program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="040000", 0x3, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
lsetxattr$trusted_overlay_origin(&(0x7f0000000000)='./mnt\x00', &(0x7f00000000c0), &(0x7f0000000140), 0x2, 0x0)
[ 94.908716][ T4644] Bluetooth: hci0: command tx timeout
[ 95.044904][ T5317] ==================================================================
[ 95.044919][ T5317] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.045021][ T5317] Read of size 2 at addr ffff888012dbbd1b by task syz.0.0/5317
[ 95.045031][ T5317]
[ 95.045052][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.045066][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.045081][ T5317] Call Trace:
[ 95.045088][ T5317]
[ 95.045093][ T5317] dump_stack_lvl+0xe8/0x150
[ 95.045127][ T5317] print_address_description+0x55/0x1e0
[ 95.045145][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.045160][ T5317] print_report+0x58/0x70
[ 95.045172][ T5317] kasan_report+0x117/0x150
[ 95.045195][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.045209][ T5317] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.045226][ T5317] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 95.045242][ T5317] ecryptfs_get_tree+0x563/0x1370
[ 95.045263][ T5317] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 95.045281][ T5317] vfs_get_tree+0x92/0x2a0
[ 95.045308][ T5317] do_new_mount+0x319/0xdc0
[ 95.045338][ T5317] ? __pfx_do_new_mount+0x10/0x10
[ 95.045350][ T5317] ? ns_capable+0x89/0xe0
[ 95.045377][ T5317] ? path_mount+0x647/0x1050
[ 95.045391][ T5317] ? user_path_at+0xd4/0x160
[ 95.045408][ T5317] __se_sys_mount+0x31d/0x420
[ 95.045422][ T5317] ? __pfx___se_sys_mount+0x10/0x10
[ 95.045439][ T5317] ? __x64_sys_mount+0x20/0xc0
[ 95.045465][ T5317] do_syscall_64+0x166/0x520
[ 95.045517][ T5317] ? trace_irq_disable+0x3b/0x140
[ 95.045538][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.045551][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 95.045565][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.045577][ T5317] RIP: 0033:0x7f9defb9e159
[ 95.045588][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.045598][ T5317] RSP: 002b:00007f9df0a3afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.045630][ T5317] RAX: ffffffffffffffda RBX: 00007f9defe25fa0 RCX: 00007f9defb9e159
[ 95.045639][ T5317] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 95.045647][ T5317] RBP: 00007f9defc3506b R08: 0000200000000500 R09: 0000000000000000
[ 95.045656][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.045663][ T5317] R13: 00007f9defe26038 R14: 00007f9defe25fa0 R15: 00007ffd281a9808
[ 95.045675][ T5317]
[ 95.045680][ T5317]
[ 95.045683][ T5317] Allocated by task 5317:
[ 95.045689][ T5317] kasan_save_track+0x3e/0x80
[ 95.045708][ T5317] __kasan_kmalloc+0x93/0xb0
[ 95.045718][ T5317] __kmalloc_noprof+0x36b/0x720
[ 95.045751][ T5317] user_preparse+0x9e/0x160
[ 95.045763][ T5317] __key_create_or_update+0x3a9/0xa80
[ 95.045773][ T5317] key_create_or_update+0x42/0x60
[ 95.045784][ T5317] __se_sys_add_key+0x349/0x420
[ 95.045798][ T5317] do_syscall_64+0x166/0x520
[ 95.045808][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.045818][ T5317]
[ 95.045821][ T5317] The buggy address belongs to the object at ffff888012dbbd00
[ 95.045821][ T5317] which belongs to the cache kmalloc-32 of size 32
[ 95.045831][ T5317] The buggy address is located 0 bytes to the right of
[ 95.045831][ T5317] allocated 27-byte region [ffff888012dbbd00, ffff888012dbbd1b)
[ 95.045843][ T5317]
[ 95.045846][ T5317] The buggy address belongs to the physical page:
[ 95.045852][ T5317] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12dbb
[ 95.045863][ T5317] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 95.045872][ T5317] page_type: f5(slab)
[ 95.045882][ T5317] raw: 00fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 95.045892][ T5317] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 95.045898][ T5317] page dumped because: kasan: bad access detected
[ 95.045904][ T5317] page_owner tracks the page as allocated
[ 95.045908][ T5317] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4665, tgid 4665 (mkdir), ts 29606264300
[ 95.045927][ T5317] post_alloc_hook+0x1f9/0x250
[ 95.045943][ T5317] get_page_from_freelist+0x2209/0x2280
[ 95.045957][ T5317] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 95.045971][ T5317] allocate_slab+0x7d/0x620
[ 95.045983][ T5317] refill_objects+0x2d5/0x350
[ 95.045993][ T5317] __pcs_replace_empty_main+0x2c8/0x6c0
[ 95.046003][ T5317] __kmalloc_cache_noprof+0x39b/0x600
[ 95.046016][ T5317] kmem_cache_free+0x156/0x650
[ 95.046028][ T5317] tear_down_vmas+0x31f/0x530
[ 95.046053][ T5317] exit_mmap+0x4ca/0x9f0
[ 95.046064][ T5317] __mmput+0x118/0x420
[ 95.046077][ T5317] exit_mm+0x221/0x2d0
[ 95.046086][ T5317] do_exit+0x6cd/0x2360
[ 95.046095][ T5317] do_group_exit+0x22d/0x2f0
[ 95.046104][ T5317] __x64_sys_exit_group+0x3f/0x40
[ 95.046113][ T5317] x64_sys_call+0x18c6/0x18d0
[ 95.046137][ T5317] page last free pid 4665 tgid 4665 ts 29605538930 stack trace:
[ 95.046146][ T5317] __free_frozen_pages+0xc93/0xd90
[ 95.046159][ T5317] tlb_finish_mmu+0x13e/0x220
[ 95.046175][ T5317] exit_mmap+0x4b2/0x9f0
[ 95.046188][ T5317] __mmput+0x118/0x420
[ 95.046200][ T5317] exit_mm+0x221/0x2d0
[ 95.046210][ T5317] do_exit+0x6cd/0x2360
[ 95.046218][ T5317] do_group_exit+0x22d/0x2f0
[ 95.046228][ T5317] __x64_sys_exit_group+0x3f/0x40
[ 95.046237][ T5317] x64_sys_call+0x18c6/0x18d0
[ 95.046245][ T5317] do_syscall_64+0x166/0x520
[ 95.046256][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.046266][ T5317]
[ 95.046269][ T5317] Memory state around the buggy address:
[ 95.046275][ T5317] ffff888012dbbc00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 95.046281][ T5317] ffff888012dbbc80: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 95.046288][ T5317] >ffff888012dbbd00: 00 00 00 03 fc fc fc fc 00 00 01 fc fc fc fc fc
[ 95.046294][ T5317] ^
[ 95.046327][ T5317] ffff888012dbbd80: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 95.046334][ T5317] ffff888012dbbe00: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 95.046339][ T5317] ==================================================================
[ 95.046348][ T5317] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 95.307253][ T5317] CPU: 0 UID: 0 PID: 5317 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 95.310925][ T5317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 95.315242][ T5317] Call Trace:
[ 95.316570][ T5317]
[ 95.317773][ T5317] vpanic+0x56d/0xa60
[ 95.319591][ T5317] ? __pfx_vpanic+0x10/0x10
[ 95.321551][ T5317] panic+0xc5/0xd0
[ 95.323129][ T5317] ? __pfx_panic+0x10/0x10
[ 95.325048][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.327949][ T5317] ? rcu_is_watching+0x16/0xb0
[ 95.330400][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.333698][ T5317] check_panic_on_warn+0x89/0xb0
[ 95.335920][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.339016][ T5317] end_report+0x73/0x170
[ 95.340956][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.344002][ T5317] kasan_report+0x128/0x150
[ 95.346034][ T5317] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.348695][ T5317] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 95.351426][ T5317] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 95.354044][ T5317] ecryptfs_get_tree+0x563/0x1370
[ 95.356279][ T5317] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 95.358888][ T5317] vfs_get_tree+0x92/0x2a0
[ 95.360986][ T5317] do_new_mount+0x319/0xdc0
[ 95.363232][ T5317] ? __pfx_do_new_mount+0x10/0x10
[ 95.365742][ T5317] ? ns_capable+0x89/0xe0
[ 95.367842][ T5317] ? path_mount+0x647/0x1050
[ 95.370019][ T5317] ? user_path_at+0xd4/0x160
[ 95.372203][ T5317] __se_sys_mount+0x31d/0x420
[ 95.374224][ T5317] ? __pfx___se_sys_mount+0x10/0x10
[ 95.376641][ T5317] ? __x64_sys_mount+0x20/0xc0
[ 95.378841][ T5317] do_syscall_64+0x166/0x520
[ 95.380882][ T5317] ? trace_irq_disable+0x3b/0x140
[ 95.383046][ T5317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.385648][ T5317] ? clear_bhb_loop+0x70/0xc0
[ 95.387682][ T5317] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 95.390151][ T5317] RIP: 0033:0x7f9defb9e159
[ 95.392082][ T5317] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 95.400316][ T5317] RSP: 002b:00007f9df0a3afe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 95.404019][ T5317] RAX: ffffffffffffffda RBX: 00007f9defe25fa0 RCX: 00007f9defb9e159
[ 95.407658][ T5317] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 95.411463][ T5317] RBP: 00007f9defc3506b R08: 0000200000000500 R09: 0000000000000000
[ 95.415166][ T5317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 95.418783][ T5317] R13: 00007f9defe26038 R14: 00007f9defe25fa0 R15: 00007ffd281a9808
[ 95.422193][ T5317]
[ 95.424007][ T5317] Kernel Offset: disabled
[ 95.426058][ T5317] Rebooting in 86400 seconds..