program:
syz_mount_image$msdos(&(0x7f0000000000), &(0x7f00000004c0)='./file0\x00', 0x0, &(0x7f0000000700)=ANY=[], 0xfd, 0x1d9, &(0x7f0000000140)="$eJzs3cFqE1EUBuCT2DSpq+4EURhw46qoT1CRCmJAULLQlUJ104hgN9FN+xg+nSsfQLrKRq7Emcm0o9G2MDO1/b5NzuS/Nzl3ApNscuf1rfd7ux/233278SVGo170t2M75r3YjH6UDgMAuEzmKZVl6rYTAKAti+//7ym3YsiPllsCABr24uWrpw/H453nWTaKODqcTWaT/DHPHz8Z79zLftmsZh3NZpNry/x+Vv/tsMgHcb3IH+Tzs5P5ety9k+eL7NGzcS0fxm6zSwcAAAAAAAAAAAAAAAAAAAAAgM7cjqz0x/19trbq+UaR50fH9geq7d+zFjfXisNjewwftLEoAAAAAAAAAAAAAAAAAAAA+M/sf/q892Y6ffuxKoYRcfKZZTFYHZVFr3jhv41prkgRcaZZ/Wi5w7MVX/99wi9CMejo415VZBejjek5T8t6RDTV2DyldKrB1TVi2NXFCQAAAAAAAAAAAAAAAAAArpjqT7+/Z6MuGgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACADlT3/z9HcRARpxi8fLONTpcKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADAJfYzAAD///63Krc=")
add_key$user(&(0x7f0000000040), &(0x7f0000000080)={'syz', 0x0}, &(0x7f0000000100)="0400", 0x2, 0xfffffffffffffffd)
mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./lower\x00', 0x1ff)
mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff)
mount(&(0x7f0000000400)=@filename='./lower\x00', &(0x7f0000000440)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz ,ecryptfs_fnek_sig=syz ,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00')
r0 = openat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x0, 0x0)
ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, 0x0)
[ 131.467168][ T4648] Bluetooth: hci0: command tx timeout
[ 131.478808][ T5335] loop0: detected capacity change from 0 to 256
[ 131.542392][ T5335] ==================================================================
[ 131.542406][ T5335] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.542578][ T5335] Read of size 2 at addr ffff88803473071a by task syz.0.0/5335
[ 131.542589][ T5335]
[ 131.542597][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 131.542635][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 131.542644][ T5335] Call Trace:
[ 131.542649][ T5335]
[ 131.542656][ T5335] dump_stack_lvl+0xe8/0x150
[ 131.542688][ T5335] print_address_description+0x55/0x1e0
[ 131.542708][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.542724][ T5335] print_report+0x58/0x70
[ 131.542740][ T5335] kasan_report+0x117/0x150
[ 131.542765][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.542783][ T5335] ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.542797][ T5335] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 131.542813][ T5335] ecryptfs_get_tree+0x563/0x1370
[ 131.542833][ T5335] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 131.542854][ T5335] vfs_get_tree+0x92/0x2a0
[ 131.542873][ T5335] do_new_mount+0x319/0xdc0
[ 131.542890][ T5335] ? __pfx_do_new_mount+0x10/0x10
[ 131.542905][ T5335] ? ns_capable+0x89/0xe0
[ 131.542922][ T5335] ? path_mount+0x647/0x1050
[ 131.542935][ T5335] ? user_path_at+0xd4/0x160
[ 131.542951][ T5335] __se_sys_mount+0x31d/0x420
[ 131.542966][ T5335] ? __pfx___se_sys_mount+0x10/0x10
[ 131.542982][ T5335] ? __x64_sys_mount+0x20/0xc0
[ 131.542997][ T5335] do_syscall_64+0x166/0x520
[ 131.543067][ T5335] ? trace_irq_disable+0x3b/0x140
[ 131.543093][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.543105][ T5335] ? clear_bhb_loop+0x70/0xc0
[ 131.543118][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.543131][ T5335] RIP: 0033:0x7fc9c0b9e159
[ 131.543143][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 131.543154][ T5335] RSP: 002b:00007fc9c19a0fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 131.543168][ T5335] RAX: ffffffffffffffda RBX: 00007fc9c0e25fa0 RCX: 00007fc9c0b9e159
[ 131.543178][ T5335] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 131.543187][ T5335] RBP: 00007fc9c0c3506b R08: 0000200000000500 R09: 0000000000000000
[ 131.543195][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 131.543202][ T5335] R13: 00007fc9c0e26038 R14: 00007fc9c0e25fa0 R15: 00007ffe9c4b0508
[ 131.543217][ T5335]
[ 131.543222][ T5335]
[ 131.543225][ T5335] Allocated by task 5335:
[ 131.543232][ T5335] kasan_save_track+0x3e/0x80
[ 131.543243][ T5335] __kasan_kmalloc+0x93/0xb0
[ 131.543253][ T5335] __kmalloc_noprof+0x36b/0x720
[ 131.543268][ T5335] user_preparse+0x9e/0x160
[ 131.543295][ T5335] __key_create_or_update+0x3a9/0xa80
[ 131.543309][ T5335] key_create_or_update+0x42/0x60
[ 131.543321][ T5335] __se_sys_add_key+0x349/0x420
[ 131.543336][ T5335] do_syscall_64+0x166/0x520
[ 131.543351][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.543362][ T5335]
[ 131.543365][ T5335] The buggy address belongs to the object at ffff888034730700
[ 131.543365][ T5335] which belongs to the cache kmalloc-32 of size 32
[ 131.543375][ T5335] The buggy address is located 0 bytes to the right of
[ 131.543375][ T5335] allocated 26-byte region [ffff888034730700, ffff88803473071a)
[ 131.543387][ T5335]
[ 131.543390][ T5335] The buggy address belongs to the physical page:
[ 131.543396][ T5335] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34730
[ 131.543407][ T5335] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
[ 131.543422][ T5335] page_type: f5(slab)
[ 131.543440][ T5335] raw: 04fff00000000000 ffff88801b041780 dead000000000100 dead000000000122
[ 131.543452][ T5335] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000
[ 131.543462][ T5335] page dumped because: kasan: bad access detected
[ 131.543468][ T5335] page_owner tracks the page as allocated
[ 131.543475][ T5335] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1444, tgid 1444 (kworker/u4:8), ts 15548276713
[ 131.543497][ T5335] post_alloc_hook+0x1f9/0x250
[ 131.543515][ T5335] get_page_from_freelist+0x2209/0x2280
[ 131.543530][ T5335] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 131.543544][ T5335] allocate_slab+0x7d/0x620
[ 131.543562][ T5335] refill_objects+0x2d5/0x350
[ 131.543580][ T5335] __pcs_replace_empty_main+0x2c8/0x6c0
[ 131.543595][ T5335] __kmalloc_cache_noprof+0x39b/0x600
[ 131.543626][ T5335] kmem_cache_free+0x156/0x650
[ 131.543636][ T5335] release_task+0x1020/0x1740
[ 131.543647][ T5335] do_exit+0x168c/0x2360
[ 131.543657][ T5335] call_usermodehelper_exec_async+0x357/0x360
[ 131.543673][ T5335] ret_from_fork+0x514/0xb70
[ 131.543683][ T5335] ret_from_fork_asm+0x1a/0x30
[ 131.543699][ T5335] page last free pid 1054 tgid 1054 ts 15547924901 stack trace:
[ 131.543707][ T5335] __free_frozen_pages+0xc93/0xd90
[ 131.543723][ T5335] __kasan_populate_vmalloc+0x1a8/0x1c0
[ 131.543740][ T5335] alloc_vmap_area+0xd1a/0x1420
[ 131.543755][ T5335] __get_vm_area_node+0x200/0x2f0
[ 131.543767][ T5335] __vmalloc_node_range_noprof+0x343/0x1540
[ 131.543782][ T5335] __vmalloc_node_noprof+0xc2/0x100
[ 131.543796][ T5335] dup_task_struct+0x2c6/0xa00
[ 131.543809][ T5335] copy_process+0x7e0/0x4400
[ 131.543822][ T5335] kernel_clone+0x2d7/0x940
[ 131.543835][ T5335] user_mode_thread+0x115/0x180
[ 131.543848][ T5335] call_usermodehelper_exec_work+0x5c/0x230
[ 131.543862][ T5335] process_scheduled_works+0xc3d/0x1630
[ 131.543872][ T5335] worker_thread+0xa47/0xfb0
[ 131.543883][ T5335] kthread+0x38b/0x480
[ 131.543892][ T5335] ret_from_fork+0x514/0xb70
[ 131.543901][ T5335] ret_from_fork_asm+0x1a/0x30
[ 131.543917][ T5335]
[ 131.543920][ T5335] Memory state around the buggy address:
[ 131.543926][ T5335] ffff888034730600: 00 00 00 fc fc fc fc fc fa fb fb fb fc fc fc fc
[ 131.543934][ T5335] ffff888034730680: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc
[ 131.543941][ T5335] >ffff888034730700: 00 00 00 02 fc fc fc fc 00 00 00 fc fc fc fc fc
[ 131.543947][ T5335] ^
[ 131.543952][ T5335] ffff888034730780: 00 00 00 00 fc fc fc fc 00 00 00 fc fc fc fc fc
[ 131.543960][ T5335] ffff888034730800: 00 00 00 fc fc fc fc fc 00 00 00 fc fc fc fc fc
[ 131.543967][ T5335] ==================================================================
[ 131.715401][ T5335] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 131.833280][ T5335] CPU: 0 UID: 0 PID: 5335 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
[ 131.836932][ T5335] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 131.840530][ T5335] Call Trace:
[ 131.841830][ T5335]
[ 131.843000][ T5335] vpanic+0x56d/0xa60
[ 131.844615][ T5335] ? __pfx_vpanic+0x10/0x10
[ 131.846542][ T5335] ? __pfx___schedule+0x10/0x10
[ 131.848629][ T5335] panic+0xc5/0xd0
[ 131.850074][ T5335] ? __pfx_panic+0x10/0x10
[ 131.851884][ T5335] ? preempt_schedule_thunk+0x16/0x40
[ 131.854033][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.856851][ T5335] check_panic_on_warn+0x89/0xb0
[ 131.859091][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.861910][ T5335] end_report+0x73/0x170
[ 131.863826][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.866698][ T5335] kasan_report+0x128/0x150
[ 131.868725][ T5335] ? ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.871569][ T5335] ecryptfs_verify_auth_tok_from_key+0x36f/0x3a0
[ 131.874121][ T5335] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250
[ 131.876907][ T5335] ecryptfs_get_tree+0x563/0x1370
[ 131.878908][ T5335] ? __pfx_ecryptfs_get_tree+0x10/0x10
[ 131.880973][ T5335] vfs_get_tree+0x92/0x2a0
[ 131.882701][ T5335] do_new_mount+0x319/0xdc0
[ 131.884639][ T5335] ? __pfx_do_new_mount+0x10/0x10
[ 131.886730][ T5335] ? ns_capable+0x89/0xe0
[ 131.888509][ T5335] ? path_mount+0x647/0x1050
[ 131.890387][ T5335] ? user_path_at+0xd4/0x160
[ 131.892375][ T5335] __se_sys_mount+0x31d/0x420
[ 131.894474][ T5335] ? __pfx___se_sys_mount+0x10/0x10
[ 131.896703][ T5335] ? __x64_sys_mount+0x20/0xc0
[ 131.898821][ T5335] do_syscall_64+0x166/0x520
[ 131.900853][ T5335] ? trace_irq_disable+0x3b/0x140
[ 131.903033][ T5335] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.905751][ T5335] ? clear_bhb_loop+0x70/0xc0
[ 131.907713][ T5335] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 131.910178][ T5335] RIP: 0033:0x7fc9c0b9e159
[ 131.911999][ T5335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[ 131.919986][ T5335] RSP: 002b:00007fc9c19a0fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
[ 131.922904][ T5335] RAX: ffffffffffffffda RBX: 00007fc9c0e25fa0 RCX: 00007fc9c0b9e159
[ 131.925769][ T5335] RDX: 0000200000000480 RSI: 0000200000000440 RDI: 0000200000000400
[ 131.929173][ T5335] RBP: 00007fc9c0c3506b R08: 0000200000000500 R09: 0000000000000000
[ 131.932687][ T5335] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[ 131.936459][ T5335] R13: 00007fc9c0e26038 R14: 00007fc9c0e25fa0 R15: 00007ffe9c4b0508
[ 131.940227][ T5335]
[ 131.944488][ T5335] Kernel Offset: disabled
[ 131.946524][ T5335] Rebooting in 86400 seconds..