program:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x18500, 0x0)
ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xf28)
socket$can_raw(0x1d, 0x3, 0x1)
socket$kcm(0x11, 0x3, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/16, 0x10, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./lower\x00', 0x1af)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='\x00', 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$int_in(r2, 0x5452, &(0x7f0000000280)=0x6)
bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, &(0x7f0000847fff)='X', 0x20000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000000)='./mnt\x00', 0x1040, &(0x7f0000000200)={[{@usrquota}]}, 0xfc, 0x236, &(0x7f0000000800)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0)
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000580)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a})
openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0)
[ 94.943414][ T4645] Bluetooth: hci0: command tx timeout
[ 95.180131][ T5318] loop0: detected capacity change from 0 to 128
[ 95.240903][ T5318] =======================================================
[ 95.240903][ T5318] WARNING: The mand mount option has been deprecated and
[ 95.240903][ T5318] and is ignored by this kernel. Remove the mand
[ 95.240903][ T5318] option from the mount to silence this warning.
[ 95.240903][ T5318] =======================================================
[ 95.244287][ T5318] ==================================================================
[ 95.244299][ T5318] BUG: KASAN: slab-out-of-bounds in md5_blocks+0x120/0xbd0
[ 95.244387][ T5318] Read of size 64 at addr ffff88801395bf20 by task syz.0.0/5318
[ 95.244397][ T5318]
[ 95.244405][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.244416][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.244424][ T5318] Call Trace:
[ 95.244429][ T5318]
[ 95.244434][ T5318] dump_stack_lvl+0xe8/0x150
[ 95.244454][ T5318] print_address_description+0x55/0x1e0
[ 95.244470][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.244480][ T5318] print_report+0x58/0x70
[ 95.244494][ T5318] kasan_report+0x117/0x150
[ 95.244508][ T5318] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.244525][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.244537][ T5318] kasan_check_range+0x264/0x2c0
[ 95.244552][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.244562][ T5318] __asan_memcpy+0x29/0x70
[ 95.244578][ T5318] md5_blocks+0x120/0xbd0
[ 95.244590][ T5318] ? kasan_save_track+0x3e/0x80
[ 95.244602][ T5318] ? __kasan_kmalloc+0x93/0xb0
[ 95.244611][ T5318] ? __kmalloc_noprof+0x36b/0x720
[ 95.244627][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.244642][ T5318] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 95.244655][ T5318] ? ecryptfs_lookup+0x20e/0x780
[ 95.244669][ T5318] ? lookup_open+0x9e1/0x1a40
[ 95.244685][ T5318] ? path_openat+0x677/0x1d60
[ 95.244700][ T5318] ? do_file_open+0x23e/0x4a0
[ 95.244716][ T5318] ? do_sys_openat2+0x115/0x200
[ 95.244728][ T5318] ? __x64_sys_openat+0x138/0x170
[ 95.244741][ T5318] ? do_syscall_64+0x166/0x520
[ 95.244786][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.244808][ T5318] ? __pfx_md5_blocks+0x10/0x10
[ 95.244823][ T5318] ? simple_strntoull+0x134/0x190
[ 95.244836][ T5318] md5_update+0xef/0x150
[ 95.244847][ T5318] md5+0xed/0x180
[ 95.244857][ T5318] ? __pfx_md5+0x10/0x10
[ 95.244870][ T5318] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 95.244881][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.244895][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.244911][ T5318] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 95.244933][ T5318] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 95.244953][ T5318] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 95.244968][ T5318] ? d_alloc_parallel+0x1535/0x16b0
[ 95.244989][ T5318] ecryptfs_lookup+0x20e/0x780
[ 95.245006][ T5318] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 95.245024][ T5318] ? seqcount_lockdep_reader_access+0xec/0x100
[ 95.245041][ T5318] lookup_open+0x9e1/0x1a40
[ 95.245065][ T5318] path_openat+0x677/0x1d60
[ 95.245087][ T5318] do_file_open+0x23e/0x4a0
[ 95.245105][ T5318] ? __pfx_do_file_open+0x10/0x10
[ 95.245128][ T5318] ? _raw_spin_unlock+0x28/0x50
[ 95.245141][ T5318] ? alloc_fd+0x651/0x6c0
[ 95.245156][ T5318] do_sys_openat2+0x115/0x200
[ 95.245170][ T5318] ? __se_sys_futex+0x3a8/0x450
[ 95.245183][ T5318] ? __pfx_do_sys_openat2+0x10/0x10
[ 95.245198][ T5318] ? rcu_is_watching+0x16/0xb0
[ 95.245214][ T5318] __x64_sys_openat+0x138/0x170
[ 95.245229][ T5318] do_syscall_64+0x166/0x520
[ 95.245242][ T5318] ? trace_irq_disable+0x3b/0x140
[ 95.245255][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.245266][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 95.245279][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.245290][ T5318] RIP: 0033:0x7f1e6e79e159
[ 95.245300][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.245310][ T5318] RSP: 002b:00007f1e6f58dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.245324][ T5318] RAX: ffffffffffffffda RBX: 00007f1e6ea25fa0 RCX: 00007f1e6e79e159
[ 95.245333][ T5318] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 95.245341][ T5318] RBP: 00007f1e6e83506b R08: 0000000000000000 R09: 0000000000000000
[ 95.245348][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.245355][ T5318] R13: 00007f1e6ea26038 R14: 00007f1e6ea25fa0 R15: 00007ffc80d6dcc8
[ 95.245369][ T5318]
[ 95.245373][ T5318]
[ 95.245376][ T5318] Allocated by task 5317:
[ 95.245382][ T5318] kasan_save_track+0x3e/0x80
[ 95.245393][ T5318] __kasan_kmalloc+0x93/0xb0
[ 95.245405][ T5318] __kmalloc_cache_noprof+0x321/0x600
[ 95.245419][ T5318] task_numa_work+0x9be/0x15b0
[ 95.245432][ T5318] task_work_run+0x1d9/0x270
[ 95.245444][ T5318] resume_user_mode_work+0x5b/0x90
[ 95.245455][ T5318] irqentry_exit+0x2c9/0x910
[ 95.245466][ T5318] asm_sysvec_apic_timer_interrupt+0x1a/0x20
[ 95.245476][ T5318]
[ 95.245479][ T5318] The buggy address belongs to the object at ffff88801395bf00
[ 95.245479][ T5318] which belongs to the cache kmalloc-64 of size 64
[ 95.245488][ T5318] The buggy address is located 32 bytes inside of
[ 95.245488][ T5318] allocated 40-byte region [ffff88801395bf00, ffff88801395bf28)
[ 95.245500][ T5318]
[ 95.245503][ T5318] The buggy address belongs to the physical page:
[ 95.245509][ T5318] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1395b
[ 95.245522][ T5318] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 95.245532][ T5318] page_type: f5(slab)
[ 95.245542][ T5318] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 95.245552][ T5318] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 95.245558][ T5318] page dumped because: kasan: bad access detected
[ 95.245565][ T5318] page_owner tracks the page as allocated
[ 95.245568][ T5318] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5280, tgid 5280 (syz-executor), ts 92999413753
[ 95.245588][ T5318] post_alloc_hook+0x1f9/0x250
[ 95.245601][ T5318] get_page_from_freelist+0x2209/0x2280
[ 95.245610][ T5318] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 95.245619][ T5318] allocate_slab+0x7d/0x620
[ 95.245630][ T5318] ___slab_alloc+0x16a/0x960
[ 95.245639][ T5318] __kmalloc_flags_noprof+0x341/0x7a0
[ 95.245653][ T5318] alloc_slab_obj_exts+0x5c/0x180
[ 95.245664][ T5318] __memcg_slab_post_alloc_hook+0x60b/0xd90
[ 95.245677][ T5318] __kvmalloc_node_noprof+0x5f1/0x820
[ 95.245686][ T5318] xt_alloc_table_info+0x40/0xb0
[ 95.245698][ T5318] arpt_register_table+0xe0/0x440
[ 95.245712][ T5318] arptable_filter_table_init+0x41/0x70
[ 95.245726][ T5318] xt_find_table_lock+0x311/0x400
[ 95.245739][ T5318] xt_request_find_table_lock+0x26/0x100
[ 95.245751][ T5318] do_arpt_get_ctl+0x5f0/0x1270
[ 95.245764][ T5318] nf_getsockopt+0x26e/0x290
[ 95.245776][ T5318] page last free pid 79 tgid 79 ts 92998395758 stack trace:
[ 95.245784][ T5318] free_unref_folios+0xdc2/0x14e0
[ 95.245808][ T5318] shrink_folio_list+0x4a2d/0x5250
[ 95.245818][ T5318] evict_folios+0x3055/0x3fb0
[ 95.245833][ T5318] try_to_shrink_lruvec+0xe3b/0x1340
[ 95.245847][ T5318] shrink_one+0x233/0x730
[ 95.245861][ T5318] shrink_node+0x35d0/0x3e30
[ 95.245875][ T5318] kswapd+0x185e/0x32c0
[ 95.245884][ T5318] kthread+0x38b/0x480
[ 95.245892][ T5318] ret_from_fork+0x514/0xb70
[ 95.245902][ T5318] ret_from_fork_asm+0x1a/0x30
[ 95.245919][ T5318]
[ 95.245921][ T5318] Memory state around the buggy address:
[ 95.245928][ T5318] ffff88801395be00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 95.245935][ T5318] ffff88801395be80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 95.245942][ T5318] >ffff88801395bf00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 95.245948][ T5318] ^
[ 95.245955][ T5318] ffff88801395bf80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 95.245962][ T5318] ffff88801395c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 95.245968][ T5318] ==================================================================
[ 95.245978][ T5318] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.588415][ T5318] CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.592293][ T5318] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.596449][ T5318] Call Trace:
[ 95.597982][ T5318]
[ 95.599294][ T5318] vpanic+0x56d/0xa60
[ 95.601038][ T5318] ? __pfx_vpanic+0x10/0x10
[ 95.603059][ T5318] panic+0xc5/0xd0
[ 95.604729][ T5318] ? __pfx_panic+0x10/0x10
[ 95.606681][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.608673][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.610706][ T5318] check_panic_on_warn+0x89/0xb0
[ 95.612941][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.614910][ T5318] end_report+0x73/0x170
[ 95.616800][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.618796][ T5318] kasan_report+0x128/0x150
[ 95.620779][ T5318] ? do_raw_spin_lock+0x12b/0x2f0
[ 95.622964][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.624966][ T5318] kasan_check_range+0x264/0x2c0
[ 95.627164][ T5318] ? md5_blocks+0x120/0xbd0
[ 95.629142][ T5318] __asan_memcpy+0x29/0x70
[ 95.631124][ T5318] md5_blocks+0x120/0xbd0
[ 95.633012][ T5318] ? kasan_save_track+0x3e/0x80
[ 95.635157][ T5318] ? __kasan_kmalloc+0x93/0xb0
[ 95.637277][ T5318] ? __kmalloc_noprof+0x36b/0x720
[ 95.639469][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.642154][ T5318] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 95.645089][ T5318] ? ecryptfs_lookup+0x20e/0x780
[ 95.647319][ T5318] ? lookup_open+0x9e1/0x1a40
[ 95.649348][ T5318] ? path_openat+0x677/0x1d60
[ 95.651474][ T5318] ? do_file_open+0x23e/0x4a0
[ 95.653530][ T5318] ? do_sys_openat2+0x115/0x200
[ 95.655648][ T5318] ? __x64_sys_openat+0x138/0x170
[ 95.657842][ T5318] ? do_syscall_64+0x166/0x520
[ 95.659956][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.662649][ T5318] ? __pfx_md5_blocks+0x10/0x10
[ 95.664777][ T5318] ? simple_strntoull+0x134/0x190
[ 95.666987][ T5318] md5_update+0xef/0x150
[ 95.668862][ T5318] md5+0xed/0x180
[ 95.670465][ T5318] ? __pfx_md5+0x10/0x10
[ 95.672343][ T5318] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 95.674679][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.677371][ T5318] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 95.680029][ T5318] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 95.682718][ T5318] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 95.685599][ T5318] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 95.688624][ T5318] ? d_alloc_parallel+0x1535/0x16b0
[ 95.690911][ T5318] ecryptfs_lookup+0x20e/0x780
[ 95.693065][ T5318] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 95.695476][ T5318] ? seqcount_lockdep_reader_access+0xec/0x100
[ 95.698213][ T5318] lookup_open+0x9e1/0x1a40
[ 95.700241][ T5318] path_openat+0x677/0x1d60
[ 95.702223][ T5318] do_file_open+0x23e/0x4a0
[ 95.704183][ T5318] ? __pfx_do_file_open+0x10/0x10
[ 95.706400][ T5318] ? _raw_spin_unlock+0x28/0x50
[ 95.708548][ T5318] ? alloc_fd+0x651/0x6c0
[ 95.710461][ T5318] do_sys_openat2+0x115/0x200
[ 95.712561][ T5318] ? __se_sys_futex+0x3a8/0x450
[ 95.714732][ T5318] ? __pfx_do_sys_openat2+0x10/0x10
[ 95.717066][ T5318] ? rcu_is_watching+0x16/0xb0
[ 95.719217][ T5318] __x64_sys_openat+0x138/0x170
[ 95.721430][ T5318] do_syscall_64+0x166/0x520
[ 95.723584][ T5318] ? trace_irq_disable+0x3b/0x140
[ 95.725762][ T5318] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.728382][ T5318] ? clear_bhb_loop+0x70/0xc0
[ 95.730364][ T5318] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.732968][ T5318] RIP: 0033:0x7f1e6e79e159
[ 95.734893][ T5318] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.743186][ T5318] RSP: 002b:00007f1e6f58dfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
[ 95.746726][ T5318] RAX: ffffffffffffffda RBX: 00007f1e6ea25fa0 RCX: 00007f1e6e79e159
[ 95.750287][ T5318] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c
[ 95.753923][ T5318] RBP: 00007f1e6e83506b R08: 0000000000000000 R09: 0000000000000000
[ 95.757565][ T5318] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.761020][ T5318] R13: 00007f1e6ea26038 R14: 00007f1e6ea25fa0 R15: 00007ffc80d6dcc8
[ 95.764482][ T5318]
[ 95.766236][ T5318] Kernel Offset: disabled
[ 95.768116][ T5318] Rebooting in 86400 seconds..