program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400000000", 0x5, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./mnt\x00', 0x106)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') (fail_nth: 47)
[ 92.794505][ T5283] Bluetooth: hci0: command tx timeout
[ 92.806015][ T10] cfg80211: failed to load regulatory.db
[ 92.877098][ T5323] FAULT_INJECTION: forcing a failure.
[ 92.877098][ T5323] name failslab, interval 1, probability 0, space 0, times 1
[ 92.877115][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.877124][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.877129][ T5323] Call Trace:
[ 92.877132][ T5323]
[ 92.877135][ T5323] dump_stack_lvl+0xe8/0x150
[ 92.877200][ T5323] should_fail_ex+0x410/0x560
[ 92.877254][ T5323] should_failslab+0xa8/0x100
[ 92.877268][ T5323] __kmalloc_cache_node_noprof+0xaa/0x620
[ 92.877286][ T5323] ? bdi_alloc+0x51/0x110
[ 92.877301][ T5323] ? bdi_alloc+0x51/0x110
[ 92.877320][ T5323] bdi_alloc+0x51/0x110
[ 92.877343][ T5323] super_setup_bdi_name+0xa8/0x210
[ 92.877362][ T5323] ? __pfx_super_setup_bdi_name+0x10/0x10
[ 92.877376][ T5323] ? ecryptfs_get_tree+0x5ba/0x1370
[ 92.877401][ T5323] ecryptfs_get_tree+0x641/0x1370
[ 92.877423][ T5323] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 92.877447][ T5323] vfs_get_tree+0x92/0x2a0
[ 92.877463][ T5323] do_new_mount+0x319/0xdc0
[ 92.877480][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 92.877494][ T5323] ? ns_capable+0x89/0xe0
[ 92.877510][ T5323] ? path_mount+0x647/0x1050
[ 92.877525][ T5323] ? user_path_at+0xd4/0x160
[ 92.877540][ T5323] __se_sys_mount+0x31d/0x420
[ 92.877558][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 92.877575][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 92.877589][ T5323] do_syscall_64+0x166/0x520
[ 92.877640][ T5323] ? trace_irq_disable+0x3b/0x140
[ 92.877653][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.877664][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 92.877679][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.877690][ T5323] RIP: 0033:0x7fb3fbf9e159
[ 92.877700][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.877709][ T5323] RSP: 002b:00007fb3fcdc5fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 92.877724][ T5323] RAX: ffffffffffffffda RBX: 00007fb3fc225fa0 RCX: 00007fb3fbf9e159
[ 92.877732][ T5323] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 92.877740][ T5323] RBP: 00007fb3fcdc6050 R08: 0000200000000500 R09: 0000000000000000
[ 92.877747][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 92.877752][ T5323] R13: 00007fb3fc226038 R14: 00007fb3fc225fa0 R15: 00007ffc1e14d9c8
[ 92.877771][ T5323]
[ 92.877889][ T5323] ==================================================================
[ 92.877895][ T5323] BUG: KASAN: slab-use-after-free in ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.877908][ T5323] Read of size 4 at addr ffff888012327a90 by task syz.0.0/5323
[ 92.877917][ T5323]
[ 92.877922][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 92.877934][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 92.877940][ T5323] Call Trace:
[ 92.877944][ T5323]
[ 92.877948][ T5323] dump_stack_lvl+0xe8/0x150
[ 92.877963][ T5323] print_address_description+0x55/0x1e0
[ 92.877978][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.877989][ T5323] print_report+0x58/0x70
[ 92.878001][ T5323] kasan_report+0x117/0x150
[ 92.878013][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.878026][ T5323] ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 92.878039][ T5323] ecryptfs_get_tree+0x1069/0x1370
[ 92.878057][ T5323] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 92.878075][ T5323] vfs_get_tree+0x92/0x2a0
[ 92.878090][ T5323] do_new_mount+0x319/0xdc0
[ 92.878103][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 92.878117][ T5323] ? ns_capable+0x89/0xe0
[ 92.878131][ T5323] ? path_mount+0x647/0x1050
[ 92.878143][ T5323] ? user_path_at+0xd4/0x160
[ 92.878157][ T5323] __se_sys_mount+0x31d/0x420
[ 92.878170][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 92.878183][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 92.878194][ T5323] do_syscall_64+0x166/0x520
[ 92.878205][ T5323] ? trace_irq_disable+0x3b/0x140
[ 92.878215][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.878225][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 92.878236][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.878246][ T5323] RIP: 0033:0x7fb3fbf9e159
[ 92.878255][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 92.878264][ T5323] RSP: 002b:00007fb3fcdc5fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 92.878276][ T5323] RAX: ffffffffffffffda RBX: 00007fb3fc225fa0 RCX: 00007fb3fbf9e159
[ 92.878283][ T5323] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 92.878290][ T5323] RBP: 00007fb3fcdc6050 R08: 0000200000000500 R09: 0000000000000000
[ 92.878297][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 92.878304][ T5323] R13: 00007fb3fc226038 R14: 00007fb3fc225fa0 R15: 00007ffc1e14d9c8
[ 92.878315][ T5323]
[ 92.878319][ T5323]
[ 92.878322][ T5323] Allocated by task 5323:
[ 92.878327][ T5323] kasan_save_track+0x3e/0x80
[ 92.878349][ T5323] __kasan_slab_alloc+0x6c/0x80
[ 92.878358][ T5323] kmem_cache_alloc_noprof+0x2b9/0x600
[ 92.878371][ T5323] ecryptfs_init_fs_context+0x70/0x1b0
[ 92.878385][ T5323] alloc_fs_context+0x9a3/0xd00
[ 92.878398][ T5323] do_new_mount+0x17f/0xdc0
[ 92.878409][ T5323] __se_sys_mount+0x31d/0x420
[ 92.878419][ T5323] do_syscall_64+0x166/0x520
[ 92.878428][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.878437][ T5323]
[ 92.878439][ T5323] Freed by task 5323:
[ 92.878444][ T5323] kasan_save_track+0x3e/0x80
[ 92.878458][ T5323] kasan_save_free_info+0x40/0x50
[ 92.878470][ T5323] __kasan_slab_free+0x5c/0x80
[ 92.878479][ T5323] kmem_cache_free+0x182/0x650
[ 92.878492][ T5323] deactivate_locked_super+0xbc/0x110
[ 92.878502][ T5323] ecryptfs_get_tree+0xff6/0x1370
[ 92.878563][ T5323] vfs_get_tree+0x92/0x2a0
[ 92.878578][ T5323] do_new_mount+0x319/0xdc0
[ 92.878588][ T5323] __se_sys_mount+0x31d/0x420
[ 92.878599][ T5323] do_syscall_64+0x166/0x520
[ 92.878608][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.878618][ T5323]
[ 92.878620][ T5323] The buggy address belongs to the object at ffff888012327a80
[ 92.878620][ T5323] which belongs to the cache ecryptfs_sb_cache of size 280
[ 92.878629][ T5323] The buggy address is located 16 bytes inside of
[ 92.878629][ T5323] freed 280-byte region [ffff888012327a80, ffff888012327b98)
[ 92.878640][ T5323]
[ 92.878643][ T5323] The buggy address belongs to the physical page:
[ 92.878649][ T5323] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012327c00 pfn:0x12327
[ 92.878659][ T5323] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
[ 92.878669][ T5323] page_type: f5(slab)
[ 92.878679][ T5323] raw: 00fff00000000200 ffff8880003bb000 ffff8880003ba4c8 ffff8880003ba4c8
[ 92.878688][ T5323] raw: ffff888012327c00 00000002000a0008 00000000f5000000 0000000000000000
[ 92.878694][ T5323] page dumped because: kasan: bad access detected
[ 92.878699][ T5323] page_owner tracks the page as allocated
[ 92.878703][ T5323] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5323, tgid 5322 (syz.0.0), ts 92876226618
[ 92.878720][ T5323] post_alloc_hook+0x1f9/0x250
[ 92.878734][ T5323] get_page_from_freelist+0x2209/0x2280
[ 92.878745][ T5323] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 92.878758][ T5323] allocate_slab+0x7d/0x620
[ 92.878768][ T5323] refill_objects+0x2d5/0x350
[ 92.878777][ T5323] __pcs_replace_empty_main+0x2c8/0x6c0
[ 92.878787][ T5323] kmem_cache_alloc_noprof+0x399/0x600
[ 92.878800][ T5323] ecryptfs_init_fs_context+0x70/0x1b0
[ 92.878813][ T5323] alloc_fs_context+0x9a3/0xd00
[ 92.878827][ T5323] do_new_mount+0x17f/0xdc0
[ 92.878837][ T5323] __se_sys_mount+0x31d/0x420
[ 92.878846][ T5323] do_syscall_64+0x166/0x520
[ 92.878855][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 92.878865][ T5323] page last free pid 1 tgid 1 ts 27409721916 stack trace:
[ 92.878873][ T5323] __free_frozen_pages+0xc93/0xd90
[ 92.878885][ T5323] free_reserved_area+0x204/0x2e0
[ 92.878898][ T5323] free_kernel_image_pages+0xa2/0x100
[ 92.878912][ T5323] kernel_init+0x36/0x1d0
[ 92.878925][ T5323] ret_from_fork+0x514/0xb70
[ 92.878934][ T5323] ret_from_fork_asm+0x1a/0x30
[ 92.878949][ T5323]
[ 92.878952][ T5323] Memory state around the buggy address:
[ 92.878958][ T5323] ffff888012327980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.878965][ T5323] ffff888012327a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.878971][ T5323] >ffff888012327a80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 92.878974][ T5323] ^
[ 92.878978][ T5323] ffff888012327b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 92.878982][ T5323] ffff888012327b80: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 92.878985][ T5323] ==================================================================
[ 92.878991][ T5323] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.253178][ T5323] CPU: 0 UID: 0 PID: 5323 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.257235][ T5323] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.262128][ T5323] Call Trace:
[ 93.263784][ T5323]
[ 93.265210][ T5323] vpanic+0x56d/0xa60
[ 93.267070][ T5323] ? __pfx_vpanic+0x10/0x10
[ 93.269170][ T5323] panic+0xc5/0xd0
[ 93.270884][ T5323] ? __pfx_panic+0x10/0x10
[ 93.272981][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.275976][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.279571][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.282503][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.285515][ T5323] check_panic_on_warn+0x89/0xb0
[ 93.287793][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.290605][ T5323] end_report+0x73/0x170
[ 93.292455][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.295221][ T5323] kasan_report+0x128/0x150
[ 93.297262][ T5323] ? ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.300183][ T5323] ecryptfs_destroy_mount_crypt_stat+0x2ee/0x300
[ 93.303055][ T5323] ecryptfs_get_tree+0x1069/0x1370
[ 93.305382][ T5323] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 93.307849][ T5323] vfs_get_tree+0x92/0x2a0
[ 93.309908][ T5323] do_new_mount+0x319/0xdc0
[ 93.312074][ T5323] ? __pfx_do_new_mount+0x10/0x10
[ 93.314400][ T5323] ? ns_capable+0x89/0xe0
[ 93.316407][ T5323] ? path_mount+0x647/0x1050
[ 93.318499][ T5323] ? user_path_at+0xd4/0x160
[ 93.320568][ T5323] __se_sys_mount+0x31d/0x420
[ 93.322808][ T5323] ? __pfx___se_sys_mount+0x10/0x10
[ 93.325149][ T5323] ? __x64_sys_mount+0x20/0xc0
[ 93.327118][ T5323] do_syscall_64+0x166/0x520
[ 93.328932][ T5323] ? trace_irq_disable+0x3b/0x140
[ 93.331378][ T5323] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.334411][ T5323] ? clear_bhb_loop+0x70/0xc0
[ 93.336829][ T5323] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.339603][ T5323] RIP: 0033:0x7fb3fbf9e159
[ 93.341623][ T5323] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.349962][ T5323] RSP: 002b:00007fb3fcdc5fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 93.353708][ T5323] RAX: ffffffffffffffda RBX: 00007fb3fc225fa0 RCX: 00007fb3fbf9e159
[ 93.357935][ T5323] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 93.361693][ T5323] RBP: 00007fb3fcdc6050 R08: 0000200000000500 R09: 0000000000000000
[ 93.365204][ T5323] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[ 93.368663][ T5323] R13: 00007fb3fc226038 R14: 00007fb3fc225fa0 R15: 00007ffc1e14d9c8
[ 93.372553][ T5323]
[ 93.374358][ T5323] Kernel Offset: disabled
[ 93.376409][ T5323] Rebooting in 86400 seconds..