================================================================== BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x324/0x360 fs/ecryptfs/keystore.c:465 Read of size 2 at addr ffff0000d24cc999 by task syz.5.948/8124 CPU: 1 UID: 0 PID: 8124 Comm: syz.5.948 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391 ecryptfs_verify_auth_tok_from_key+0x324/0x360 fs/ecryptfs/keystore.c:465 ecryptfs_keyring_auth_tok_for_sig+0xe8/0x1a0 fs/ecryptfs/keystore.c:1606 ecryptfs_init_global_auth_toks fs/ecryptfs/main.c:194 [inline] ecryptfs_validate_options fs/ecryptfs/main.c:420 [inline] ecryptfs_get_tree+0x478/0x1044 fs/ecryptfs/main.c:453 vfs_get_tree+0x90/0x28c fs/super.c:1932 fc_mount+0x24/0xac fs/namespace.c:1278 do_new_mount_fc fs/namespace.c:3885 [inline] do_new_mount+0x2a4/0x538 fs/namespace.c:3961 path_mount+0x5f0/0xa88 fs/namespace.c:4312 do_mount+0xe8/0x148 fs/namespace.c:4325 __do_sys_mount fs/namespace.c:4543 [inline] __se_sys_mount fs/namespace.c:4520 [inline] __arm64_sys_mount+0x33c/0x388 fs/namespace.c:4520 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 Allocated by task 7712: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] user_preparse+0x94/0x160 security/keys/user_defined.c:67 __key_create_or_update+0x264/0x7fc security/keys/key.c:854 key_create_or_update+0x60/0x7c security/keys/key.c:1021 __do_sys_add_key security/keys/keyctl.c:134 [inline] __se_sys_add_key security/keys/keyctl.c:74 [inline] __arm64_sys_add_key+0x384/0x43c security/keys/keyctl.c:74 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 The buggy address belongs to the object at ffff0000d24cc980 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 0 bytes to the right of allocated 25-byte region [ffff0000d24cc980, ffff0000d24cc999) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1124cc flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000000 ffff0000c0001780 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d24cc880: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ffff0000d24cc900: fa fb fb fb fc fc fc fc 00 00 00 00 fc fc fc fc >ffff0000d24cc980: 00 00 00 01 fc fc fc fc fa fb fb fb fc fc fc fc ^ ffff0000d24cca00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ffff0000d24cca80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc ================================================================== ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [197] Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4] Could not find valid key in user session keyring for sig specified in mount option: [syz0] One or more global auth toks could not properly register; rc = [-22] Error validating options; rc = [-22] FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 UID: 0 PID: 8124 Comm: syz.5.948 Tainted: G B syzkaller #0 PREEMPT Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 fail_dump lib/fault-inject.c:73 [inline] should_fail_ex+0x418/0x58c lib/fault-inject.c:174 should_failslab+0xc4/0x120 mm/failslab.c:46 slab_pre_alloc_hook mm/slub.c:4638 [inline] slab_alloc_node mm/slub.c:4974 [inline] kmem_cache_alloc_lru_noprof+0x98/0x5d8 mm/slub.c:5029 debugfs_alloc_inode+0x2c/0x3c fs/debugfs/inode.c:225 alloc_inode+0x68/0x198 fs/inode.c:338 new_inode+0x20/0x50 fs/inode.c:1170 debugfs_get_inode+0x20/0x7c fs/debugfs/inode.c:72 __debugfs_create_file+0xb8/0x36c fs/debugfs/inode.c:436 debugfs_create_file_full+0x58/0x70 fs/debugfs/inode.c:463 binder_open+0x718/0xa6c drivers/android/binder.c:6131 do_dentry_open+0x5c4/0xfbc fs/open.c:996 vfs_open+0x44/0x2dc fs/open.c:1101 do_open fs/namei.c:4866 [inline] path_openat+0x1084/0x18f0 fs/namei.c:5029 do_file_open+0x1c8/0x2e8 fs/namei.c:5058 do_sys_openat2+0x114/0x1e8 fs/open.c:1417 do_sys_open+0xb0/0xe0 fs/open.c:1423 __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __arm64_sys_openat+0xa8/0xc4 fs/open.c:1434 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 debugfs: out of free dentries, can not create file '8121' binder: 8121:8124 ioctl 4018620d 0 returned -22