program:
add_key$user(&(0x7f0000000040), &(0x7f0000000400)={'syz', 0x0}, &(0x7f0000000080)="90", 0x1, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mnt\x00', 0x106)
mount(&(0x7f0000000140)=@filename='./lower\x00', &(0x7f0000000180)='./mnt\x00', &(0x7f00000001c0)='ecryptfs\x00', 0x0, &(0x7f0000000200)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0), 0x8000, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002600)='blkio.bfq.time\x00', 0x275a, 0x0)
openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000340)={'syzkaller1\x00', 0x1})
r3 = socket$unix(0x1, 0x3, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000380)={'syzkaller1\x00', 0x1})
write(r2, &(0x7f00000003c0)="000081004500001c1234", 0xa)
r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000280), 0x2200, 0x0)
ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f00000002c0)=0x10)
mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x100000b, 0x8012, r4, 0x0)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0)
ioctl$SNDCTL_SYNTH_MEMAVL(r0, 0xc004510e, 0x0)
[ 74.676396][ T4662] Bluetooth: hci0: command tx timeout
[ 74.775119][ T5333] ==================================================================
[ 74.775162][ T5333] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 74.775260][ T5333] Read of size 2 at addr ffff888014320559 by task syz.0.0/5333
[ 74.775267][ T5333]
[ 74.775279][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 74.775288][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 74.775293][ T5333] Call Trace:
[ 74.775296][ T5333]
[ 74.775300][ T5333] dump_stack_lvl+0xe8/0x150
[ 74.775313][ T5333] print_address_description+0x55/0x1e0
[ 74.775325][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 74.775337][ T5333] print_report+0x58/0x70
[ 74.775364][ T5333] kasan_report+0x117/0x150
[ 74.775385][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 74.775403][ T5333] ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 74.775420][ T5333] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 74.775436][ T5333] ecryptfs_get_tree+0x547/0x12a0
[ 74.775448][ T5333] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 74.775461][ T5333] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 74.775476][ T5333] vfs_get_tree+0x92/0x2a0
[ 74.775488][ T5333] do_new_mount+0x325/0xb00
[ 74.775505][ T5333] ? __pfx_do_new_mount+0x10/0x10
[ 74.775518][ T5333] ? ns_capable+0x84/0xe0
[ 74.775539][ T5333] ? path_mount+0x647/0x1050
[ 74.775549][ T5333] ? user_path_at+0xd4/0x160
[ 74.775556][ T5333] __se_sys_mount+0x31d/0x420
[ 74.775567][ T5333] ? __pfx___se_sys_mount+0x10/0x10
[ 74.775578][ T5333] ? __x64_sys_mount+0x20/0xc0
[ 74.775589][ T5333] do_syscall_64+0x166/0x520
[ 74.775629][ T5333] ? trace_irq_disable+0x3b/0x140
[ 74.775639][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.775648][ T5333] ? clear_bhb_loop+0x70/0xc0
[ 74.775657][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.775665][ T5333] RIP: 0033:0x7f0e0d39f559
[ 74.775683][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 74.775692][ T5333] RSP: 002b:00007f0e0e279fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 74.775706][ T5333] RAX: ffffffffffffffda RBX: 00007f0e0d625fa0 RCX: 00007f0e0d39f559
[ 74.775714][ T5333] RDX: 00002000000001c0 RSI: 0000200000000180 RDI: 0000200000000140
[ 74.775723][ T5333] RBP: 00007f0e0d436b20 R08: 0000200000000200 R09: 0000000000000000
[ 74.775730][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 74.775737][ T5333] R13: 00007f0e0d626038 R14: 00007f0e0d625fa0 R15: 00007ffd7295e5c8
[ 74.775757][ T5333]
[ 74.775761][ T5333]
[ 74.775765][ T5333] Allocated by task 5333:
[ 74.775771][ T5333] kasan_save_track+0x3e/0x80
[ 74.775781][ T5333] __kasan_kmalloc+0x93/0xb0
[ 74.775788][ T5333] __kmalloc_noprof+0x366/0x710
[ 74.775801][ T5333] user_preparse+0x9e/0x160
[ 74.775818][ T5333] __key_create_or_update+0x360/0xa90
[ 74.775829][ T5333] key_create_or_update+0x42/0x60
[ 74.775839][ T5333] __se_sys_add_key+0x349/0x420
[ 74.775852][ T5333] do_syscall_64+0x166/0x520
[ 74.775862][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.775872][ T5333]
[ 74.775876][ T5333] The buggy address belongs to the object at ffff888014320540
[ 74.775876][ T5333] which belongs to the cache kmalloc-32 of size 32
[ 74.775885][ T5333] The buggy address is located 0 bytes to the right of
[ 74.775885][ T5333] allocated 25-byte region [ffff888014320540, ffff888014320559)
[ 74.775896][ T5333]
[ 74.775898][ T5333] The buggy address belongs to the physical page:
[ 74.775905][ T5333] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14320
[ 74.775915][ T5333] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 74.775927][ T5333] page_type: f5(slab)
[ 74.775938][ T5333] raw: 00fff00000000000 ffff88801c441780 dead000000000100 dead000000000122
[ 74.775947][ T5333] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 74.775953][ T5333] page dumped because: kasan: bad access detected
[ 74.775958][ T5333] page_owner tracks the page as allocated
[ 74.775962][ T5333] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4681, tgid 4681 (mount), ts 27711633594
[ 74.775990][ T5333] post_alloc_hook+0x1f9/0x250
[ 74.776005][ T5333] get_page_from_freelist+0x220f/0x2280
[ 74.776016][ T5333] __alloc_frozen_pages_noprof+0x1fc/0x400
[ 74.776025][ T5333] allocate_slab+0x7d/0x5e0
[ 74.776037][ T5333] refill_objects+0x2d5/0x350
[ 74.776050][ T5333] __pcs_replace_empty_main+0x2c8/0x6c0
[ 74.776062][ T5333] __kmalloc_cache_noprof+0x396/0x600
[ 74.776077][ T5333] kmem_cache_free+0x156/0x650
[ 74.776086][ T5333] vms_complete_munmap_vmas+0x892/0xbe0
[ 74.776095][ T5333] __mmap_complete+0xab/0x4b0
[ 74.776102][ T5333] mmap_region+0x16c0/0x23c0
[ 74.776110][ T5333] do_mmap+0xe0a/0x1300
[ 74.776117][ T5333] vm_mmap_pgoff+0x272/0x4e0
[ 74.776124][ T5333] ksys_mmap_pgoff+0x4dc/0x760
[ 74.776132][ T5333] do_syscall_64+0x166/0x520
[ 74.776140][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 74.776150][ T5333] page last free pid 1 tgid 1 ts 27452065557 stack trace:
[ 74.776157][ T5333] __free_frozen_pages+0xc97/0xd90
[ 74.776171][ T5333] free_reserved_area+0x204/0x2e0
[ 74.776186][ T5333] free_kernel_image_pages+0xa2/0x100
[ 74.776203][ T5333] kernel_init+0x36/0x1d0
[ 74.776214][ T5333] ret_from_fork+0x514/0xb70
[ 74.776225][ T5333] ret_from_fork_asm+0x1a/0x30
[ 74.776235][ T5333]
[ 74.776237][ T5333] Memory state around the buggy address:
[ 74.776241][ T5333] ffff888014320400: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc
[ 74.776247][ T5333] ffff888014320480: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 74.776251][ T5333] >ffff888014320500: 00 00 00 00 fc fc fc fc 00 00 00 01 fc fc fc fc
[ 74.776255][ T5333] ^
[ 74.776259][ T5333] ffff888014320580: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 74.776263][ T5333] ffff888014320600: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc
[ 74.776266][ T5333] ==================================================================
[ 74.776366][ T5333] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.035189][ T5333] CPU: 0 UID: 0 PID: 5333 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 75.039516][ T5333] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 75.044629][ T5333] Call Trace:
[ 75.046282][ T5333]
[ 75.047633][ T5333] vpanic+0x56d/0xa60
[ 75.049466][ T5333] ? rcu_is_watching+0x16/0xb0
[ 75.052012][ T5333] ? __pfx_vpanic+0x10/0x10
[ 75.054537][ T5333] ? __pfx___schedule+0x10/0x10
[ 75.056740][ T5333] panic+0xc5/0xd0
[ 75.058303][ T5333] ? __pfx_panic+0x10/0x10
[ 75.060025][ T5333] ? preempt_schedule_thunk+0x16/0x40
[ 75.062188][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 75.064996][ T5333] check_panic_on_warn+0x89/0xb0
[ 75.067149][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 75.069837][ T5333] end_report+0x73/0x170
[ 75.071710][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 75.074338][ T5333] kasan_report+0x128/0x150
[ 75.076251][ T5333] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 75.079023][ T5333] ecryptfs_verify_auth_tok_from_key+0x350/0x3a0
[ 75.081745][ T5333] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 75.084553][ T5333] ecryptfs_get_tree+0x547/0x12a0
[ 75.086825][ T5333] ? __pfx_vfs_parse_comma_sep+0x10/0x10
[ 75.089610][ T5333] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 75.092036][ T5333] vfs_get_tree+0x92/0x2a0
[ 75.094054][ T5333] do_new_mount+0x325/0xb00
[ 75.096151][ T5333] ? __pfx_do_new_mount+0x10/0x10
[ 75.098460][ T5333] ? ns_capable+0x84/0xe0
[ 75.100442][ T5333] ? path_mount+0x647/0x1050
[ 75.102498][ T5333] ? user_path_at+0xd4/0x160
[ 75.104578][ T5333] __se_sys_mount+0x31d/0x420
[ 75.106549][ T5333] ? __pfx___se_sys_mount+0x10/0x10
[ 75.108582][ T5333] ? __x64_sys_mount+0x20/0xc0
[ 75.110578][ T5333] do_syscall_64+0x166/0x520
[ 75.112467][ T5333] ? trace_irq_disable+0x3b/0x140
[ 75.114565][ T5333] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.117264][ T5333] ? clear_bhb_loop+0x70/0xc0
[ 75.119397][ T5333] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.121955][ T5333] RIP: 0033:0x7f0e0d39f559
[ 75.123818][ T5333] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 75.131552][ T5333] RSP: 002b:00007f0e0e279fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 75.135064][ T5333] RAX: ffffffffffffffda RBX: 00007f0e0d625fa0 RCX: 00007f0e0d39f559
[ 75.138470][ T5333] RDX: 00002000000001c0 RSI: 0000200000000180 RDI: 0000200000000140
[ 75.141793][ T5333] RBP: 00007f0e0d436b20 R08: 0000200000000200 R09: 0000000000000000
[ 75.145124][ T5333] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 75.148628][ T5333] R13: 00007f0e0d626038 R14: 00007f0e0d625fa0 R15: 00007ffd7295e5c8
[ 75.152175][ T5333]
[ 75.155164][ T5333] Kernel Offset: disabled
[ 75.157133][ T5333] Rebooting in 86400 seconds..