program:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x1ff)
add_key$user(&(0x7f0000000200), &(0x7f0000000240)={'syz', 0x0}, &(0x7f0000000300)="040000", 0x3, 0xfffffffffffffffd)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000500)='./mnt\x00', &(0x7f0000000600)='ecryptfs\x00', 0x0, &(0x7f0000000700)='ecryptfs_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
setxattr(&(0x7f0000000800)='./mnt\x00', &(0x7f00000000c0)=@known='system.advise\x00', &(0x7f0000000a00)='val\x00', 0x4, 0x2)
[ 86.793930][ T5277] Bluetooth: hci0: command tx timeout
[ 86.953602][ T5323] ==================================================================
[ 86.953619][ T5323] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 86.953749][ T5323] Read of size 2 at addr ffff88803c36dddb by task syz.0.0/5323
[ 86.953760][ T5323]
[ 86.953788][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 86.953803][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 86.953841][ T5323] Call Trace:
[ 86.953871][ T5323]
[ 86.953878][ T5323] dump_stack_lvl+0xe8/0x150
[ 86.953898][ T5323] print_address_description+0x55/0x1e0
[ 86.953917][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 86.953935][ T5323] print_report+0x58/0x70
[ 86.953949][ T5323] kasan_report+0x117/0x150
[ 86.953966][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 86.953984][ T5323] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 86.954002][ T5323] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 86.954019][ T5323] ecryptfs_get_tree+0x563/0x1370
[ 86.954033][ T5323] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 86.954050][ T5323] vfs_get_tree+0x92/0x2a0
[ 86.954064][ T5323] do_new_mount+0x325/0xb00
[ 86.954080][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 86.954093][ T5323] ? ns_capable+0x89/0xe0
[ 86.954109][ T5323] ? path_mount+0x647/0x1050
[ 86.954123][ T5323] ? user_path_at+0xd4/0x160
[ 86.954145][ T5323] __se_sys_mount+0x31d/0x420
[ 86.954161][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 86.954178][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 86.954193][ T5323] do_syscall_64+0x166/0x520
[ 86.954248][ T5323] ? trace_irq_disable+0x3b/0x140
[ 86.954261][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.954273][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 86.954284][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.954294][ T5323] RIP: 0033:0x7f6e7c99e559
[ 86.954315][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 86.954326][ T5323] RSP: 002b:00007f6e7d7e3fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 86.954340][ T5323] RAX: ffffffffffffffda RBX: 00007f6e7cc25fa0 RCX: 00007f6e7c99e559
[ 86.954349][ T5323] RDX: 0000200000000600 RSI: 0000200000000500 RDI: 0000200000000400
[ 86.954358][ T5323] RBP: 00007f6e7ca358b0 R08: 0000200000000700 R09: 0000000000000000
[ 86.954366][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 86.954372][ T5323] R13: 00007f6e7cc26038 R14: 00007f6e7cc25fa0 R15: 00007ffe579ef3b8
[ 86.954388][ T5323]
[ 86.954392][ T5323]
[ 86.954424][ T5323] Allocated by task 5323:
[ 86.954431][ T5323] kasan_save_track+0x3e/0x80
[ 86.954444][ T5323] __kasan_kmalloc+0x93/0xb0
[ 86.954455][ T5323] __kmalloc_noprof+0x36b/0x720
[ 86.954466][ T5323] user_preparse+0x9e/0x160
[ 86.954490][ T5323] __key_create_or_update+0x354/0xa70
[ 86.954505][ T5323] key_create_or_update+0x42/0x60
[ 86.954516][ T5323] __se_sys_add_key+0x349/0x420
[ 86.954524][ T5323] do_syscall_64+0x166/0x520
[ 86.954535][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.954546][ T5323]
[ 86.954549][ T5323] The buggy address belongs to the object at ffff88803c36ddc0
[ 86.954549][ T5323] which belongs to the cache kmalloc-32 of size 32
[ 86.954569][ T5323] The buggy address is located 0 bytes to the right of
[ 86.954569][ T5323] allocated 27-byte region [ffff88803c36ddc0, ffff88803c36dddb)
[ 86.954581][ T5323]
[ 86.954584][ T5323] The buggy address belongs to the physical page:
[ 86.954602][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3c36d
[ 86.954613][ T5323] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 86.954624][ T5323] page_type: f5(slab)
[ 86.954635][ T5323] raw: 04fff00000000000 ffff88801c041780 dead000000000100 dead000000000122
[ 86.954645][ T5323] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 86.954652][ T5323] page dumped because: kasan: bad access detected
[ 86.954659][ T5323] page_owner tracks the page as allocated
[ 86.954663][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5126, tgid 5126 (dhcpcd-run-hook), ts 59363877526
[ 86.954681][ T5323] post_alloc_hook+0x1f9/0x250
[ 86.954699][ T5323] get_page_from_freelist+0x2209/0x2280
[ 86.954710][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 86.954718][ T5323] allocate_slab+0x7d/0x620
[ 86.954730][ T5323] refill_objects+0x2d5/0x350
[ 86.954741][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0
[ 86.954752][ T5323] __kmalloc_cache_noprof+0x39b/0x600
[ 86.954761][ T5323] kmem_cache_free+0x156/0x650
[ 86.954771][ T5323] tear_down_vmas+0x31f/0x530
[ 86.954786][ T5323] exit_mmap+0x4ca/0x9f0
[ 86.954799][ T5323] __mmput+0x118/0x420
[ 86.954809][ T5323] exit_mm+0x18e/0x240
[ 86.954817][ T5323] do_exit+0x6cd/0x2360
[ 86.954825][ T5323] do_group_exit+0x22d/0x2f0
[ 86.954836][ T5323] __x64_sys_exit_group+0x3f/0x40
[ 86.954847][ T5323] x64_sys_call+0x18c6/0x18d0
[ 86.954857][ T5323] page last free pid 5126 tgid 5126 ts 59363212160 stack trace:
[ 86.954864][ T5323] __free_frozen_pages+0xc93/0xd90
[ 86.954877][ T5323] tlb_finish_mmu+0x13e/0x220
[ 86.954885][ T5323] exit_mmap+0x4b2/0x9f0
[ 86.954896][ T5323] __mmput+0x118/0x420
[ 86.954905][ T5323] exit_mm+0x18e/0x240
[ 86.954913][ T5323] do_exit+0x6cd/0x2360
[ 86.954920][ T5323] do_group_exit+0x22d/0x2f0
[ 86.954928][ T5323] __x64_sys_exit_group+0x3f/0x40
[ 86.954937][ T5323] x64_sys_call+0x18c6/0x18d0
[ 86.954946][ T5323] do_syscall_64+0x166/0x520
[ 86.954957][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 86.954967][ T5323]
[ 86.954971][ T5323] Memory state around the buggy address:
[ 86.954978][ T5323] ffff88803c36dc80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.954986][ T5323] ffff88803c36dd00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.954994][ T5323] >ffff88803c36dd80: fa fb fb fb fc fc fc fc 00 00 00 03 fc fc fc fc
[ 86.955000][ T5323] ^
[ 86.955008][ T5323] ffff88803c36de00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 86.955017][ T5323] ffff88803c36de80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 86.955022][ T5323] ==================================================================
[ 86.955031][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 87.269470][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 87.273106][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 87.277650][ T5323] Call Trace:
[ 87.279157][ T5323]
[ 87.280690][ T5323] vpanic+0x56d/0xa60
[ 87.282985][ T5323] ? __pfx_vpanic+0x10/0x10
[ 87.285546][ T5323] panic+0xc5/0xd0
[ 87.287609][ T5323] ? __pfx_panic+0x10/0x10
[ 87.289867][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.293172][ T5323] ? rcu_is_watching+0x16/0xb0
[ 87.295739][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.299329][ T5323] check_panic_on_warn+0x89/0xb0
[ 87.301816][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.304239][ T5323] end_report+0x73/0x170
[ 87.305864][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.308289][ T5323] kasan_report+0x128/0x150
[ 87.310033][ T5323] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.312482][ T5323] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 87.314997][ T5323] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 87.318155][ T5323] ecryptfs_get_tree+0x563/0x1370
[ 87.320620][ T5323] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 87.348087][ T5323] vfs_get_tree+0x92/0x2a0
[ 87.350277][ T5323] do_new_mount+0x325/0xb00
[ 87.352182][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 87.354247][ T5323] ? ns_capable+0x89/0xe0
[ 87.356131][ T5323] ? path_mount+0x647/0x1050
[ 87.358021][ T5323] ? user_path_at+0xd4/0x160
[ 87.359971][ T5323] __se_sys_mount+0x31d/0x420
[ 87.361934][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 87.364866][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 87.367572][ T5323] do_syscall_64+0x166/0x520
[ 87.369945][ T5323] ? trace_irq_disable+0x3b/0x140
[ 87.372584][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.375316][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 87.377325][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 87.380305][ T5323] RIP: 0033:0x7f6e7c99e559
[ 87.391439][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 87.399671][ T5323] RSP: 002b:00007f6e7d7e3fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 87.403504][ T5323] RAX: ffffffffffffffda RBX: 00007f6e7cc25fa0 RCX: 00007f6e7c99e559
[ 87.408145][ T5323] RDX: 0000200000000600 RSI: 0000200000000500 RDI: 0000200000000400
[ 87.412921][ T5323] RBP: 00007f6e7ca358b0 R08: 0000200000000700 R09: 0000000000000000
[ 87.430932][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 87.434955][ T5323] R13: 00007f6e7cc26038 R14: 00007f6e7cc25fa0 R15: 00007ffe579ef3b8
[ 87.452129][ T5323]
[ 87.453940][ T5323] Kernel Offset: disabled
[ 87.458970][ T5323] Rebooting in 86400 seconds..