program:
r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]})
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="040000", 0x3, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
close_range(r0, 0xffffffffffffffff, 0x200000000000000)
[ 93.402212][ T4648] Bluetooth: hci0: command tx timeout
[ 93.412874][ T55] cfg80211: failed to load regulatory.db
[ 93.495421][ T5322] ==================================================================
[ 93.495436][ T5322] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.495708][ T5322] Read of size 2 at addr ffff88804334f01b by task syz.0.0/5322
[ 93.495715][ T5322]
[ 93.495727][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.495738][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.495743][ T5322] Call Trace:
[ 93.495747][ T5322]
[ 93.495751][ T5322] dump_stack_lvl+0xe8/0x150
[ 93.495782][ T5322] print_address_description+0x55/0x1e0
[ 93.495794][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.495803][ T5322] print_report+0x58/0x70
[ 93.495811][ T5322] kasan_report+0x117/0x150
[ 93.495822][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.495832][ T5322] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.495842][ T5322] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 93.495854][ T5322] ecryptfs_get_tree+0x563/0x1370
[ 93.495871][ T5322] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 93.495890][ T5322] vfs_get_tree+0x92/0x2a0
[ 93.495907][ T5322] do_new_mount+0x319/0xdc0
[ 93.495920][ T5322] ? __pfx_do_new_mount+0x10/0x10
[ 93.495933][ T5322] ? ns_capable+0x89/0xe0
[ 93.495958][ T5322] ? path_mount+0x647/0x1050
[ 93.495973][ T5322] ? user_path_at+0xd4/0x160
[ 93.495989][ T5322] __se_sys_mount+0x31d/0x420
[ 93.496005][ T5322] ? __pfx___se_sys_mount+0x10/0x10
[ 93.496020][ T5322] ? __seccomp_permit_syscall+0xe7/0x2b0
[ 93.496044][ T5322] ? __x64_sys_mount+0x20/0xc0
[ 93.496059][ T5322] do_syscall_64+0x166/0x520
[ 93.496140][ T5322] ? trace_irq_disable+0x3b/0x140
[ 93.496152][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.496167][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 93.496183][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.496194][ T5322] RIP: 0033:0x7fc8fbf9e159
[ 93.496205][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.496217][ T5322] RSP: 002b:00007fc8fce9bfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 93.496231][ T5322] RAX: ffffffffffffffda RBX: 00007fc8fc225fa0 RCX: 00007fc8fbf9e159
[ 93.496240][ T5322] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 93.496246][ T5322] RBP: 00007fc8fc03503b R08: 0000200000000500 R09: 0000000000000000
[ 93.496253][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.496260][ T5322] R13: 00007fc8fc226038 R14: 00007fc8fc225fa0 R15: 00007ffc380a0418
[ 93.496272][ T5322]
[ 93.496277][ T5322]
[ 93.496281][ T5322] Allocated by task 5322:
[ 93.496286][ T5322] kasan_save_track+0x3e/0x80
[ 93.496301][ T5322] __kasan_kmalloc+0x93/0xb0
[ 93.496311][ T5322] __kmalloc_noprof+0x36b/0x720
[ 93.496327][ T5322] user_preparse+0x9e/0x160
[ 93.496378][ T5322] __key_create_or_update+0x3a9/0xa80
[ 93.496391][ T5322] key_create_or_update+0x42/0x60
[ 93.496402][ T5322] __se_sys_add_key+0x349/0x420
[ 93.496417][ T5322] do_syscall_64+0x166/0x520
[ 93.496428][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.496439][ T5322]
[ 93.496442][ T5322] The buggy address belongs to the object at ffff88804334f000
[ 93.496442][ T5322] which belongs to the cache kmalloc-32 of size 32
[ 93.496452][ T5322] The buggy address is located 0 bytes to the right of
[ 93.496452][ T5322] allocated 27-byte region [ffff88804334f000, ffff88804334f01b)
[ 93.496464][ T5322]
[ 93.496467][ T5322] The buggy address belongs to the physical page:
[ 93.496473][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88804334fa80 pfn:0x4334f
[ 93.496485][ T5322] flags: 0x4fff00000000200(workingset|node=1|zone=1|lastcpupid=0x7ff)
[ 93.496496][ T5322] page_type: f5(slab)
[ 93.496508][ T5322] raw: 04fff00000000200 ffff88801b041780 ffff8880304004c8 ffffea000109e190
[ 93.496526][ T5322] raw: ffff88804334fa80 000000000040003e 00000000f5000000 0000000000000000
[ 93.496532][ T5322] page dumped because: kasan: bad access detected
[ 93.496538][ T5322] page_owner tracks the page as allocated
[ 93.496543][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5035, tgid 5035 (rm), ts 62233307236
[ 93.496564][ T5322] post_alloc_hook+0x1f9/0x250
[ 93.496578][ T5322] get_page_from_freelist+0x2209/0x2280
[ 93.496596][ T5322] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 93.496611][ T5322] allocate_slab+0x7d/0x620
[ 93.496622][ T5322] refill_objects+0x2d5/0x350
[ 93.496636][ T5322] __pcs_replace_empty_main+0x2c8/0x6c0
[ 93.496646][ T5322] __kmalloc_cache_noprof+0x39b/0x600
[ 93.496661][ T5322] kmem_cache_free+0x156/0x650
[ 93.496676][ T5322] tear_down_vmas+0x31f/0x530
[ 93.496689][ T5322] exit_mmap+0x4ca/0x9f0
[ 93.496700][ T5322] __mmput+0x118/0x420
[ 93.496711][ T5322] setup_new_exec+0x30d/0x360
[ 93.496724][ T5322] load_elf_binary+0xbc0/0x28d0
[ 93.496737][ T5322] bprm_execve+0x930/0x1590
[ 93.496750][ T5322] do_execveat_common+0x4f4/0x670
[ 93.496764][ T5322] __x64_sys_execve+0x97/0xc0
[ 93.496778][ T5322] page last free pid 5035 tgid 5035 ts 62232382505 stack trace:
[ 93.496786][ T5322] __free_frozen_pages+0xc93/0xd90
[ 93.496800][ T5322] tlb_finish_mmu+0x13e/0x220
[ 93.496815][ T5322] exit_mmap+0x4b2/0x9f0
[ 93.496827][ T5322] __mmput+0x118/0x420
[ 93.496838][ T5322] setup_new_exec+0x30d/0x360
[ 93.496851][ T5322] load_elf_binary+0xbc0/0x28d0
[ 93.496863][ T5322] bprm_execve+0x930/0x1590
[ 93.496876][ T5322] do_execveat_common+0x4f4/0x670
[ 93.496889][ T5322] __x64_sys_execve+0x97/0xc0
[ 93.496904][ T5322] do_syscall_64+0x166/0x520
[ 93.496915][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.496926][ T5322]
[ 93.496929][ T5322] Memory state around the buggy address:
[ 93.496936][ T5322] ffff88804334ef00: 00 00 00 00 00 00 fc fc fc fc 00 00 00 00 00 00
[ 93.496943][ T5322] ffff88804334ef80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
[ 93.496949][ T5322] >ffff88804334f000: 00 00 00 03 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 93.496955][ T5322] ^
[ 93.496961][ T5322] ffff88804334f080: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 93.496968][ T5322] ffff88804334f100: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 93.496975][ T5322] ==================================================================
[ 93.496983][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 93.758982][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 93.762628][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 93.766930][ T5322] Call Trace:
[ 93.768505][ T5322]
[ 93.769910][ T5322] vpanic+0x56d/0xa60
[ 93.771770][ T5322] ? __pfx_vpanic+0x10/0x10
[ 93.773814][ T5322] panic+0xc5/0xd0
[ 93.775450][ T5322] ? __pfx_panic+0x10/0x10
[ 93.777324][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.780121][ T5322] ? rcu_is_watching+0x16/0xb0
[ 93.782120][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.784756][ T5322] check_panic_on_warn+0x89/0xb0
[ 93.786602][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.788798][ T5322] end_report+0x73/0x170
[ 93.790149][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.792172][ T5322] kasan_report+0x128/0x150
[ 93.793677][ T5322] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.796642][ T5322] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 93.799152][ T5322] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 93.801935][ T5322] ecryptfs_get_tree+0x563/0x1370
[ 93.804245][ T5322] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 93.806633][ T5322] vfs_get_tree+0x92/0x2a0
[ 93.808638][ T5322] do_new_mount+0x319/0xdc0
[ 93.810627][ T5322] ? __pfx_do_new_mount+0x10/0x10
[ 93.812855][ T5322] ? ns_capable+0x89/0xe0
[ 93.814669][ T5322] ? path_mount+0x647/0x1050
[ 93.816675][ T5322] ? user_path_at+0xd4/0x160
[ 93.818474][ T5322] __se_sys_mount+0x31d/0x420
[ 93.820360][ T5322] ? __pfx___se_sys_mount+0x10/0x10
[ 93.822631][ T5322] ? __seccomp_permit_syscall+0xe7/0x2b0
[ 93.824966][ T5322] ? __x64_sys_mount+0x20/0xc0
[ 93.827016][ T5322] do_syscall_64+0x166/0x520
[ 93.828927][ T5322] ? trace_irq_disable+0x3b/0x140
[ 93.831023][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.833592][ T5322] ? clear_bhb_loop+0x70/0xc0
[ 93.835736][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 93.838209][ T5322] RIP: 0033:0x7fc8fbf9e159
[ 93.840078][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 93.847971][ T5322] RSP: 002b:00007fc8fce9bfe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 93.851351][ T5322] RAX: ffffffffffffffda RBX: 00007fc8fc225fa0 RCX: 00007fc8fbf9e159
[ 93.854440][ T5322] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 93.857537][ T5322] RBP: 00007fc8fc03503b R08: 0000200000000500 R09: 0000000000000000
[ 93.860550][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 93.863184][ T5322] R13: 00007fc8fc226038 R14: 00007fc8fc225fa0 R15: 00007ffc380a0418
[ 93.865930][ T5322]
[ 93.867694][ T5322] Kernel Offset: disabled
[ 93.869404][ T5322] Rebooting in 86400 seconds..