program:
syz_mount_image$ext4(&(0x7f0000000180)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x0, &(0x7f00000003c0)={[{@noauto_da_alloc}, {@quota}, {@nobh}, {@init_itable}, {@jqfmt_vfsold}]}, 0xff, 0x4fe, &(0x7f0000000ac0)="$eJzs3cFvG1kZAPDPTpw4aXaTXfYASLCFXSioqpO4u9FqD7CcEEIrIfYIUhsSN4pix1HslCb0kJ65IlGJC3DkD+DcE3cuCP6AckAqEIEaJA5GMx6nTmo3EWnsKP79pNHMmzeZ7724817zxfELYGRdj4j9iJiIiLsRMZudz2VbfNLekuueHzxcOTx4uJKLVuuzf+TS+uRcdH1N4lp2z2JE/PC7ET/JvRy3sbu3sVytVraz8nyztjXf2N27tV5bXqusVTbL5aXFpYWPbn9YPvqaZxPn6+u7tc4NvvT0j/vf/FnSrJnsTHc/Xqd21wtHcRLjEfH9iwg2BGNZf8750jAk+Yh4OyK+mj7/szGWvpoAwFXWas1Ga7a7DABcdfk0B5bLl7JcwEzk86VSO4f3Tkznq/VG8+a9+s7majtXNheF/L31amUhyxXORSGXlBfT4xfl8ony7Yh4KyJ+MTmVlksr9erqMP/jAwAj7NqJ+f/fk+35HwC44orDbgAAMHDmfwAYPeZ/ABg95n8AGD3t+X9q2M0AAAbHxA8AI0j+HwBGyg8+/TTZWofZ51+v3t/d2ajfv7VaaWyUajsrpZX69lZprV5fSz+zp3ba/ar1+tbiB7HzYO5bW43mfGN3706tvrPZvJN+rvedSiG9an8APQMA+nnr3Sd/ySUz8sdT6RZdazkUhtoy4KLlh90AYGjGjpV+PbR2AINntS8YXef4GV96AK6IHkv0HlPs9T7hVqvVurgmARfsxhfk/2FUdeX/vQsYRszYsBsADI38P4yuVit31jX/46wXAgCXmxw/0Of3/29n+99lvxz48erJKx5fZKsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADgcuus/1vK1gKfiXy+VIp4IyLmopC7t16tLETEmxHx58nCZFJeHHKbAYDzyv8tl63/dWP2/ZljVV++dnQ4ERE//dVnv3yw3Gxu/yliIvfPyc755uPsfHnwrQcATteZp9N91w/yzw8ernS2Qbbn2XciotiOf3gwEYdH8cdjPN0XoxAR0//KZeW2XFfu4jz2H0XE53v1PxczaQ6kvfLpyfhJ7DcGGj9/LH4+rWvvk+/F515DW2DUPEnGn096PX/5uJ7uez//xXSEOr9s/EtutXKYjoEv4nfGv7E+49/1s8b44A/fax9NvVz3KOKL4xGd2Idd408nfq5P/PfP2slXLDLf+k3EjegdvzvWfLO2Nd/Y3bu1Xlteq6xVNsvlpcWlhY9uf1ieT3PU8/1ng79/fPPNfnVJ/6f7xC+e0v+vnbH7v/3v3R995RXxv/Fer/j5eOcV8ZNv6dfPGH95+vfFfnVJ/NU+/T/t9b95xvhP/7r30rLhAMDwNHb3Npar1cq2AweX/yD5J3sJmtHz4NuDijURvat+/l77mT5R1Wr9X7H6jRivI+sGXAZHD31E/GfYjQEAAAAAAAAAAAAAAHoaxF8sDbuPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAXF3/CwAA///w1c+A")
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="040000", 0x3, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, 0x0)
[ 122.872429][ T4644] Bluetooth: hci0: command tx timeout
[ 122.883033][ T5315] loop0: detected capacity change from 0 to 512
[ 122.966517][ T5315] EXT4-fs: Ignoring removed nobh option
[ 122.982866][ T5315] EXT4-fs: Quota format mount options ignored when QUOTA feature is enabled
[ 123.046734][ T5315] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback.
[ 123.046849][ T5315] ext4 filesystem being mounted at /0/bus supports timestamps until 2038-01-19 (0x7fffffff)
[ 123.073004][ T5315] ==================================================================
[ 123.073017][ T5315] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.073107][ T5315] Read of size 2 at addr ffff88804429a95b by task syz.0.0/5315
[ 123.073115][ T5315]
[ 123.073122][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 123.073132][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.073137][ T5315] Call Trace:
[ 123.073141][ T5315]
[ 123.073144][ T5315] dump_stack_lvl+0xe8/0x150
[ 123.073156][ T5315] print_address_description+0x55/0x1e0
[ 123.073167][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.073176][ T5315] print_report+0x58/0x70
[ 123.073185][ T5315] kasan_report+0x117/0x150
[ 123.073193][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.073203][ T5315] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.073213][ T5315] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 123.073224][ T5315] ecryptfs_get_tree+0x563/0x1370
[ 123.073236][ T5315] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 123.073249][ T5315] vfs_get_tree+0x92/0x2a0
[ 123.073260][ T5315] do_new_mount+0x319/0xdc0
[ 123.073270][ T5315] ? __pfx_do_new_mount+0x10/0x10
[ 123.073278][ T5315] ? ns_capable+0x89/0xe0
[ 123.073288][ T5315] ? path_mount+0x647/0x1050
[ 123.073296][ T5315] ? user_path_at+0xd4/0x160
[ 123.073306][ T5315] __se_sys_mount+0x31d/0x420
[ 123.073315][ T5315] ? __pfx___se_sys_mount+0x10/0x10
[ 123.073324][ T5315] ? __x64_sys_mount+0x20/0xc0
[ 123.073336][ T5315] do_syscall_64+0x166/0x520
[ 123.073381][ T5315] ? trace_irq_disable+0x3b/0x140
[ 123.073396][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.073408][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 123.073447][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.073461][ T5315] RIP: 0033:0x7f444359e159
[ 123.073473][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 123.073484][ T5315] RSP: 002b:00007f4444518fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 123.073495][ T5315] RAX: ffffffffffffffda RBX: 00007f4443825fa0 RCX: 00007f444359e159
[ 123.073501][ T5315] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 123.073506][ T5315] RBP: 00007f444363506b R08: 0000200000000500 R09: 0000000000000000
[ 123.073512][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 123.073517][ T5315] R13: 00007f4443826038 R14: 00007f4443825fa0 R15: 00007fff563afdd8
[ 123.073541][ T5315]
[ 123.073545][ T5315]
[ 123.073548][ T5315] Allocated by task 5315:
[ 123.073554][ T5315] kasan_save_track+0x3e/0x80
[ 123.073571][ T5315] __kasan_kmalloc+0x93/0xb0
[ 123.073582][ T5315] __kmalloc_noprof+0x36b/0x720
[ 123.073596][ T5315] user_preparse+0x9e/0x160
[ 123.073608][ T5315] __key_create_or_update+0x3a9/0xa80
[ 123.073629][ T5315] key_create_or_update+0x42/0x60
[ 123.073641][ T5315] __se_sys_add_key+0x349/0x420
[ 123.073656][ T5315] do_syscall_64+0x166/0x520
[ 123.073666][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.073677][ T5315]
[ 123.073680][ T5315] The buggy address belongs to the object at ffff88804429a940
[ 123.073680][ T5315] which belongs to the cache kmalloc-32 of size 32
[ 123.073688][ T5315] The buggy address is located 0 bytes to the right of
[ 123.073688][ T5315] allocated 27-byte region [ffff88804429a940, ffff88804429a95b)
[ 123.073699][ T5315]
[ 123.073702][ T5315] The buggy address belongs to the physical page:
[ 123.073709][ T5315] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4429a
[ 123.073719][ T5315] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 123.073729][ T5315] page_type: f5(slab)
[ 123.073741][ T5315] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 123.073752][ T5315] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 123.073759][ T5315] page dumped because: kasan: bad access detected
[ 123.073765][ T5315] page_owner tracks the page as allocated
[ 123.073770][ T5315] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5107, tgid 5107 (dhcpcd-run-hook), ts 96228981552
[ 123.073787][ T5315] post_alloc_hook+0x1f9/0x250
[ 123.073802][ T5315] get_page_from_freelist+0x2209/0x2280
[ 123.073817][ T5315] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 123.073832][ T5315] allocate_slab+0x7d/0x620
[ 123.073843][ T5315] refill_objects+0x2d5/0x350
[ 123.073855][ T5315] __pcs_replace_empty_main+0x2c8/0x6c0
[ 123.073866][ T5315] __kmalloc_cache_noprof+0x39b/0x600
[ 123.073881][ T5315] kmem_cache_free+0x156/0x650
[ 123.073895][ T5315] tear_down_vmas+0x31f/0x530
[ 123.073908][ T5315] exit_mmap+0x4ca/0x9f0
[ 123.073919][ T5315] __mmput+0x118/0x420
[ 123.073932][ T5315] exit_mm+0x221/0x2d0
[ 123.073942][ T5315] do_exit+0x6cd/0x2360
[ 123.073951][ T5315] do_group_exit+0x22d/0x2f0
[ 123.073962][ T5315] __x64_sys_exit_group+0x3f/0x40
[ 123.073973][ T5315] x64_sys_call+0x18c6/0x18d0
[ 123.073982][ T5315] page last free pid 5107 tgid 5107 ts 96228903500 stack trace:
[ 123.073990][ T5315] __free_frozen_pages+0xc93/0xd90
[ 123.074004][ T5315] tlb_finish_mmu+0x13e/0x220
[ 123.074018][ T5315] exit_mmap+0x4b2/0x9f0
[ 123.074029][ T5315] __mmput+0x118/0x420
[ 123.074040][ T5315] exit_mm+0x221/0x2d0
[ 123.074049][ T5315] do_exit+0x6cd/0x2360
[ 123.074058][ T5315] do_group_exit+0x22d/0x2f0
[ 123.074067][ T5315] __x64_sys_exit_group+0x3f/0x40
[ 123.074076][ T5315] x64_sys_call+0x18c6/0x18d0
[ 123.074085][ T5315] do_syscall_64+0x166/0x520
[ 123.074095][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.074106][ T5315]
[ 123.074109][ T5315] Memory state around the buggy address:
[ 123.074115][ T5315] ffff88804429a800: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 123.074123][ T5315] ffff88804429a880: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 123.074131][ T5315] >ffff88804429a900: 00 00 00 00 fc fc fc fc 00 00 00 03 fc fc fc fc
[ 123.074138][ T5315] ^
[ 123.074145][ T5315] ffff88804429a980: 00 00 00 00 fc fc fc fc 00 00 00 00 fc fc fc fc
[ 123.074152][ T5315] ffff88804429aa00: 00 00 00 00 fc fc fc fc fa fb fb fb fc fc fc fc
[ 123.074156][ T5315] ==================================================================
[ 123.398325][ T5315] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 123.401744][ T5315] CPU: 0 UID: 0 PID: 5315 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 123.405678][ T5315] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 123.409987][ T5315] Call Trace:
[ 123.411571][ T5315]
[ 123.413018][ T5315] vpanic+0x56d/0xa60
[ 123.414992][ T5315] ? __pfx_vpanic+0x10/0x10
[ 123.417070][ T5315] ? __pfx___schedule+0x10/0x10
[ 123.419286][ T5315] panic+0xc5/0xd0
[ 123.421040][ T5315] ? __pfx_panic+0x10/0x10
[ 123.423011][ T5315] ? preempt_schedule_thunk+0x16/0x40
[ 123.425396][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.428283][ T5315] check_panic_on_warn+0x89/0xb0
[ 123.430511][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.433230][ T5315] end_report+0x73/0x170
[ 123.435203][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.438130][ T5315] kasan_report+0x128/0x150
[ 123.440234][ T5315] ? ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.443051][ T5315] ecryptfs_verify_auth_tok_from_key+0x38f/0x3a0
[ 123.445816][ T5315] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 123.448542][ T5315] ecryptfs_get_tree+0x563/0x1370
[ 123.450729][ T5315] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 123.453044][ T5315] vfs_get_tree+0x92/0x2a0
[ 123.455017][ T5315] do_new_mount+0x319/0xdc0
[ 123.457097][ T5315] ? __pfx_do_new_mount+0x10/0x10
[ 123.459386][ T5315] ? ns_capable+0x89/0xe0
[ 123.461323][ T5315] ? path_mount+0x647/0x1050
[ 123.463465][ T5315] ? user_path_at+0xd4/0x160
[ 123.465586][ T5315] __se_sys_mount+0x31d/0x420
[ 123.467721][ T5315] ? __pfx___se_sys_mount+0x10/0x10
[ 123.470111][ T5315] ? __x64_sys_mount+0x20/0xc0
[ 123.472294][ T5315] do_syscall_64+0x166/0x520
[ 123.474421][ T5315] ? trace_irq_disable+0x3b/0x140
[ 123.476699][ T5315] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.479362][ T5315] ? clear_bhb_loop+0x70/0xc0
[ 123.481493][ T5315] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 123.484106][ T5315] RIP: 0033:0x7f444359e159
[ 123.486157][ T5315] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 123.494717][ T5315] RSP: 002b:00007f4444518fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 123.498336][ T5315] RAX: ffffffffffffffda RBX: 00007f4443825fa0 RCX: 00007f444359e159
[ 123.501690][ T5315] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 123.504998][ T5315] RBP: 00007f444363506b R08: 0000200000000500 R09: 0000000000000000
[ 123.508428][ T5315] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 123.511907][ T5315] R13: 00007f4443826038 R14: 00007f4443825fa0 R15: 00007fff563afdd8
[ 123.515472][ T5315]
[ 123.517258][ T5315] Kernel Offset: disabled
[ 123.519293][ T5315] Rebooting in 86400 seconds..