program:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x18500, 0x0)
ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xf28)
socket$can_raw(0x1d, 0x3, 0x1)
socket$kcm(0x11, 0x3, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/16, 0x10, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./lower\x00', 0x1af)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='\x00', 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$int_in(r2, 0x5452, &(0x7f0000000280)=0x6)
bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, &(0x7f0000847fff)='X', 0x20000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000000)='./mnt\x00', 0x1040, &(0x7f0000000200)={[{@usrquota}]}, 0xfc, 0x236, &(0x7f0000000800)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0)
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000580)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a})
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r4, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a})
chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00')
symlink(&(0x7f00000007c0)='mnt/encrypted_dir\x00', &(0x7f0000000040)='./file0\x00')
[ 136.788910][ T5282] Bluetooth: hci0: command tx timeout
[ 136.920806][ T5323] loop0: detected capacity change from 0 to 128
[ 136.924876][ T5323] =======================================================
[ 136.924876][ T5323] WARNING: The mand mount option has been deprecated and
[ 136.924876][ T5323] and is ignored by this kernel. Remove the mand
[ 136.924876][ T5323] option from the mount to silence this warning.
[ 136.924876][ T5323] =======================================================
[ 136.959575][ T5323] ==================================================================
[ 136.959602][ T5323] BUG: KASAN: slab-out-of-bounds in md5_blocks+0x120/0xbd0
[ 136.959703][ T5323] Read of size 64 at addr ffff8880434115a0 by task syz.0.0/5323
[ 136.959713][ T5323]
[ 136.959721][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 136.959734][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 136.959742][ T5323] Call Trace:
[ 136.959747][ T5323]
[ 136.959752][ T5323] dump_stack_lvl+0xe8/0x150
[ 136.959770][ T5323] print_address_description+0x55/0x1e0
[ 136.959786][ T5323] ? md5_blocks+0x120/0xbd0
[ 136.959807][ T5323] print_report+0x58/0x70
[ 136.959819][ T5323] kasan_report+0x117/0x150
[ 136.959832][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 136.959848][ T5323] ? md5_blocks+0x120/0xbd0
[ 136.959859][ T5323] kasan_check_range+0x264/0x2c0
[ 136.959871][ T5323] ? md5_blocks+0x120/0xbd0
[ 136.959882][ T5323] __asan_memcpy+0x29/0x70
[ 136.959899][ T5323] md5_blocks+0x120/0xbd0
[ 136.959910][ T5323] ? kasan_save_track+0x3e/0x80
[ 136.959919][ T5323] ? __kasan_kmalloc+0x93/0xb0
[ 136.959930][ T5323] ? __kmalloc_noprof+0x36b/0x720
[ 136.959945][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 136.959958][ T5323] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 136.959971][ T5323] ? ecryptfs_lookup+0x20e/0x780
[ 136.959983][ T5323] ? lookup_one_qstr_excl+0x12d/0x360
[ 136.959998][ T5323] ? filename_create+0x20e/0x370
[ 136.960012][ T5323] ? filename_mkdirat+0xd2/0x510
[ 136.960021][ T5323] ? __se_sys_mkdirat+0x35/0x150
[ 136.960030][ T5323] ? do_syscall_64+0x166/0x520
[ 136.960078][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.960094][ T5323] ? __pfx_md5_blocks+0x10/0x10
[ 136.960106][ T5323] ? simple_strntoull+0x134/0x190
[ 136.960119][ T5323] md5_update+0xef/0x150
[ 136.960129][ T5323] md5+0xed/0x180
[ 136.960140][ T5323] ? __pfx_md5+0x10/0x10
[ 136.960152][ T5323] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 136.960163][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 136.960175][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 136.960189][ T5323] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 136.960206][ T5323] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 136.960229][ T5323] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 136.960246][ T5323] ecryptfs_lookup+0x20e/0x780
[ 136.960264][ T5323] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 136.960281][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 136.960295][ T5323] ? d_alloc+0x144/0x190
[ 136.960310][ T5323] lookup_one_qstr_excl+0x12d/0x360
[ 136.960326][ T5323] filename_create+0x20e/0x370
[ 136.960343][ T5323] ? __pfx_filename_create+0x10/0x10
[ 136.960360][ T5323] filename_mkdirat+0xd2/0x510
[ 136.960371][ T5323] ? __pfx_filename_mkdirat+0x10/0x10
[ 136.960382][ T5323] ? do_getname+0x151/0x250
[ 136.960393][ T5323] __se_sys_mkdirat+0x35/0x150
[ 136.960404][ T5323] do_syscall_64+0x166/0x520
[ 136.960417][ T5323] ? trace_irq_disable+0x3b/0x140
[ 136.960427][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.960439][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 136.960453][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.960465][ T5323] RIP: 0033:0x7f0b8d99e159
[ 136.960477][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 136.960487][ T5323] RSP: 002b:00007f0b8e877fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 136.960512][ T5323] RAX: ffffffffffffffda RBX: 00007f0b8dc25fa0 RCX: 00007f0b8d99e159
[ 136.960521][ T5323] RDX: 0000000000000000 RSI: 0000200000000640 RDI: ffffffffffffff9c
[ 136.960529][ T5323] RBP: 00007f0b8da3506b R08: 0000000000000000 R09: 0000000000000000
[ 136.960538][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 136.960546][ T5323] R13: 00007f0b8dc26038 R14: 00007f0b8dc25fa0 R15: 00007ffd9c733248
[ 136.960558][ T5323]
[ 136.960562][ T5323]
[ 136.960565][ T5323] Allocated by task 5083:
[ 136.960570][ T5323] kasan_save_track+0x3e/0x80
[ 136.960580][ T5323] __kasan_kmalloc+0x93/0xb0
[ 136.960607][ T5323] __kmalloc_noprof+0x36b/0x720
[ 136.960624][ T5323] ima_write_template_field_data+0x47/0x490
[ 136.960636][ T5323] ima_eventdigest_init_common+0x2cc/0x400
[ 136.960646][ T5323] ima_alloc_init_template+0x323/0x700
[ 136.960660][ T5323] ima_store_measurement+0x1d4/0x690
[ 136.960672][ T5323] process_measurement+0x15ac/0x1c10
[ 136.960686][ T5323] ima_file_check+0xe1/0x130
[ 136.960698][ T5323] security_file_post_open+0xb3/0x260
[ 136.960707][ T5323] path_openat+0x1485/0x1d60
[ 136.960722][ T5323] do_file_open+0x23e/0x4a0
[ 136.960735][ T5323] do_sys_openat2+0x115/0x200
[ 136.960746][ T5323] __x64_sys_openat+0x138/0x170
[ 136.960756][ T5323] do_syscall_64+0x166/0x520
[ 136.960767][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 136.960778][ T5323]
[ 136.960781][ T5323] The buggy address belongs to the object at ffff888043411580
[ 136.960781][ T5323] which belongs to the cache kmalloc-64 of size 64
[ 136.960790][ T5323] The buggy address is located 32 bytes inside of
[ 136.960790][ T5323] allocated 40-byte region [ffff888043411580, ffff8880434115a8)
[ 136.960802][ T5323]
[ 136.960805][ T5323] The buggy address belongs to the physical page:
[ 136.960813][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43411
[ 136.960824][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 136.960834][ T5323] page_type: f5(slab)
[ 136.960846][ T5323] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 136.960855][ T5323] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 136.960861][ T5323] page dumped because: kasan: bad access detected
[ 136.960867][ T5323] page_owner tracks the page as allocated
[ 136.960872][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4995, tgid 4995 (dhcpcd-run-hook), ts 99150509443
[ 136.960889][ T5323] post_alloc_hook+0x1f9/0x250
[ 136.960903][ T5323] get_page_from_freelist+0x2209/0x2280
[ 136.960912][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 136.960922][ T5323] allocate_slab+0x7d/0x620
[ 136.960933][ T5323] refill_objects+0x2d5/0x350
[ 136.960944][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0
[ 136.960956][ T5323] __kmalloc_noprof+0x47b/0x720
[ 136.960970][ T5323] tomoyo_encode+0x2ad/0x570
[ 136.960982][ T5323] tomoyo_realpath_from_path+0x5fa/0x640
[ 136.960992][ T5323] tomoyo_path_perm+0x283/0x560
[ 136.961002][ T5323] security_inode_getattr+0x12b/0x310
[ 136.961015][ T5323] vfs_getattr+0x23/0x70
[ 136.961025][ T5323] vfs_statx_path+0x2b/0x230
[ 136.961035][ T5323] vfs_statx+0x12e/0x200
[ 136.961045][ T5323] vfs_fstatat+0x11b/0x170
[ 136.961054][ T5323] __x64_sys_newfstatat+0x151/0x200
[ 136.961065][ T5323] page last free pid 4995 tgid 4995 ts 99148505001 stack trace:
[ 136.961073][ T5323] __free_frozen_pages+0xc93/0xd90
[ 136.961086][ T5323] rcu_core+0x926/0x1260
[ 136.961096][ T5323] handle_softirqs+0x226/0x860
[ 136.961109][ T5323] __irq_exit_rcu+0xcb/0x220
[ 136.961121][ T5323] irq_exit_rcu+0x9/0x30
[ 136.961133][ T5323] sysvec_apic_timer_interrupt+0xa6/0xc0
[ 136.961145][ T5323] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 136.961155][ T5323]
[ 136.961158][ T5323] Memory state around the buggy address:
[ 136.961164][ T5323] ffff888043411480: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 136.961171][ T5323] ffff888043411500: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 136.961178][ T5323] >ffff888043411580: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 136.961183][ T5323] ^
[ 136.961189][ T5323] ffff888043411600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 136.961194][ T5323] ffff888043411680: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 136.961199][ T5323] ==================================================================
[ 136.965087][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 137.291213][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 137.295108][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 137.299383][ T5323] Call Trace:
[ 137.300902][ T5323]
[ 137.302208][ T5323] vpanic+0x56d/0xa60
[ 137.303980][ T5323] ? __pfx_vpanic+0x10/0x10
[ 137.305962][ T5323] panic+0xc5/0xd0
[ 137.307596][ T5323] ? __pfx_panic+0x10/0x10
[ 137.309548][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 137.311933][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.313853][ T5323] ? preempt_schedule_thunk+0x16/0x40
[ 137.316235][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.318518][ T5323] check_panic_on_warn+0x89/0xb0
[ 137.321151][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.323494][ T5323] end_report+0x73/0x170
[ 137.325692][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.327748][ T5323] kasan_report+0x128/0x150
[ 137.329729][ T5323] ? do_raw_spin_lock+0x12b/0x2f0
[ 137.331909][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.333898][ T5323] kasan_check_range+0x264/0x2c0
[ 137.335919][ T5323] ? md5_blocks+0x120/0xbd0
[ 137.337853][ T5323] __asan_memcpy+0x29/0x70
[ 137.339911][ T5323] md5_blocks+0x120/0xbd0
[ 137.341808][ T5323] ? kasan_save_track+0x3e/0x80
[ 137.343807][ T5323] ? __kasan_kmalloc+0x93/0xb0
[ 137.345834][ T5323] ? __kmalloc_noprof+0x36b/0x720
[ 137.347998][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 137.350624][ T5323] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 137.353452][ T5323] ? ecryptfs_lookup+0x20e/0x780
[ 137.355566][ T5323] ? lookup_one_qstr_excl+0x12d/0x360
[ 137.357889][ T5323] ? filename_create+0x20e/0x370
[ 137.360047][ T5323] ? filename_mkdirat+0xd2/0x510
[ 137.362278][ T5323] ? __se_sys_mkdirat+0x35/0x150
[ 137.364320][ T5323] ? do_syscall_64+0x166/0x520
[ 137.366383][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 137.368903][ T5323] ? __pfx_md5_blocks+0x10/0x10
[ 137.370985][ T5323] ? simple_strntoull+0x134/0x190
[ 137.373077][ T5323] md5_update+0xef/0x150
[ 137.374864][ T5323] md5+0xed/0x180
[ 137.376430][ T5323] ? __pfx_md5+0x10/0x10
[ 137.378256][ T5323] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 137.380428][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 137.383009][ T5323] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 137.385488][ T5323] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 137.387849][ T5323] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 137.390472][ T5323] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 137.393227][ T5323] ecryptfs_lookup+0x20e/0x780
[ 137.395197][ T5323] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 137.397410][ T5323] ? _raw_spin_unlock+0x28/0x50
[ 137.399857][ T5323] ? d_alloc+0x144/0x190
[ 137.401918][ T5323] lookup_one_qstr_excl+0x12d/0x360
[ 137.404148][ T5323] filename_create+0x20e/0x370
[ 137.406090][ T5323] ? __pfx_filename_create+0x10/0x10
[ 137.408291][ T5323] filename_mkdirat+0xd2/0x510
[ 137.410253][ T5323] ? __pfx_filename_mkdirat+0x10/0x10
[ 137.412367][ T5323] ? do_getname+0x151/0x250
[ 137.414228][ T5323] __se_sys_mkdirat+0x35/0x150
[ 137.416449][ T5323] do_syscall_64+0x166/0x520
[ 137.418286][ T5323] ? trace_irq_disable+0x3b/0x140
[ 137.420439][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 137.422867][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 137.424854][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 137.427368][ T5323] RIP: 0033:0x7f0b8d99e159
[ 137.429258][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 137.437207][ T5323] RSP: 002b:00007f0b8e877fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 137.440635][ T5323] RAX: ffffffffffffffda RBX: 00007f0b8dc25fa0 RCX: 00007f0b8d99e159
[ 137.443976][ T5323] RDX: 0000000000000000 RSI: 0000200000000640 RDI: ffffffffffffff9c
[ 137.447192][ T5323] RBP: 00007f0b8da3506b R08: 0000000000000000 R09: 0000000000000000
[ 137.450651][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 137.454041][ T5323] R13: 00007f0b8dc26038 R14: 00007f0b8dc25fa0 R15: 00007ffd9c733248
[ 137.457268][ T5323]
[ 137.458968][ T5323] Kernel Offset: disabled
[ 137.460946][ T5323] Rebooting in 86400 seconds..