program: socket$kcm(0x11, 0x3, 0x0) add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/16, 0x10, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000140)='./mnt/file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x2000) r2 = getegid() r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r3, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x2, 0x0, 0x0, 0x4, 0x4, 0x4, 0x2000, 0x101, r4, r5, 0xf0ee, 0x4}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$fuse(&(0x7f0000000000), &(0x7f00000000c0)='./mnt\x00', 0x0, &(0x7f0000000200)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x5}}, {@max_read={'max_read', 0x3d, 0xd}}, {@max_read={'max_read', 0x3d, 0x7}}, {@default_permissions}], [{@fowner_eq={'fowner', 0x3d, r4}}]}}, 0x0, 0x0, &(0x7f0000000300)) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, 0x0) [ 94.888797][ T5278] Bluetooth: hci0: command tx timeout [ 94.983937][ T5314] ================================================================== [ 94.983969][ T5314] BUG: KASAN: slab-use-after-free in ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.984130][ T5314] Read of size 4 at addr ffff8880438e4398 by task syz.0.0/5314 [ 94.984159][ T5314] [ 94.984176][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.984208][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.984217][ T5314] Call Trace: [ 94.984230][ T5314] [ 94.984247][ T5314] dump_stack_lvl+0xe8/0x150 [ 94.984274][ T5314] print_address_description+0x55/0x1e0 [ 94.984292][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.984305][ T5314] print_report+0x58/0x70 [ 94.984320][ T5314] kasan_report+0x117/0x150 [ 94.984341][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.984353][ T5314] ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.984364][ T5314] ecryptfs_encrypt_and_encode_filename+0x576/0x1580 [ 94.984374][ T5314] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10 [ 94.984382][ T5314] ? d_alloc_parallel+0x1535/0x16b0 [ 94.984398][ T5314] ecryptfs_lookup+0x20e/0x780 [ 94.984413][ T5314] ? __pfx_ecryptfs_lookup+0x10/0x10 [ 94.984428][ T5314] ? lock_acquire+0x232/0x350 [ 94.984449][ T5314] __lookup_slow+0x1fb/0x2f0 [ 94.984472][ T5314] lookup_slow+0x53/0x70 [ 94.984484][ T5314] path_lookupat+0x3f5/0x8c0 [ 94.984501][ T5314] filename_lookup+0x265/0x5d0 [ 94.984514][ T5314] ? __pfx_filename_lookup+0x10/0x10 [ 94.984537][ T5314] vfs_statx+0xfc/0x200 [ 94.984549][ T5314] ? __pfx_vfs_statx+0x10/0x10 [ 94.984559][ T5314] ? strncpy_from_user+0x150/0x2c0 [ 94.984588][ T5314] ? do_getname+0x151/0x250 [ 94.984601][ T5314] vfs_fstatat+0x11b/0x170 [ 94.984613][ T5314] __x64_sys_newfstatat+0x151/0x200 [ 94.984626][ T5314] ? __pfx___x64_sys_newfstatat+0x10/0x10 [ 94.984637][ T5314] ? blkcg_maybe_throttle_current+0x1b0/0xb90 [ 94.984663][ T5314] ? rcu_is_watching+0x16/0xb0 [ 94.984681][ T5314] do_syscall_64+0x166/0x520 [ 94.984763][ T5314] ? trace_irq_disable+0x3b/0x140 [ 94.984775][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.984787][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 94.984795][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.984803][ T5314] RIP: 0033:0x7f7c96b9e159 [ 94.984811][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.984827][ T5314] RSP: 002b:00007f7c979defe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 94.984838][ T5314] RAX: ffffffffffffffda RBX: 00007f7c96e25fa0 RCX: 00007f7c96b9e159 [ 94.984843][ T5314] RDX: 0000200000000180 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 94.984849][ T5314] RBP: 00007f7c96c3506b R08: 0000000000000000 R09: 0000000000000000 [ 94.984855][ T5314] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000 [ 94.984859][ T5314] R13: 00007f7c96e26038 R14: 00007f7c96e25fa0 R15: 00007ffe237901e8 [ 94.984867][ T5314] [ 94.984870][ T5314] [ 94.984873][ T5314] Allocated by task 5313: [ 94.984891][ T5314] kasan_save_track+0x3e/0x80 [ 94.984902][ T5314] __kasan_kmalloc+0x93/0xb0 [ 94.984908][ T5314] __kmalloc_noprof+0x36b/0x720 [ 94.984919][ T5314] security_inode_init_security+0x102/0x3e0 [ 94.984928][ T5314] shmem_symlink+0xe0/0x4d0 [ 94.984938][ T5314] vfs_symlink+0x18b/0x330 [ 94.984948][ T5314] filename_symlinkat+0x1cd/0x410 [ 94.984957][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 94.984965][ T5314] do_syscall_64+0x166/0x520 [ 94.984976][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.984985][ T5314] [ 94.984988][ T5314] Freed by task 5313: [ 94.984993][ T5314] kasan_save_track+0x3e/0x80 [ 94.985007][ T5314] kasan_save_free_info+0x40/0x50 [ 94.985020][ T5314] __kasan_slab_free+0x5c/0x80 [ 94.985029][ T5314] kfree+0x1c5/0x650 [ 94.985039][ T5314] security_inode_init_security+0x34e/0x3e0 [ 94.985050][ T5314] shmem_symlink+0xe0/0x4d0 [ 94.985062][ T5314] vfs_symlink+0x18b/0x330 [ 94.985071][ T5314] filename_symlinkat+0x1cd/0x410 [ 94.985081][ T5314] __se_sys_symlinkat+0x4e/0x2b0 [ 94.985090][ T5314] do_syscall_64+0x166/0x520 [ 94.985101][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.985111][ T5314] [ 94.985114][ T5314] The buggy address belongs to the object at ffff8880438e4380 [ 94.985114][ T5314] which belongs to the cache kmalloc-64 of size 64 [ 94.985131][ T5314] The buggy address is located 24 bytes inside of [ 94.985131][ T5314] freed 64-byte region [ffff8880438e4380, ffff8880438e43c0) [ 94.985137][ T5314] [ 94.985140][ T5314] The buggy address belongs to the physical page: [ 94.985144][ T5314] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x438e4 [ 94.985152][ T5314] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 94.985162][ T5314] page_type: f5(slab) [ 94.985172][ T5314] raw: 04fff00000000000 ffff88801b0418c0 dead000000000100 dead000000000122 [ 94.985181][ T5314] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 94.985186][ T5314] page dumped because: kasan: bad access detected [ 94.985192][ T5314] page_owner tracks the page as allocated [ 94.985197][ T5314] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5207, tgid 5207 (dhcpcd-run-hook), ts 75540822826 [ 94.985214][ T5314] post_alloc_hook+0x1f9/0x250 [ 94.985228][ T5314] get_page_from_freelist+0x2209/0x2280 [ 94.985243][ T5314] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.985259][ T5314] allocate_slab+0x7d/0x620 [ 94.985270][ T5314] refill_objects+0x2d5/0x350 [ 94.985280][ T5314] __pcs_replace_empty_main+0x2c8/0x6c0 [ 94.985287][ T5314] __kmalloc_noprof+0x47b/0x720 [ 94.985295][ T5314] tomoyo_encode+0x2ad/0x570 [ 94.985303][ T5314] tomoyo_realpath_from_path+0x5fa/0x640 [ 94.985310][ T5314] tomoyo_path_perm+0x283/0x560 [ 94.985319][ T5314] security_inode_getattr+0x12b/0x310 [ 94.985327][ T5314] __x64_sys_newfstat+0x133/0x270 [ 94.985333][ T5314] do_syscall_64+0x166/0x520 [ 94.985340][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.985346][ T5314] page last free pid 15 tgid 15 ts 74928772444 stack trace: [ 94.985351][ T5314] __free_frozen_pages+0xc93/0xd90 [ 94.985362][ T5314] tlb_remove_table_rcu+0x85/0x100 [ 94.985375][ T5314] rcu_core+0x926/0x1260 [ 94.985386][ T5314] handle_softirqs+0x226/0x860 [ 94.985400][ T5314] run_ksoftirqd+0x36/0x60 [ 94.985413][ T5314] smpboot_thread_fn+0x565/0xa70 [ 94.985427][ T5314] kthread+0x38b/0x480 [ 94.985436][ T5314] ret_from_fork+0x514/0xb70 [ 94.985445][ T5314] ret_from_fork_asm+0x1a/0x30 [ 94.985458][ T5314] [ 94.985461][ T5314] Memory state around the buggy address: [ 94.985474][ T5314] ffff8880438e4280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.985482][ T5314] ffff8880438e4300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.985490][ T5314] >ffff8880438e4380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.985496][ T5314] ^ [ 94.985503][ T5314] ffff8880438e4400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.985510][ T5314] ffff8880438e4480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 94.985517][ T5314] ================================================================== [ 94.985525][ T5314] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.286091][ T5314] CPU: 0 UID: 0 PID: 5314 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.290085][ T5314] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.294415][ T5314] Call Trace: [ 95.295845][ T5314] [ 95.297137][ T5314] vpanic+0x56d/0xa60 [ 95.298842][ T5314] ? __pfx_vpanic+0x10/0x10 [ 95.300731][ T5314] panic+0xc5/0xd0 [ 95.302323][ T5314] ? __pfx_panic+0x10/0x10 [ 95.304259][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.306708][ T5314] ? rcu_is_watching+0x16/0xb0 [ 95.308752][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.311327][ T5314] check_panic_on_warn+0x89/0xb0 [ 95.313394][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.316027][ T5314] end_report+0x73/0x170 [ 95.317849][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.320563][ T5314] kasan_report+0x128/0x150 [ 95.322575][ T5314] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.325252][ T5314] ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.328220][ T5314] ecryptfs_encrypt_and_encode_filename+0x576/0x1580 [ 95.331135][ T5314] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10 [ 95.334119][ T5314] ? d_alloc_parallel+0x1535/0x16b0 [ 95.336316][ T5314] ecryptfs_lookup+0x20e/0x780 [ 95.338450][ T5314] ? __pfx_ecryptfs_lookup+0x10/0x10 [ 95.340844][ T5314] ? lock_acquire+0x232/0x350 [ 95.342858][ T5314] __lookup_slow+0x1fb/0x2f0 [ 95.344860][ T5314] lookup_slow+0x53/0x70 [ 95.346590][ T5314] path_lookupat+0x3f5/0x8c0 [ 95.348584][ T5314] filename_lookup+0x265/0x5d0 [ 95.350577][ T5314] ? __pfx_filename_lookup+0x10/0x10 [ 95.352773][ T5314] vfs_statx+0xfc/0x200 [ 95.354448][ T5314] ? __pfx_vfs_statx+0x10/0x10 [ 95.356487][ T5314] ? strncpy_from_user+0x150/0x2c0 [ 95.358665][ T5314] ? do_getname+0x151/0x250 [ 95.360591][ T5314] vfs_fstatat+0x11b/0x170 [ 95.362457][ T5314] __x64_sys_newfstatat+0x151/0x200 [ 95.364497][ T5314] ? __pfx___x64_sys_newfstatat+0x10/0x10 [ 95.366554][ T5314] ? blkcg_maybe_throttle_current+0x1b0/0xb90 [ 95.368845][ T5314] ? rcu_is_watching+0x16/0xb0 [ 95.370842][ T5314] do_syscall_64+0x166/0x520 [ 95.372728][ T5314] ? trace_irq_disable+0x3b/0x140 [ 95.374849][ T5314] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.377515][ T5314] ? clear_bhb_loop+0x70/0xc0 [ 95.379618][ T5314] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.382115][ T5314] RIP: 0033:0x7f7c96b9e159 [ 95.384102][ T5314] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.392062][ T5314] RSP: 002b:00007f7c979defe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000106 [ 95.395686][ T5314] RAX: ffffffffffffffda RBX: 00007f7c96e25fa0 RCX: 00007f7c96b9e159 [ 95.399238][ T5314] RDX: 0000200000000180 RSI: 0000200000000140 RDI: ffffffffffffff9c [ 95.402733][ T5314] RBP: 00007f7c96c3506b R08: 0000000000000000 R09: 0000000000000000 [ 95.406188][ T5314] R10: 0000000000002000 R11: 0000000000000246 R12: 0000000000000000 [ 95.409635][ T5314] R13: 00007f7c96e26038 R14: 00007f7c96e25fa0 R15: 00007ffe237901e8 [ 95.413171][ T5314] [ 95.414962][ T5314] Kernel Offset: disabled [ 95.416905][ T5314] Rebooting in 86400 seconds..