program:
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400"/370, 0x172, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
faccessat(r0, &(0x7f0000000000)='./mnt\x00', 0x0)
[ 94.313942][ T47] Bluetooth: hci0: command tx timeout
[ 94.508701][ T5324] ==================================================================
[ 94.508715][ T5324] BUG: KASAN: slab-out-of-bounds in ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.508806][ T5324] Read of size 4 at addr ffff88803f835e98 by task syz.0.0/5324
[ 94.508819][ T5324]
[ 94.508827][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.508842][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.508850][ T5324] Call Trace:
[ 94.508855][ T5324]
[ 94.508861][ T5324] dump_stack_lvl+0xe8/0x150
[ 94.508881][ T5324] print_address_description+0x55/0x1e0
[ 94.508900][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.508914][ T5324] print_report+0x58/0x70
[ 94.508930][ T5324] kasan_report+0x117/0x150
[ 94.508945][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.508962][ T5324] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.508986][ T5324] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 94.509005][ T5324] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 94.509021][ T5324] ? d_alloc_parallel+0x1535/0x16b0
[ 94.509043][ T5324] ecryptfs_lookup+0x20e/0x780
[ 94.509060][ T5324] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 94.509079][ T5324] ? lock_acquire+0x232/0x350
[ 94.509094][ T5324] __lookup_slow+0x1fb/0x2f0
[ 94.509108][ T5324] lookup_slow+0x53/0x70
[ 94.509129][ T5324] path_lookupat+0x3f5/0x8c0
[ 94.509153][ T5324] filename_lookup+0x265/0x5d0
[ 94.509170][ T5324] ? __pfx_filename_lookup+0x10/0x10
[ 94.509192][ T5324] ? strncpy_from_user+0x150/0x2c0
[ 94.509211][ T5324] ? do_getname+0x151/0x250
[ 94.509225][ T5324] do_faccessat+0x632/0xdc0
[ 94.509241][ T5324] ? __pfx_do_faccessat+0x10/0x10
[ 94.509259][ T5324] __x64_sys_faccessat+0x7c/0x90
[ 94.509278][ T5324] do_syscall_64+0x166/0x520
[ 94.509334][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.509347][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.509361][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 94.509376][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.509389][ T5324] RIP: 0033:0x7f701019e159
[ 94.509402][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.509414][ T5324] RSP: 002b:00007f7011016fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010d
[ 94.509429][ T5324] RAX: ffffffffffffffda RBX: 00007f7010425fa0 RCX: 00007f701019e159
[ 94.509439][ T5324] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
[ 94.509447][ T5324] RBP: 00007f701023506b R08: 0000000000000000 R09: 0000000000000000
[ 94.509455][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.509463][ T5324] R13: 00007f7010426038 R14: 00007f7010425fa0 R15: 00007ffd188576f8
[ 94.509478][ T5324]
[ 94.509483][ T5324]
[ 94.509487][ T5324] Allocated by task 5324:
[ 94.509493][ T5324] kasan_save_track+0x3e/0x80
[ 94.509511][ T5324] __kasan_kmalloc+0x93/0xb0
[ 94.509522][ T5324] __kmalloc_noprof+0x36b/0x720
[ 94.509538][ T5324] user_preparse+0x9e/0x160
[ 94.509551][ T5324] __key_create_or_update+0x3a9/0xa80
[ 94.509564][ T5324] key_create_or_update+0x42/0x60
[ 94.509576][ T5324] __se_sys_add_key+0x349/0x420
[ 94.509591][ T5324] do_syscall_64+0x166/0x520
[ 94.509603][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.509614][ T5324]
[ 94.509617][ T5324] The buggy address belongs to the object at ffff88803f835c00
[ 94.509617][ T5324] which belongs to the cache kmalloc-512 of size 512
[ 94.509626][ T5324] The buggy address is located 270 bytes to the right of
[ 94.509626][ T5324] allocated 394-byte region [ffff88803f835c00, ffff88803f835d8a)
[ 94.509638][ T5324]
[ 94.509642][ T5324] The buggy address belongs to the physical page:
[ 94.509649][ T5324] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3f834
[ 94.509660][ T5324] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 94.509670][ T5324] flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff)
[ 94.509682][ T5324] page_type: f5(slab)
[ 94.509694][ T5324] raw: 04fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 94.509704][ T5324] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 94.509716][ T5324] head: 04fff00000000040 ffff88801b041c80 dead000000000100 dead000000000122
[ 94.509726][ T5324] head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000
[ 94.509738][ T5324] head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 94.509749][ T5324] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
[ 94.509755][ T5324] page dumped because: kasan: bad access detected
[ 94.509761][ T5324] page_owner tracks the page as allocated
[ 94.509766][ T5324] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5284, tgid 5284 (syz-executor), ts 92301737136
[ 94.509785][ T5324] post_alloc_hook+0x1f9/0x250
[ 94.509800][ T5324] get_page_from_freelist+0x2209/0x2280
[ 94.509819][ T5324] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 94.509837][ T5324] allocate_slab+0x7d/0x620
[ 94.509850][ T5324] refill_objects+0x2d5/0x350
[ 94.509862][ T5324] __pcs_replace_empty_main+0x2c8/0x6c0
[ 94.509874][ T5324] __kmalloc_cache_noprof+0x39b/0x600
[ 94.509891][ T5324] __ipv6_dev_mc_inc+0x447/0xaf0
[ 94.509909][ T5324] ipv6_add_dev+0xe45/0x13a0
[ 94.509919][ T5324] addrconf_notify+0x771/0x1050
[ 94.509932][ T5324] notifier_call_chain+0x1a5/0x3d0
[ 94.509949][ T5324] register_netdevice+0x18a4/0x1eb0
[ 94.509964][ T5324] cfg80211_register_netdevice+0x138/0x2d0
[ 94.509976][ T5324] ieee80211_if_add+0x108d/0x1600
[ 94.509992][ T5324] ieee80211_register_hw+0x3ef7/0x4b00
[ 94.510006][ T5324] mac80211_hwsim_new_radio+0x3258/0x56b0
[ 94.510018][ T5324] page last free pid 5284 tgid 5284 ts 91943443166 stack trace:
[ 94.510027][ T5324] __free_frozen_pages+0xc93/0xd90
[ 94.510041][ T5324] __slab_free+0x274/0x2c0
[ 94.510057][ T5324] qlist_free_all+0x99/0x100
[ 94.510073][ T5324] kasan_quarantine_reduce+0x148/0x160
[ 94.510089][ T5324] __kasan_slab_alloc+0x22/0x80
[ 94.510099][ T5324] __kmalloc_cache_noprof+0x29f/0x600
[ 94.510126][ T5324] inet_rtm_newaddr+0x613/0x19f0
[ 94.510142][ T5324] rtnetlink_rcv_msg+0x802/0xc00
[ 94.510155][ T5324] netlink_rcv_skb+0x226/0x4a0
[ 94.510171][ T5324] netlink_unicast+0x7bd/0x940
[ 94.510185][ T5324] netlink_sendmsg+0x813/0xb40
[ 94.510202][ T5324] sock_sendmsg_nosec+0x13a/0x180
[ 94.510219][ T5324] __sys_sendto+0x408/0x5a0
[ 94.510231][ T5324] __x64_sys_sendto+0xde/0x100
[ 94.510243][ T5324] do_syscall_64+0x166/0x520
[ 94.510256][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.510269][ T5324]
[ 94.510272][ T5324] Memory state around the buggy address:
[ 94.510279][ T5324] ffff88803f835d80: 00 02 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.510288][ T5324] ffff88803f835e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.510296][ T5324] >ffff88803f835e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.510303][ T5324] ^
[ 94.510310][ T5324] ffff88803f835f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.510318][ T5324] ffff88803f835f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 94.510324][ T5324] ==================================================================
[ 94.510333][ T5324] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 94.824335][ T5324] CPU: 0 UID: 0 PID: 5324 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 94.827958][ T5324] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 94.831887][ T5324] Call Trace:
[ 94.833250][ T5324]
[ 94.834549][ T5324] vpanic+0x56d/0xa60
[ 94.836404][ T5324] ? __pfx_vpanic+0x10/0x10
[ 94.838333][ T5324] panic+0xc5/0xd0
[ 94.840032][ T5324] ? __pfx_panic+0x10/0x10
[ 94.842019][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.844673][ T5324] ? rcu_is_watching+0x16/0xb0
[ 94.846568][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.849160][ T5324] check_panic_on_warn+0x89/0xb0
[ 94.851124][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.853372][ T5324] end_report+0x73/0x170
[ 94.855046][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.857683][ T5324] kasan_report+0x128/0x150
[ 94.859659][ T5324] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.862279][ T5324] ecryptfs_write_tag_70_packet+0x1241/0x12e0
[ 94.864927][ T5324] ecryptfs_encrypt_and_encode_filename+0x576/0x1580
[ 94.867819][ T5324] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10
[ 94.870943][ T5324] ? d_alloc_parallel+0x1535/0x16b0
[ 94.873388][ T5324] ecryptfs_lookup+0x20e/0x780
[ 94.875719][ T5324] ? __pfx_ecryptfs_lookup+0x10/0x10
[ 94.878124][ T5324] ? lock_acquire+0x232/0x350
[ 94.880138][ T5324] __lookup_slow+0x1fb/0x2f0
[ 94.882126][ T5324] lookup_slow+0x53/0x70
[ 94.884082][ T5324] path_lookupat+0x3f5/0x8c0
[ 94.886200][ T5324] filename_lookup+0x265/0x5d0
[ 94.888402][ T5324] ? __pfx_filename_lookup+0x10/0x10
[ 94.890797][ T5324] ? strncpy_from_user+0x150/0x2c0
[ 94.893134][ T5324] ? do_getname+0x151/0x250
[ 94.895251][ T5324] do_faccessat+0x632/0xdc0
[ 94.897303][ T5324] ? __pfx_do_faccessat+0x10/0x10
[ 94.899562][ T5324] __x64_sys_faccessat+0x7c/0x90
[ 94.901737][ T5324] do_syscall_64+0x166/0x520
[ 94.903871][ T5324] ? trace_irq_disable+0x3b/0x140
[ 94.906225][ T5324] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.908839][ T5324] ? clear_bhb_loop+0x70/0xc0
[ 94.910909][ T5324] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 94.913276][ T5324] RIP: 0033:0x7f701019e159
[ 94.915001][ T5324] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 94.923346][ T5324] RSP: 002b:00007f7011016fe8 EFLAGS: 00000246 ORIG_RAX: 000000000000010d
[ 94.927094][ T5324] RAX: ffffffffffffffda RBX: 00007f7010425fa0 RCX: 00007f701019e159
[ 94.930625][ T5324] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
[ 94.934123][ T5324] RBP: 00007f701023506b R08: 0000000000000000 R09: 0000000000000000
[ 94.937677][ T5324] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 94.941238][ T5324] R13: 00007f7010426038 R14: 00007f7010425fa0 R15: 00007ffd188576f8
[ 94.944823][ T5324]
[ 94.946621][ T5324] Kernel Offset: disabled
[ 94.948588][ T5324] Rebooting in 86400 seconds..