program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="040000", 0x3, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0), &(0x7f0000000140), 0x2, 0x0)
[ 94.540146][ T4640] Bluetooth: hci0: command tx timeout
[ 94.663048][ T5312] ==================================================================
[ 94.663080][ T5312] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.663285][ T5312] Read of size 2 at addr ffff888043e7599b by task syz.0.0/5312
[ 94.663296][ T5312]
[ 94.663304][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.663326][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.663334][ T5312] Call Trace:
[ 94.663340][ T5312]
[ 94.663346][ T5312] dump_stack_lvl+0xe8/0x150
[ 94.663392][ T5312] print_address_description+0x55/0x1e0
[ 94.663432][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.663452][ T5312] print_report+0x58/0x70
[ 94.663473][ T5312] kasan_report+0x117/0x150
[ 94.663505][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.663527][ T5312] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.663549][ T5312] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 94.663570][ T5312] ecryptfs_get_tree+0x563/0x1370
[ 94.663595][ T5312] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 94.663620][ T5312] vfs_get_tree+0x92/0x2a0
[ 94.663644][ T5312] do_new_mount+0x319/0xdc0
[ 94.663665][ T5312] ? __pfx_do_new_mount+0x10/0x10
[ 94.663683][ T5312] ? ns_capable+0x89/0xe0
[ 94.663721][ T5312] ? path_mount+0x647/0x1050
[ 94.663739][ T5312] ? user_path_at+0xd4/0x160
[ 94.663762][ T5312] __se_sys_mount+0x31d/0x420
[ 94.663782][ T5312] ? __pfx___se_sys_mount+0x10/0x10
[ 94.663801][ T5312] ? __x64_sys_mount+0x20/0xc0
[ 94.663818][ T5312] do_syscall_64+0x166/0x520
[ 94.663963][ T5312] ? trace_irq_disable+0x3b/0x140
[ 94.664005][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.664023][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 94.664042][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.664052][ T5312] RIP: 0033:0x7f1113b9e159
[ 94.664063][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.664074][ T5312] RSP: 002b:00007f110fff4fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 94.664103][ T5312] RAX: ffffffffffffffda RBX: 00007f1113e25fa0 RCX: 00007f1113b9e159
[ 94.664113][ T5312] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 94.664122][ T5312] RBP: 00007f1113c3506b R08: 0000200000000500 R09: 0000000000000000
[ 94.664131][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.664138][ T5312] R13: 00007f1113e26038 R14: 00007f1113e25fa0 R15: 00007ffdb474a618
[ 94.664153][ T5312]
[ 94.664157][ T5312]
[ 94.664160][ T5312] Allocated by task 5312:
[ 94.664170][ T5312] kasan_save_track+0x3e/0x80
[ 94.664182][ T5312] __kasan_kmalloc+0x93/0xb0
[ 94.664188][ T5312] __kmalloc_noprof+0x36b/0x720
[ 94.664198][ T5312] user_preparse+0x9e/0x160
[ 94.664252][ T5312] __key_create_or_update+0x3a9/0xa80
[ 94.664260][ T5312] key_create_or_update+0x42/0x60
[ 94.664267][ T5312] __se_sys_add_key+0x349/0x420
[ 94.664275][ T5312] do_syscall_64+0x166/0x520
[ 94.664282][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.664289][ T5312]
[ 94.664291][ T5312] The buggy address belongs to the object at ffff888043e75980
[ 94.664291][ T5312] which belongs to the cache kmalloc-32 of size 32
[ 94.664307][ T5312] The buggy address is located 0 bytes to the right of
[ 94.664307][ T5312] allocated 27-byte region [ffff888043e75980, ffff888043e7599b)
[ 94.664314][ T5312]
[ 94.664317][ T5312] The buggy address belongs to the physical page:
[ 94.664321][ T5312] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888043e75cc0 pfn:0x43e75
[ 94.664329][ T5312] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 94.664337][ T5312] page_type: f5(slab)
[ 94.664344][ T5312] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea0000faeb50
[ 94.664351][ T5312] raw: ffff888043e75cc0 0000000000400032 00000000f5000000 0000000000000000
[ 94.664355][ T5312] page dumped because: kasan: bad access detected
[ 94.664359][ T5312] page_owner tracks the page as allocated
[ 94.664362][ T5312] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5074, tgid 5074 (dhcpcd-run-hook), ts 63560094098
[ 94.664373][ T5312] post_alloc_hook+0x1f9/0x250
[ 94.664382][ T5312] get_page_from_freelist+0x2209/0x2280
[ 94.664393][ T5312] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.664403][ T5312] allocate_slab+0x7d/0x620
[ 94.664410][ T5312] refill_objects+0x2d5/0x350
[ 94.664417][ T5312] __pcs_replace_empty_main+0x2c8/0x6c0
[ 94.664424][ T5312] __kmalloc_cache_noprof+0x39b/0x600
[ 94.664434][ T5312] kmem_cache_free+0x156/0x650
[ 94.664443][ T5312] tear_down_vmas+0x31f/0x530
[ 94.664451][ T5312] exit_mmap+0x4ca/0x9f0
[ 94.664459][ T5312] __mmput+0x118/0x420
[ 94.664466][ T5312] exit_mm+0x221/0x2d0
[ 94.664472][ T5312] do_exit+0x6cd/0x2360
[ 94.664477][ T5312] do_group_exit+0x22d/0x2f0
[ 94.664484][ T5312] __x64_sys_exit_group+0x3f/0x40
[ 94.664493][ T5312] x64_sys_call+0x18c6/0x18d0
[ 94.664502][ T5312] page last free pid 5074 tgid 5074 ts 63560053736 stack trace:
[ 94.664509][ T5312] __free_frozen_pages+0xc93/0xd90
[ 94.664521][ T5312] tlb_finish_mmu+0x13e/0x220
[ 94.664535][ T5312] exit_mmap+0x4b2/0x9f0
[ 94.664548][ T5312] __mmput+0x118/0x420
[ 94.664560][ T5312] exit_mm+0x221/0x2d0
[ 94.664569][ T5312] do_exit+0x6cd/0x2360
[ 94.664579][ T5312] do_group_exit+0x22d/0x2f0
[ 94.664588][ T5312] __x64_sys_exit_group+0x3f/0x40
[ 94.664596][ T5312] x64_sys_call+0x18c6/0x18d0
[ 94.664603][ T5312] do_syscall_64+0x166/0x520
[ 94.664609][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.664615][ T5312]
[ 94.664617][ T5312] Memory state around the buggy address:
[ 94.664621][ T5312] ffff888043e75880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 94.664625][ T5312] ffff888043e75900: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 94.664630][ T5312] >ffff888043e75980: 00 00 00 03 fc fc fc fc fa fb fb fb fc fc fc fc
[ 94.664633][ T5312] ^
[ 94.664637][ T5312] ffff888043e75a00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 94.664641][ T5312] ffff888043e75a80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 94.664644][ T5312] ==================================================================
[ 94.664722][ T5312] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.919341][ T5312] CPU: 0 UID: 0 PID: 5312 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.923119][ T5312] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.927560][ T5312] Call Trace:
[ 94.929074][ T5312]
[ 94.930407][ T5312] vpanic+0x56d/0xa60
[ 94.932271][ T5312] ? rcu_is_watching+0x16/0xb0
[ 94.934469][ T5312] ? __pfx_vpanic+0x10/0x10
[ 94.936486][ T5312] ? __pfx___schedule+0x10/0x10
[ 94.938659][ T5312] panic+0xc5/0xd0
[ 94.940371][ T5312] ? __pfx_panic+0x10/0x10
[ 94.942281][ T5312] ? preempt_schedule_thunk+0x16/0x40
[ 94.944550][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.947393][ T5312] check_panic_on_warn+0x89/0xb0
[ 94.949624][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.952393][ T5312] end_report+0x73/0x170
[ 94.954263][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.957021][ T5312] kasan_report+0x128/0x150
[ 94.959027][ T5312] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.961875][ T5312] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 94.964649][ T5312] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 94.967247][ T5312] ecryptfs_get_tree+0x563/0x1370
[ 94.969577][ T5312] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 94.971983][ T5312] vfs_get_tree+0x92/0x2a0
[ 94.974003][ T5312] do_new_mount+0x319/0xdc0
[ 94.976024][ T5312] ? __pfx_do_new_mount+0x10/0x10
[ 94.978290][ T5312] ? ns_capable+0x89/0xe0
[ 94.980253][ T5312] ? path_mount+0x647/0x1050
[ 94.982381][ T5312] ? user_path_at+0xd4/0x160
[ 94.984306][ T5312] __se_sys_mount+0x31d/0x420
[ 94.986292][ T5312] ? __pfx___se_sys_mount+0x10/0x10
[ 94.988457][ T5312] ? __x64_sys_mount+0x20/0xc0
[ 94.990477][ T5312] do_syscall_64+0x166/0x520
[ 94.992471][ T5312] ? trace_irq_disable+0x3b/0x140
[ 94.994743][ T5312] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.997371][ T5312] ? clear_bhb_loop+0x70/0xc0
[ 94.999387][ T5312] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.002019][ T5312] RIP: 0033:0x7f1113b9e159
[ 95.004030][ T5312] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.012367][ T5312] RSP: 002b:00007f110fff4fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.015869][ T5312] RAX: ffffffffffffffda RBX: 00007f1113e25fa0 RCX: 00007f1113b9e159
[ 95.019148][ T5312] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 95.022568][ T5312] RBP: 00007f1113c3506b R08: 0000200000000500 R09: 0000000000000000
[ 95.025971][ T5312] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.029318][ T5312] R13: 00007f1113e26038 R14: 00007f1113e25fa0 R15: 00007ffdb474a618
[ 95.032753][ T5312]
[ 95.034825][ T5312] Kernel Offset: disabled
[ 95.036858][ T5312] Rebooting in 86400 seconds..