb0
[ 101.877915][ T5328] __kmalloc_noprof+0x36b/0x720
[ 101.877925][ T5328] user_preparse+0x9e/0x160
[ 101.877976][ T5328] __key_create_or_update+0x354/0xa70
[ 101.877988][ T5328] key_create_or_update+0x42/0x60
[ 101.877999][ T5328] __se_sys_add_key+0x349/0x420
[ 101.878007][ T5328] do_syscall_64+0x166/0x520
[ 101.878017][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.878027][ T5328]
[ 101.878030][ T5328] The buggy address belongs to the object at ffff888044d52300
[ 101.878030][ T5328] which belongs to the cache kmalloc-32 of size 32
[ 101.878038][ T5328] The buggy address is located 0 bytes to the right of
[ 101.878038][ T5328] allocated 27-byte region [ffff888044d52300, ffff888044d5231b)
[ 101.878058][ T5328]
[ 101.878061][ T5328] The buggy address belongs to the physical page:
[ 101.878067][ T5328] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888044d52e40 pfn:0x44d52
[ 101.878079][ T5328] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 101.878090][ T5328] page_type: f5(slab)
[ 101.878101][ T5328] raw: 04fff00000000200 ffff88801c041780 ffffea0000e1ed50 ffffea0000d6c5d0
[ 101.878111][ T5328] raw: ffff888044d52e40 000000000040003a 00000000f5000000 0000000000000000
[ 101.878116][ T5328] page dumped because: kasan: bad access detected
[ 101.878122][ T5328] page_owner tracks the page as allocated
[ 101.878126][ T5328] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5217, tgid 5217 (dhcpcd-run-hook), ts 79863399610
[ 101.878145][ T5328] post_alloc_hook+0x1f9/0x250
[ 101.878170][ T5328] get_page_from_freelist+0x2209/0x2280
[ 101.878181][ T5328] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 101.878191][ T5328] allocate_slab+0x7d/0x620
[ 101.878203][ T5328] refill_objects+0x2d5/0x350
[ 101.878216][ T5328] __pcs_replace_empty_main+0x2c8/0x6c0
[ 101.878228][ T5328] __kmalloc_cache_noprof+0x39b/0x600
[ 101.878237][ T5328] kmem_cache_free+0x156/0x650
[ 101.878247][ T5328] __fput_deferred+0x2ae/0x390
[ 101.878259][ T5328] fput_close+0x11f/0x240
[ 101.878269][ T5328] path_openat+0x167b/0x1d60
[ 101.878277][ T5328] do_file_open+0x23e/0x4a0
[ 101.878286][ T5328] do_sys_openat2+0x115/0x200
[ 101.878298][ T5328] __x64_sys_openat+0x138/0x170
[ 101.878309][ T5328] do_syscall_64+0x166/0x520
[ 101.878318][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 101.878327][ T5328] page last free pid 15 tgid 15 ts 79845146479 stack trace:
[ 101.878334][ T5328] __free_frozen_pages+0xc93/0xd90
[ 101.878348][ T5328] tlb_remove_table_rcu+0x85/0x100
[ 101.878358][ T5328] rcu_core+0x926/0x1260
[ 101.878381][ T5328] handle_softirqs+0x226/0x860
[ 101.878397][ T5328] run_ksoftirqd+0x36/0x60
[ 101.878412][ T5328] smpboot_thread_fn+0x565/0xa70
[ 101.878436][ T5328] kthread+0x38b/0x480
[ 101.878446][ T5328] ret_from_fork+0x514/0xb70
[ 101.878466][ T5328] ret_from_fork_asm+0x1a/0x30
[ 101.878476][ T5328]
[ 101.878479][ T5328] Memory state around the buggy address:
[ 101.878486][ T5328] ffff888044d52200: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 101.878493][ T5328] ffff888044d52280: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 101.878501][ T5328] >ffff888044d52300: 00 00 00 03 fc fc fc fc fa fb fb fb fc fc fc fc
[ 101.878506][ T5328] ^
[ 101.878512][ T5328] ffff888044d52380: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 101.878520][ T5328] ffff888044d52400: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 101.878526][ T5328] ==================================================================
[ 101.883265][ T5328] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 102.144543][ T5328] CPU: 0 UID: 0 PID: 5328 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.148413][ T5328] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.152800][ T5328] Call Trace:
[ 102.154307][ T5328]
[ 102.155614][ T5328] vpanic+0x56d/0xa60
[ 102.157427][ T5328] ? rcu_is_watching+0x16/0xb0
[ 102.159388][ T5328] ? __pfx_vpanic+0x10/0x10
[ 102.161407][ T5328] ? __pfx___schedule+0x10/0x10
[ 102.163467][ T5328] panic+0xc5/0xd0
[ 102.165017][ T5328] ? __pfx_panic+0x10/0x10
[ 102.166860][ T5328] ? preempt_schedule_thunk+0x16/0x40
[ 102.169010][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 102.171715][ T5328] check_panic_on_warn+0x89/0xb0
[ 102.173875][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 102.176636][ T5328] end_report+0x73/0x170
[ 102.178537][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 102.181279][ T5328] kasan_report+0x128/0x150
[ 102.183245][ T5328] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 102.186037][ T5328] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 102.188809][ T5328] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 102.191613][ T5328] ecryptfs_get_tree+0x563/0x1370
[ 102.193762][ T5328] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 102.196133][ T5328] vfs_get_tree+0x92/0x2a0
[ 102.198195][ T5328] do_new_mount+0x325/0xb00
[ 102.200194][ T5328] ? __pfx_do_new_mount+0x10/0x10
[ 102.202466][ T5328] ? ns_capable+0x89/0xe0
[ 102.204411][ T5328] ? path_mount+0x647/0x1050
[ 102.206453][ T5328] ? user_path_at+0xd4/0x160
[ 102.208226][ T5328] __se_sys_mount+0x31d/0x420
[ 102.210074][ T5328] ? __pfx___se_sys_mount+0x10/0x10
[ 102.212390][ T5328] ? __x64_sys_mount+0x20/0xc0
[ 102.214342][ T5328] do_syscall_64+0x166/0x520
[ 102.216237][ T5328] ? trace_irq_disable+0x3b/0x140
[ 102.218346][ T5328] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.220864][ T5328] ? clear_bhb_loop+0x70/0xc0
[ 102.222778][ T5328] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.225231][ T5328] RIP: 0033:0x7f3f1399e2d9
[ 102.227041][ T5328] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.235364][ T5328] RSP: 002b:00007f3f1482afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 102.238860][ T5328] RAX: ffffffffffffffda RBX: 00007f3f13c25fa0 RCX: 00007f3f1399e2d9
[ 102.242190][ T5328] RDX: 0000200000000c00 RSI: 0000200000000bc0 RDI: 0000200000000b80
[ 102.245467][ T5328] RBP: 00007f3f13a35888 R08: 0000200000000c40 R09: 0000000000000000
[ 102.248873][ T5328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.252243][ T5328] R13: 00007f3f13c26038 R14: 00007f3f13c25fa0 R15: 00007ffc87af47f8
[ 102.255590][ T5328]
[ 102.257338][ T5328] Kernel Offset: disabled
[ 102.259204][ T5328] Rebooting in 86400 seconds..