program:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140), 0x18500, 0x0)
ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0xf28)
socket$can_raw(0x1d, 0x3, 0x1)
socket$kcm(0x11, 0x3, 0x0)
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/16, 0x10, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./lower\x00', 0x1af)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r1 = openat(0xffffffffffffff9c, &(0x7f0000000440)='\x00', 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, 0x0)
r2 = socket$inet6_sctp(0xa, 0x1, 0x84)
ioctl$int_in(r2, 0x5452, &(0x7f0000000280)=0x6)
bind$inet6(r2, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
sendto$inet6(r2, &(0x7f0000847fff)='X', 0x20000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c)
r3 = syz_mount_image$ext4(&(0x7f0000000240)='ext4\x00', &(0x7f0000000000)='./mnt\x00', 0x1040, &(0x7f0000000200)={[{@usrquota}]}, 0xfc, 0x236, &(0x7f0000000800)="$eJzs3TFoM2UcBvDnLomf/b4gVRdBUEFEtFDqJrjURaEgpYgIKlREXJRWqC1urZOLg84qnVyKuFkdpUtxUQSnqh3qImhxsDjoELlcK9VGFFNz8t3vB5fcJe97//e4e95kOS5Aa00nmU/SSTKTpJekON/grnqZPt3cntpfTgaDx38shu3q7dpZv2tJtpI8mGSvLPJiN9nYffro54NH731jvXfPe7tPTU30IE8dHx0+dvLu4usfLjyw8fmX3y8WmU//D8d1+YoRn3WL5Jb/otj/RNFtegT8E0uvfvBVlftbk9w9zH8vZeqT9+baDXu93P/OX/V964cvbp/kWIHLNxj0qt/ArQHQOmWSfopyNkm9Xpazs/V/+K87V8uXVtdemXlhdX3l+aZnKuCy9JPDRz6+8tG1P+X/u06df+D6VeX/iaWdb6r1k07TowEmqcr/zLOb90X+oXXkH9pL/qG95B/aS/6hveQf2kv+ob3kH9pL/qG95B/a63z+AYB2GVxp+g5koClNzz8AAAAAAAAAAAAAAAAAAMBF21P7y2fLpGp++nZy/HCS7qj6neHziJMbh69XfyqqZr8r6m5jeebOMXcwpvcbvvv6pm+brf/ZHc3W31xJtl5LMtftXrz+itPr79+7+W++7z03ZoExPfRks/V/3Wm2/sJB8kk1/8yNmn/K3DZ8Hz3/9KvzN2b9l38ZcwcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABMzG8BAAD//8n0bSk=")
openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0)
ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r3, 0xc0506617, &(0x7f0000000580)={@id={0x2, 0x0, @a}, 0x40, 0x0, '\x00', @a})
mkdirat(0xffffffffffffff9c, &(0x7f0000000640)='mnt/encrypted_dir\x00', 0x0)
chdir(&(0x7f00000002c0)='mnt/encrypted_dir\x00')
symlink(&(0x7f00000007c0)='mnt/encrypted_dir\x00', &(0x7f0000000040)='./file0\x00')
[ 87.559249][ T5319] loop0: detected capacity change from 0 to 128
[ 87.579292][ T5319] =======================================================
[ 87.579292][ T5319] WARNING: The mand mount option has been deprecated and
[ 87.579292][ T5319] and is ignored by this kernel. Remove the mand
[ 87.579292][ T5319] option from the mount to silence this warning.
[ 87.579292][ T5319] =======================================================
[ 87.611208][ T5319] ==================================================================
[ 87.611216][ T5319] BUG: KASAN: slab-out-of-bounds in md5_blocks+0x120/0xbd0
[ 87.611327][ T5319] Read of size 64 at addr ffff888012f73ea0 by task syz.0.0/5319
[ 87.611336][ T5319]
[ 87.611344][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.611358][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.611364][ T5319] Call Trace:
[ 87.611369][ T5319]
[ 87.611374][ T5319] dump_stack_lvl+0xe8/0x150
[ 87.611391][ T5319] print_address_description+0x55/0x1e0
[ 87.611406][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.611416][ T5319] print_report+0x58/0x70
[ 87.611429][ T5319] kasan_report+0x117/0x150
[ 87.611440][ T5319] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.611463][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.611476][ T5319] kasan_check_range+0x264/0x2c0
[ 87.611488][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.611499][ T5319] __asan_memcpy+0x29/0x70
[ 87.611514][ T5319] md5_blocks+0x120/0xbd0
[ 87.611524][ T5319] ? kasan_save_track+0x3e/0x80
[ 87.611533][ T5319] ? __kasan_kmalloc+0x93/0xb0
[ 87.611543][ T5319] ? __kmalloc_noprof+0x36b/0x720
[ 87.611556][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 87.611569][ T5319] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 87.611581][ T5319] ? ecryptfs_lookup+0x20e/0x780
[ 87.611595][ T5319] ? lookup_one_qstr_excl+0x12d/0x360
[ 87.611609][ T5319] ? filename_create+0x20e/0x370
[ 87.611623][ T5319] ? filename_mkdirat+0xd2/0x510
[ 87.611631][ T5319] ? __se_sys_mkdirat+0x35/0x150
[ 87.611640][ T5319] ? do_syscall_64+0x166/0x520
[ 87.611691][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.611704][ T5319] ? __pfx_md5_blocks+0x10/0x10
[ 87.611718][ T5319] ? simple_strntoull+0x134/0x190
[ 87.611729][ T5319] md5_update+0xef/0x150
[ 87.611741][ T5319] md5+0xed/0x180
[ 87.611752][ T5319] ? __pfx_md5+0x10/0x10
[ 87.611763][ T5319] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 87.611773][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 87.611785][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 87.611798][ T5319] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 87.611816][ T5319] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 87.611830][ T5319] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 87.611847][ T5319] ecryptfs_lookup+0x20e/0x780
[ 87.611862][ T5319] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 87.611878][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 87.611888][ T5319] ? d_alloc+0x144/0x190
[ 87.611903][ T5319] lookup_one_qstr_excl+0x12d/0x360
[ 87.611919][ T5319] filename_create+0x20e/0x370
[ 87.611936][ T5319] ? __pfx_filename_create+0x10/0x10
[ 87.611952][ T5319] filename_mkdirat+0xd2/0x510
[ 87.611963][ T5319] ? __pfx_filename_mkdirat+0x10/0x10
[ 87.611973][ T5319] ? do_getname+0x151/0x250
[ 87.611985][ T5319] __se_sys_mkdirat+0x35/0x150
[ 87.611996][ T5319] do_syscall_64+0x166/0x520
[ 87.612008][ T5319] ? trace_irq_disable+0x3b/0x140
[ 87.612018][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.612029][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 87.612042][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.612053][ T5319] RIP: 0033:0x7f1c5e59e159
[ 87.612064][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.612075][ T5319] RSP: 002b:00007f1c5f45afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 87.612089][ T5319] RAX: ffffffffffffffda RBX: 00007f1c5e825fa0 RCX: 00007f1c5e59e159
[ 87.612098][ T5319] RDX: 0000000000000000 RSI: 0000200000000640 RDI: ffffffffffffff9c
[ 87.612106][ T5319] RBP: 00007f1c5e63506b R08: 0000000000000000 R09: 0000000000000000
[ 87.612113][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.612119][ T5319] R13: 00007f1c5e826038 R14: 00007f1c5e825fa0 R15: 00007ffef46b20e8
[ 87.612131][ T5319]
[ 87.612135][ T5319]
[ 87.612137][ T5319] Allocated by task 4982:
[ 87.612143][ T5319] kasan_save_track+0x3e/0x80
[ 87.612153][ T5319] __kasan_kmalloc+0x93/0xb0
[ 87.612162][ T5319] __kmalloc_noprof+0x36b/0x720
[ 87.612177][ T5319] tomoyo_commit_ok+0x29/0x1d0
[ 87.612189][ T5319] tomoyo_update_domain+0x4ea/0x7e0
[ 87.612206][ T5319] tomoyo_write_misc+0x17b/0x1d0
[ 87.612215][ T5319] tomoyo_supervisor+0xff8/0x1560
[ 87.612224][ T5319] tomoyo_env_perm+0x151/0x1f0
[ 87.612235][ T5319] tomoyo_find_next_domain+0x1332/0x1a90
[ 87.612248][ T5319] tomoyo_bprm_check_security+0x11b/0x180
[ 87.612260][ T5319] security_bprm_check+0x85/0x240
[ 87.612271][ T5319] bprm_execve+0x888/0x1590
[ 87.612284][ T5319] do_execveat_common+0x4f4/0x670
[ 87.612327][ T5319] __x64_sys_execve+0x97/0xc0
[ 87.612342][ T5319] do_syscall_64+0x166/0x520
[ 87.612355][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.612366][ T5319]
[ 87.612369][ T5319] The buggy address belongs to the object at ffff888012f73e80
[ 87.612369][ T5319] which belongs to the cache kmalloc-64 of size 64
[ 87.612379][ T5319] The buggy address is located 32 bytes inside of
[ 87.612379][ T5319] allocated 40-byte region [ffff888012f73e80, ffff888012f73ea8)
[ 87.612387][ T5319]
[ 87.612389][ T5319] The buggy address belongs to the physical page:
[ 87.612394][ T5319] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12f73
[ 87.612401][ T5319] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 87.612407][ T5319] page_type: f5(slab)
[ 87.612413][ T5319] raw: 00fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122
[ 87.612419][ T5319] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
[ 87.612422][ T5319] page dumped because: kasan: bad access detected
[ 87.612427][ T5319] page_owner tracks the page as allocated
[ 87.612431][ T5319] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4696, tgid 4696 (udevadm), ts 29258985719
[ 87.612456][ T5319] post_alloc_hook+0x1f9/0x250
[ 87.612476][ T5319] get_page_from_freelist+0x2209/0x2280
[ 87.612486][ T5319] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 87.612496][ T5319] allocate_slab+0x7d/0x620
[ 87.612508][ T5319] refill_objects+0x2d5/0x350
[ 87.612520][ T5319] __pcs_replace_empty_main+0x2c8/0x6c0
[ 87.612532][ T5319] __kmalloc_noprof+0x47b/0x720
[ 87.612546][ T5319] tomoyo_encode+0x2ad/0x570
[ 87.612558][ T5319] tomoyo_realpath_from_path+0x5fa/0x640
[ 87.612568][ T5319] tomoyo_path_perm+0x283/0x560
[ 87.612577][ T5319] security_inode_getattr+0x12b/0x310
[ 87.612589][ T5319] vfs_getattr+0x23/0x70
[ 87.612599][ T5319] vfs_statx_path+0x2b/0x230
[ 87.612610][ T5319] vfs_statx+0x12e/0x200
[ 87.612619][ T5319] vfs_fstatat+0x11b/0x170
[ 87.612631][ T5319] __x64_sys_newfstatat+0x151/0x200
[ 87.612642][ T5319] page last free pid 4696 tgid 4696 ts 29256503628 stack trace:
[ 87.612649][ T5319] __free_frozen_pages+0xc93/0xd90
[ 87.612667][ T5319] __slab_free+0x274/0x2c0
[ 87.612675][ T5319] qlist_free_all+0x99/0x100
[ 87.612689][ T5319] kasan_quarantine_reduce+0x148/0x160
[ 87.612701][ T5319] __kasan_slab_alloc+0x22/0x80
[ 87.612709][ T5319] kmem_cache_alloc_noprof+0x2b9/0x600
[ 87.612721][ T5319] do_getname+0x2e/0x250
[ 87.612735][ T5319] do_readlinkat+0xc8/0x510
[ 87.612745][ T5319] __x64_sys_readlink+0x7f/0x90
[ 87.612755][ T5319] do_syscall_64+0x166/0x520
[ 87.612771][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.612784][ T5319]
[ 87.612787][ T5319] Memory state around the buggy address:
[ 87.612792][ T5319] ffff888012f73d80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 87.612800][ T5319] ffff888012f73e00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 87.612807][ T5319] >ffff888012f73e80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 87.612816][ T5319] ^
[ 87.612821][ T5319] ffff888012f73f00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
[ 87.612828][ T5319] ffff888012f73f80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ 87.612833][ T5319] ==================================================================
[ 87.691182][ T5319] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.957720][ T5319] CPU: 0 UID: 0 PID: 5319 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.961507][ T5319] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.966463][ T5319] Call Trace:
[ 87.967949][ T5319]
[ 87.969230][ T5319] vpanic+0x56d/0xa60
[ 87.970957][ T5319] ? __pfx_vpanic+0x10/0x10
[ 87.972976][ T5319] panic+0xc5/0xd0
[ 87.974551][ T5319] ? __pfx_panic+0x10/0x10
[ 87.976400][ T5319] ? preempt_schedule_thunk+0x16/0x40
[ 87.978670][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.980559][ T5319] ? preempt_schedule_thunk+0x16/0x40
[ 87.982839][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.984734][ T5319] check_panic_on_warn+0x89/0xb0
[ 87.986815][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.988723][ T5319] end_report+0x73/0x170
[ 87.990465][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.992216][ T5319] kasan_report+0x128/0x150
[ 87.994176][ T5319] ? do_raw_spin_lock+0x12b/0x2f0
[ 87.996389][ T5319] ? md5_blocks+0x120/0xbd0
[ 87.998311][ T5319] kasan_check_range+0x264/0x2c0
[ 88.000392][ T5319] ? md5_blocks+0x120/0xbd0
[ 88.002333][ T5319] __asan_memcpy+0x29/0x70
[ 88.004230][ T5319] md5_blocks+0x120/0xbd0
[ 88.006063][ T5319] ? kasan_save_track+0x3e/0x80
[ 88.008109][ T5319] ? __kasan_kmalloc+0x93/0xb0
[ 88.010277][ T5319] ? __kmalloc_noprof+0x36b/0x720
[ 88.012379][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 88.014769][ T5319] ? ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 88.017359][ T5319] ? ecryptfs_lookup+0x20e/0x780
[ 88.019021][ T5319] ? lookup_one_qstr_excl+0x12d/0x360
[ 88.021121][ T5319] ? filename_create+0x20e/0x370
[ 88.023106][ T5319] ? filename_mkdirat+0xd2/0x510
[ 88.025126][ T5319] ? __se_sys_mkdirat+0x35/0x150
[ 88.027231][ T5319] ? do_syscall_64+0x166/0x520
[ 88.029348][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.031949][ T5319] ? __pfx_md5_blocks+0x10/0x10
[ 88.034065][ T5319] ? simple_strntoull+0x134/0x190
[ 88.036250][ T5319] md5_update+0xef/0x150
[ 88.037957][ T5319] md5+0xed/0x180
[ 88.039387][ T5319] ? __pfx_md5+0x10/0x10
[ 88.041053][ T5319] ? bpf_core_calc_relo+0x6e0/0x13f0
[ 88.043165][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 88.045833][ T5319] ? ecryptfs_write_tag_70_packet+0x4bf/0x12e0
[ 88.048408][ T5319] ecryptfs_write_tag_70_packet+0x820/0x12e0
[ 88.050881][ T5319] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 88.053562][ T5319] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 88.056562][ T5319] ecryptfs_lookup+0x20e/0x780
[ 88.058602][ T5319] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 88.060836][ T5319] ? _raw_spin_unlock+0x28/0x50
[ 88.062999][ T5319] ? d_alloc+0x144/0x190
[ 88.065239][ T5319] lookup_one_qstr_excl+0x12d/0x360
[ 88.067795][ T5319] filename_create+0x20e/0x370
[ 88.069898][ T5319] ? __pfx_filename_create+0x10/0x10
[ 88.072245][ T5319] filename_mkdirat+0xd2/0x510
[ 88.074502][ T5319] ? __pfx_filename_mkdirat+0x10/0x10
[ 88.076879][ T5319] ? do_getname+0x151/0x250
[ 88.078860][ T5319] __se_sys_mkdirat+0x35/0x150
[ 88.080962][ T5319] do_syscall_64+0x166/0x520
[ 88.082993][ T5319] ? trace_irq_disable+0x3b/0x140
[ 88.085155][ T5319] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.087705][ T5319] ? clear_bhb_loop+0x70/0xc0
[ 88.089838][ T5319] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 88.092485][ T5319] RIP: 0033:0x7f1c5e59e159
[ 88.094417][ T5319] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 88.102553][ T5319] RSP: 002b:00007f1c5f45afe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
[ 88.106218][ T5319] RAX: ffffffffffffffda RBX: 00007f1c5e825fa0 RCX: 00007f1c5e59e159
[ 88.109708][ T5319] RDX: 0000000000000000 RSI: 0000200000000640 RDI: ffffffffffffff9c
[ 88.113252][ T5319] RBP: 00007f1c5e63506b R08: 0000000000000000 R09: 0000000000000000
[ 88.116581][ T5319] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 88.119803][ T5319] R13: 00007f1c5e826038 R14: 00007f1c5e825fa0 R15: 00007ffef46b20e8
[ 88.123202][ T5319]
[ 88.124874][ T5319] Kernel Offset: disabled
[ 88.126642][ T5319] Rebooting in 86400 seconds..