program:
syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000240)='./file0\x00', 0x8, &(0x7f0000000000), 0x1, 0x51a, &(0x7f0000001200)="$eJzs3U9sI1cZAPBvJsnam6ZNCj0AKnQphQWt1k68bVT1QjlVCFVC9MhhGxInimLHUeyUJuwhe+SORCVOcOLMAYkDUk/ckTjAjUs5IBVYgRokJFx5bGedP06sbGJv499PGvnNvLG/93Y071mfN/MCGFu3ImI/Im5ExLsRMds5nnS2eLO9tc775NGD5YNHD5aTaDbf+WeS1beORc97Wp7pfGY+In7wVsSPkmNB/xRR393bWKpUytudQ8VGdatY3927u15dWiuvlTdLpcWFxfnX771WurS+vlT9zcc3I+L3v/vyR3/c/9ZPWs2a6dT19uMytbs+dRinZTIivncVwUZgotOfGxd584XexGVKI+JzEfFydv/PxkR2NY86epm+PcTWAQBXodmcjeZs7z4AcN2lWQ4sSQudXMBMpGmh0M7hvRDTaaVWb9xZre1srrRzZXMxla6uV8rznVzhXEwlq+uT5YWs3N2vlEvH9u9FxPMR8bPczWy/sFyrrIzyiw8AjLFnjs3//8m1538A4JrLPy7mRtkOAGB48qNuAAAwdOZ/ABg/5n8AGD/mfwAYP+Z/ABg/5n8AGCvff/vt1tY86Dz/euW93Z2N2nt3V8r1jUJ1Z7mwXNveKqzVamvZM3uq531epVbbWng1dt4vNsr1RrG+u3e/WtvZbNzPnut9vzw1lF4BAGd5/qUP/5JExP4bN7Mtep73f+5c/eJVtw64SumoGwCMzMSoGwCMzMnVvoBxIR8P4+v/zWYzetbujYiHh6Weh4H2/S9CHwwUJrVuKDx9bn/xCfL/wGea/D+Mr4vl/32Xh+tA/h/GV7OZWPMfAMaMHD+QnFPf+/v/fLNnZ7Df/wEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOBamsm2JC101gKfiTQtFCKejYi5mEpW1yvl+Yh4LiL+nJvKtfYXIsK6QQDwWZb+Pems/3V79pWZ47U3cv/NZa8R8eNfvPPz95caje2FiBvJvw6PNz7oHC+Nov0AwHm683R3Hu/65NGD5e42zPZ8/J324qKtuAedrV0zGZPZaz7LNUz/O+nst7W+r0xcQvz9hxHxhdP6n2S5kbnOyqfH47diPzvU+OmR+GlW135t/Vt8/hLaAuPmw9b48+Zp918at7LX0+//fDZCPbnu+HdwYvxLD8e/iT7j361BY7z6h++eONicbdc9jPjSZMRB98N7xp9u/KRP/FcGjP/XF7/ycr+65i8jbsdp/U+OxCo2qlvF+u7e3fXq0lp5rbxZKi0uLM6/fu+1UjHLURe7meqT/vHGnef6xW/1f7pP/Pw5/f/6gP3/1f/e/eFXz4j/za+dfv1fOCN+a078xoDxl6Z/m+9X14q/0qf/513/OwPG/+hveysDngoADEF9d29jqVIpbz95IX/mOellhBigkETsX3GIx4Xcr3/61vkn54bWngsWol/VxNPSwmtTyD0dzRigMOqRCbhqj2/6UbcEAAAAAAAAAAAAAADoZxh/TjTqPgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHB9fRoAAP//j4/W2A==")
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400", 0x2, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, 0x0)
[ 102.390072][ T5288] Bluetooth: hci0: command tx timeout
[ 102.498643][ T5324] loop0: detected capacity change from 0 to 512
[ 102.599730][ T5324] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000d40000 r/w without journal. Quota mode: writeback.
[ 102.599910][ T5324] ext4 filesystem being mounted at /0/file0 supports timestamps until 2038-01-19 (0x7fffffff)
[ 102.627987][ T5324] ==================================================================
[ 102.628004][ T5324] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.628177][ T5324] Read of size 2 at addr ffff88801267795a by task syz.0.0/5324
[ 102.628188][ T5324]
[ 102.628197][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.628209][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.628223][ T5324] Call Trace:
[ 102.628229][ T5324]
[ 102.628233][ T5324] dump_stack_lvl+0xe8/0x150
[ 102.628255][ T5324] print_address_description+0x55/0x1e0
[ 102.628267][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.628278][ T5324] print_report+0x58/0x70
[ 102.628287][ T5324] kasan_report+0x117/0x150
[ 102.628323][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.628334][ T5324] ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.628344][ T5324] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 102.628354][ T5324] ecryptfs_get_tree+0x563/0x1370
[ 102.628367][ T5324] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 102.628384][ T5324] vfs_get_tree+0x92/0x2a0
[ 102.628399][ T5324] do_new_mount+0x319/0xdc0
[ 102.628412][ T5324] ? __pfx_do_new_mount+0x10/0x10
[ 102.628425][ T5324] ? ns_capable+0x89/0xe0
[ 102.628444][ T5324] ? path_mount+0x647/0x1050
[ 102.628458][ T5324] ? user_path_at+0xd4/0x160
[ 102.628477][ T5324] __se_sys_mount+0x31d/0x420
[ 102.628490][ T5324] ? __pfx___se_sys_mount+0x10/0x10
[ 102.628500][ T5324] ? __x64_sys_mount+0x20/0xc0
[ 102.628518][ T5324] do_syscall_64+0x166/0x520
[ 102.628597][ T5324] ? trace_irq_disable+0x3b/0x140
[ 102.628622][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.628636][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 102.628650][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.628662][ T5324] RIP: 0033:0x7f0a52b9e159
[ 102.628674][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 102.628684][ T5324] RSP: 002b:00007f0a53b13fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 102.628699][ T5324] RAX: ffffffffffffffda RBX: 00007f0a52e25fa0 RCX: 00007f0a52b9e159
[ 102.628706][ T5324] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 102.628714][ T5324] RBP: 00007f0a52c3506b R08: 0000200000000500 R09: 0000000000000000
[ 102.628722][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 102.628729][ T5324] R13: 00007f0a52e26038 R14: 00007f0a52e25fa0 R15: 00007ffc450a33c8
[ 102.628740][ T5324]
[ 102.628744][ T5324]
[ 102.628747][ T5324] Allocated by task 5324:
[ 102.628753][ T5324] kasan_save_track+0x3e/0x80
[ 102.628768][ T5324] __kasan_kmalloc+0x93/0xb0
[ 102.628777][ T5324] __kmalloc_noprof+0x36b/0x720
[ 102.628789][ T5324] user_preparse+0x9e/0x160
[ 102.628814][ T5324] __key_create_or_update+0x3a9/0xa80
[ 102.628824][ T5324] key_create_or_update+0x42/0x60
[ 102.628836][ T5324] __se_sys_add_key+0x349/0x420
[ 102.628848][ T5324] do_syscall_64+0x166/0x520
[ 102.628861][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.628870][ T5324]
[ 102.628873][ T5324] The buggy address belongs to the object at ffff888012677940
[ 102.628873][ T5324] which belongs to the cache kmalloc-32 of size 32
[ 102.628882][ T5324] The buggy address is located 0 bytes to the right of
[ 102.628882][ T5324] allocated 26-byte region [ffff888012677940, ffff88801267795a)
[ 102.628894][ T5324]
[ 102.628897][ T5324] The buggy address belongs to the physical page:
[ 102.628904][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12677
[ 102.628915][ T5324] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 102.628926][ T5324] page_type: f5(slab)
[ 102.628938][ T5324] raw: 00fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 102.628949][ T5324] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 102.628956][ T5324] page dumped because: kasan: bad access detected
[ 102.628963][ T5324] page_owner tracks the page as allocated
[ 102.628967][ T5324] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5244, tgid 5244 (dhcpcd), ts 78950746070
[ 102.628984][ T5324] post_alloc_hook+0x1f9/0x250
[ 102.628996][ T5324] get_page_from_freelist+0x2209/0x2280
[ 102.629021][ T5324] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 102.629039][ T5324] allocate_slab+0x7d/0x620
[ 102.629052][ T5324] refill_objects+0x2d5/0x350
[ 102.629065][ T5324] __pcs_replace_empty_main+0x2c8/0x6c0
[ 102.629078][ T5324] __kmalloc_cache_noprof+0x39b/0x600
[ 102.629094][ T5324] kmem_cache_free+0x156/0x650
[ 102.629108][ T5324] tear_down_vmas+0x31f/0x530
[ 102.629120][ T5324] exit_mmap+0x4ca/0x9f0
[ 102.629130][ T5324] __mmput+0x118/0x420
[ 102.629142][ T5324] exit_mm+0x221/0x2d0
[ 102.629152][ T5324] do_exit+0x6cd/0x2360
[ 102.629161][ T5324] do_group_exit+0x22d/0x2f0
[ 102.629171][ T5324] __x64_sys_exit_group+0x3f/0x40
[ 102.629181][ T5324] x64_sys_call+0x18c6/0x18d0
[ 102.629189][ T5324] page last free pid 5244 tgid 5244 ts 78950728249 stack trace:
[ 102.629197][ T5324] __free_frozen_pages+0xc93/0xd90
[ 102.629211][ T5324] tlb_finish_mmu+0x13e/0x220
[ 102.629227][ T5324] exit_mmap+0x4b2/0x9f0
[ 102.629240][ T5324] __mmput+0x118/0x420
[ 102.629253][ T5324] exit_mm+0x221/0x2d0
[ 102.629262][ T5324] do_exit+0x6cd/0x2360
[ 102.629271][ T5324] do_group_exit+0x22d/0x2f0
[ 102.629281][ T5324] __x64_sys_exit_group+0x3f/0x40
[ 102.629292][ T5324] x64_sys_call+0x18c6/0x18d0
[ 102.629300][ T5324] do_syscall_64+0x166/0x520
[ 102.629310][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.629320][ T5324]
[ 102.629323][ T5324] Memory state around the buggy address:
[ 102.629329][ T5324] ffff888012677800: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.629336][ T5324] ffff888012677880: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 102.629344][ T5324] >ffff888012677900: 00 00 00 00 fc fc fc fc 00 00 00 02 fc fc fc fc
[ 102.629349][ T5324] ^
[ 102.629354][ T5324] ffff888012677980: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.629360][ T5324] ffff888012677a00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 102.629365][ T5324] ==================================================================
[ 102.629515][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 102.901003][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 102.905159][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 102.909740][ T5324] Call Trace:
[ 102.911447][ T5324]
[ 102.912929][ T5324] vpanic+0x56d/0xa60
[ 102.914965][ T5324] ? rcu_is_watching+0x16/0xb0
[ 102.917154][ T5324] ? __pfx_vpanic+0x10/0x10
[ 102.919243][ T5324] ? __pfx___schedule+0x10/0x10
[ 102.921402][ T5324] panic+0xc5/0xd0
[ 102.923134][ T5324] ? __pfx_panic+0x10/0x10
[ 102.925419][ T5324] ? preempt_schedule_thunk+0x16/0x40
[ 102.927753][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.930574][ T5324] check_panic_on_warn+0x89/0xb0
[ 102.932841][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.935913][ T5324] end_report+0x73/0x170
[ 102.937767][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.940582][ T5324] kasan_report+0x128/0x150
[ 102.942587][ T5324] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.945820][ T5324] ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 102.950370][ T5324] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 102.954008][ T5324] ecryptfs_get_tree+0x563/0x1370
[ 102.956185][ T5324] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 102.958489][ T5324] vfs_get_tree+0x92/0x2a0
[ 102.960501][ T5324] do_new_mount+0x319/0xdc0
[ 102.962617][ T5324] ? __pfx_do_new_mount+0x10/0x10
[ 102.965044][ T5324] ? ns_capable+0x89/0xe0
[ 102.967024][ T5324] ? path_mount+0x647/0x1050
[ 102.969083][ T5324] ? user_path_at+0xd4/0x160
[ 102.971174][ T5324] __se_sys_mount+0x31d/0x420
[ 102.973341][ T5324] ? __pfx___se_sys_mount+0x10/0x10
[ 102.975779][ T5324] ? __x64_sys_mount+0x20/0xc0
[ 102.977930][ T5324] do_syscall_64+0x166/0x520
[ 102.980058][ T5324] ? trace_irq_disable+0x3b/0x140
[ 102.982506][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.985545][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 102.987905][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 102.990659][ T5324] RIP: 0033:0x7f0a52b9e159
[ 102.992723][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 103.001402][ T5324] RSP: 002b:00007f0a53b13fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 103.005299][ T5324] RAX: ffffffffffffffda RBX: 00007f0a52e25fa0 RCX: 00007f0a52b9e159
[ 103.008777][ T5324] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 103.012251][ T5324] RBP: 00007f0a52c3506b R08: 0000200000000500 R09: 0000000000000000
[ 103.015723][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 103.019121][ T5324] R13: 00007f0a52e26038 R14: 00007f0a52e25fa0 R15: 00007ffc450a33c8
[ 103.022669][ T5324]
[ 103.024570][ T5324] Kernel Offset: disabled
[ 103.026549][ T5324] Rebooting in 86400 seconds..