program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/370, 0x172, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
openat(r0, &(0x7f0000000000)='./mnt\x00', 0x40000, 0x0)
[ 93.021881][ T46] Bluetooth: hci0: command tx timeout
[ 93.038607][ T9] cfg80211: failed to load regulatory.db
[ 93.157307][ T5322] ==================================================================
[ 93.157332][ T5322] BUG: KASAN: slab-out-of-bounds in ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.157446][ T5322] Read of size 4 at addr ffff888013350698 by task syz.0.0/5322
[ 93.157458][ T5322]
[ 93.157466][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.157481][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.157490][ T5322] Call Trace:
[ 93.157496][ T5322]
[ 93.157503][ T5322] dump_stack_lvl+0xe8/0x150
[ 93.157523][ T5322] print_address_description+0x55/0x1e0
[ 93.157544][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.157560][ T5322] print_report+0x58/0x70
[ 93.157577][ T5322] kasan_report+0x117/0x150
[ 93.157590][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.157608][ T5322] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.157629][ T5322] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 93.157648][ T5322] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 93.157664][ T5322] ? d_alloc_parallel+0x1535/0x16b0
[ 93.157686][ T5322] ecryptfs_lookup+0x20e/0x780
[ 93.157704][ T5322] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 93.157720][ T5322] ? d_lookup+0x1f/0xa0
[ 93.157738][ T5322] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 93.157756][ T5322] lookup_open+0x9e1/0x1a40
[ 93.157779][ T5322] path_openat+0x677/0x1d60
[ 93.157801][ T5322] do_file_open+0x23e/0x4a0
[ 93.157820][ T5322] ? __pfx_do_file_open+0x10/0x10
[ 93.157842][ T5322] ? _raw_spin_unlock+0x28/0x50
[ 93.157907][ T5322] ? alloc_fd+0x651/0x6c0
[ 93.157926][ T5322] do_sys_openat2+0x115/0x200
[ 93.157941][ T5322] ? __se_sys_futex+0x3a8/0x450
[ 93.157958][ T5322] ? __pfx_do_sys_openat2+0x10/0x10
[ 93.157974][ T5322] ? rcu_is_watching+0x16/0xb0
[ 93.157989][ T5322] __x64_sys_openat+0x138/0x170
[ 93.157999][ T5322] do_syscall_64+0x166/0x520
[ 93.158007][ T5322] ? trace_irq_disable+0x3b/0x140
[ 93.158016][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.158024][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 93.158033][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.158042][ T5322] RIP: 0033:0x7f1f9159e159
[ 93.158051][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.158058][ T5322] RSP: 002b:00007f1f92389fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 93.158069][ T5322] RAX: ffffffffffffffda RBX: 00007f1f91825fa0 RCX: 00007f1f9159e159
[ 93.158075][ T5322] RDX: 0000000000040000 RSI: 0000200000000000 RDI: 0000000000000003
[ 93.158081][ T5322] RBP: 00007f1f9163506b R08: 0000000000000000 R09: 0000000000000000
[ 93.158086][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.158091][ T5322] R13: 00007f1f91826038 R14: 00007f1f91825fa0 R15: 00007fff299c9668
[ 93.158100][ T5322]
[ 93.158103][ T5322]
[ 93.158105][ T5322] Allocated by task 5322:
[ 93.158109][ T5322] kasan_save_track+0x3e/0x80
[ 93.158121][ T5322] __kasan_kmalloc+0x93/0xb0
[ 93.158128][ T5322] __kmalloc_noprof+0x36b/0x720
[ 93.158140][ T5322] user_preparse+0x9e/0x160
[ 93.158149][ T5322] __key_create_or_update+0x3a9/0xa80
[ 93.158156][ T5322] key_create_or_update+0x42/0x60
[ 93.158164][ T5322] __se_sys_add_key+0x349/0x420
[ 93.158173][ T5322] do_syscall_64+0x166/0x520
[ 93.158181][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.158192][ T5322]
[ 93.158195][ T5322] The buggy address belongs to the object at ffff888013350400
[ 93.158195][ T5322] which belongs to the cache kmalloc-512 of size 512
[ 93.158204][ T5322] The buggy address is located 270 bytes to the right of
[ 93.158204][ T5322] allocated 394-byte region [ffff888013350400, ffff88801335058a)
[ 93.158216][ T5322]
[ 93.158219][ T5322] The buggy address belongs to the physical page:
[ 93.158227][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13350
[ 93.158241][ T5322] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 93.158252][ T5322] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[ 93.158265][ T5322] page_type: f5(slab)
[ 93.158278][ T5322] raw: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 93.158291][ T5322] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 93.158304][ T5322] head: 00fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 93.158315][ T5322] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 93.158335][ T5322] head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 93.158346][ T5322] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 93.158353][ T5322] page dumped because: kasan: bad access detected
[ 93.158361][ T5322] page_owner tracks the page as allocated
[ 93.158366][ T5322] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4702, tgid 4702 (udevd), ts 38320241925
[ 93.158390][ T5322] post_alloc_hook+0x1f9/0x250
[ 93.158406][ T5322] get_page_from_freelist+0x2209/0x2280
[ 93.158424][ T5322] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 93.158441][ T5322] allocate_slab+0x7d/0x620
[ 93.158455][ T5322] refill_objects+0x2d5/0x350
[ 93.158467][ T5322] __pcs_replace_empty_main+0x2c8/0x6c0
[ 93.158480][ T5322] __kmalloc_cache_noprof+0x39b/0x600
[ 93.158497][ T5322] kernfs_fop_open+0x3ac/0xce0
[ 93.158509][ T5322] do_dentry_open+0x816/0x1380
[ 93.158521][ T5322] vfs_open+0x3b/0x340
[ 93.158531][ T5322] path_openat+0x1443/0x1d60
[ 93.158547][ T5322] do_file_open+0x23e/0x4a0
[ 93.158562][ T5322] do_sys_openat2+0x115/0x200
[ 93.158574][ T5322] __x64_sys_openat+0x138/0x170
[ 93.158587][ T5322] do_syscall_64+0x166/0x520
[ 93.158599][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.158611][ T5322] page last free pid 4712 tgid 4712 ts 37774271411 stack trace:
[ 93.158620][ T5322] __free_frozen_pages+0xc93/0xd90
[ 93.158635][ T5322] __slab_free+0x274/0x2c0
[ 93.158657][ T5322] qlist_free_all+0x99/0x100
[ 93.158672][ T5322] kasan_quarantine_reduce+0x148/0x160
[ 93.158690][ T5322] __kasan_slab_alloc+0x22/0x80
[ 93.158703][ T5322] kmem_cache_alloc_noprof+0x2b9/0x600
[ 93.158721][ T5322] do_getname+0x2e/0x250
[ 93.158734][ T5322] do_readlinkat+0xc8/0x510
[ 93.158747][ T5322] __x64_sys_readlink+0x7f/0x90
[ 93.158759][ T5322] do_syscall_64+0x166/0x520
[ 93.158770][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.158783][ T5322]
[ 93.158786][ T5322] Memory state around the buggy address:
[ 93.158793][ T5322] ffff888013350580: 00 02 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.158801][ T5322] ffff888013350600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.158809][ T5322] >ffff888013350680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.158815][ T5322] ^
[ 93.158822][ T5322] ffff888013350700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.158829][ T5322] ffff888013350780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.158836][ T5322] ==================================================================
[ 93.158845][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.494163][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.498318][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.502945][ T5322] Call Trace:
[ 93.504571][ T5322]
[ 93.505945][ T5322] vpanic+0x56d/0xa60
[ 93.507927][ T5322] ? __pfx_vpanic+0x10/0x10
[ 93.510200][ T5322] panic+0xc5/0xd0
[ 93.512297][ T5322] ? __pfx_panic+0x10/0x10
[ 93.514914][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.517807][ T5322] ? rcu_is_watching+0x16/0xb0
[ 93.520020][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.522997][ T5322] check_panic_on_warn+0x89/0xb0
[ 93.526287][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.530106][ T5322] end_report+0x73/0x170
[ 93.532423][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.535638][ T5322] kasan_report+0x128/0x150
[ 93.537627][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.540466][ T5322] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 93.543371][ T5322] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 93.546785][ T5322] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 93.550356][ T5322] ? d_alloc_parallel+0x1535/0x16b0
[ 93.552647][ T5322] ecryptfs_lookup+0x20e/0x780
[ 93.554640][ T5322] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 93.556953][ T5322] ? d_lookup+0x1f/0xa0
[ 93.558740][ T5322] ? seqcount_lockdep_reader_access+0xa9/0x100
[ 93.561489][ T5322] lookup_open+0x9e1/0x1a40
[ 93.563540][ T5322] path_openat+0x677/0x1d60
[ 93.565965][ T5322] do_file_open+0x23e/0x4a0
[ 93.568662][ T5322] ? __pfx_do_file_open+0x10/0x10
[ 93.571512][ T5322] ? _raw_spin_unlock+0x28/0x50
[ 93.574253][ T5322] ? alloc_fd+0x651/0x6c0
[ 93.576730][ T5322] do_sys_openat2+0x115/0x200
[ 93.579525][ T5322] ? __se_sys_futex+0x3a8/0x450
[ 93.582401][ T5322] ? __pfx_do_sys_openat2+0x10/0x10
[ 93.585335][ T5322] ? rcu_is_watching+0x16/0xb0
[ 93.588213][ T5322] __x64_sys_openat+0x138/0x170
[ 93.590995][ T5322] do_syscall_64+0x166/0x520
[ 93.593186][ T5322] ? trace_irq_disable+0x3b/0x140
[ 93.595218][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.597751][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 93.599649][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.602192][ T5322] RIP: 0033:0x7f1f9159e159
[ 93.604492][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.613929][ T5322] RSP: 002b:00007f1f92389fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 93.617037][ T5322] RAX: ffffffffffffffda RBX: 00007f1f91825fa0 RCX: 00007f1f9159e159
[ 93.620118][ T5322] RDX: 0000000000040000 RSI: 0000200000000000 RDI: 0000000000000003
[ 93.623366][ T5322] RBP: 00007f1f9163506b R08: 0000000000000000 R09: 0000000000000000
[ 93.626958][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.631158][ T5322] R13: 00007f1f91826038 R14: 00007f1f91825fa0 R15: 00007fff299c9668
[ 93.634816][ T5322]
[ 93.636556][ T5322] Kernel Offset: disabled
[ 93.638435][ T5322] Rebooting in 86400 seconds..