program: ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000000)={0xffffffffffffffff, 0x8000, 0x4, 0x6}) ioctl$AUTOFS_IOC_ASKUMOUNT(r0, 0x80049370, &(0x7f0000000040)) mkdirat(0xffffffffffffff9c, &(0x7f0000004000)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000280), &(0x7f00000000c0)=0x4) r1 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) ioctl$BTRFS_IOC_START_SYNC(r0, 0x80089418, &(0x7f0000000100)) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') llistxattr(&(0x7f0000000040)='./mnt\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000680)='mnt/encrypted_dir\x00', 0x800, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f00000006c0)=@v2={0x2, @aes256, 0x0, '\x00', @a}) recvmsg$can_bcm(r2, &(0x7f0000000380)={&(0x7f0000000580)=@vsock, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000000700)=""/136, 0x88}, {&(0x7f00000007c0)=""/131, 0x83}, {&(0x7f0000000880)=""/249, 0xf9}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/50, 0x32}, {&(0x7f0000001f40)=""/256, 0x100}, {&(0x7f0000000400)=""/52, 0x34}, {&(0x7f0000001b40)=""/123, 0x7b}, {&(0x7f0000001bc0)=""/224, 0xe0}], 0x9, &(0x7f0000001e80)=""/176, 0xb0}, 0x40) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000180), &(0x7f00000001c0)=0x4) ioctl$F2FS_IOC_GET_PIN_FILE(r0, 0x8004f50e, &(0x7f0000000200)) ioctl$RTC_PLL_GET(0xffffffffffffffff, 0x80207011, &(0x7f0000000080)) keyctl$dh_compute(0x17, &(0x7f00000002c0)={r1, r1, r1}, &(0x7f0000000300)=""/101, 0x65, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@newlink={0x40, 0x10, 0x401, 0x70bd28, 0x84, {0x0, 0x0, 0x0, 0x0, 0x26f13}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x4}}}, @IFLA_ADDRESS={0xa, 0x1, @broadcast}]}, 0x40}, 0x1, 0x0, 0x0, 0x2400d818}, 0x0) write(r3, &(0x7f0000000140)='A', 0x1) [ 94.693976][ T4651] Bluetooth: hci0: command tx timeout [ 94.904769][ T5322] ================================================================== [ 94.904783][ T5322] BUG: KASAN: slab-use-after-free in ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.904882][ T5322] Read of size 4 at addr ffff888042e35e98 by task syz.0.0/5322 [ 94.904892][ T5322] [ 94.904901][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 94.904914][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 94.904922][ T5322] Call Trace: [ 94.904970][ T5322] [ 94.904977][ T5322] dump_stack_lvl+0xe8/0x150 [ 94.904995][ T5322] print_address_description+0x55/0x1e0 [ 94.905009][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.905023][ T5322] print_report+0x58/0x70 [ 94.905035][ T5322] kasan_report+0x117/0x150 [ 94.905050][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.905066][ T5322] ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 94.905084][ T5322] ecryptfs_encrypt_and_encode_filename+0x576/0x1580 [ 94.905102][ T5322] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10 [ 94.905117][ T5322] ? d_alloc_parallel+0x1535/0x16b0 [ 94.905134][ T5322] ecryptfs_lookup+0x20e/0x780 [ 94.905151][ T5322] ? __pfx_ecryptfs_lookup+0x10/0x10 [ 94.905166][ T5322] ? d_lookup+0x1f/0xa0 [ 94.905181][ T5322] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 94.905198][ T5322] lookup_open+0x9e1/0x1a40 [ 94.905220][ T5322] path_openat+0x677/0x1d60 [ 94.905240][ T5322] do_file_open+0x23e/0x4a0 [ 94.905257][ T5322] ? __pfx_do_file_open+0x10/0x10 [ 94.905278][ T5322] ? _raw_spin_unlock+0x28/0x50 [ 94.905335][ T5322] ? alloc_fd+0x651/0x6c0 [ 94.905371][ T5322] do_sys_openat2+0x115/0x200 [ 94.905385][ T5322] ? __se_sys_futex+0x3a8/0x450 [ 94.905402][ T5322] ? __pfx_do_sys_openat2+0x10/0x10 [ 94.905416][ T5322] ? rcu_is_watching+0x16/0xb0 [ 94.905430][ T5322] __x64_sys_openat+0x138/0x170 [ 94.905449][ T5322] do_syscall_64+0x166/0x520 [ 94.905477][ T5322] ? trace_irq_disable+0x3b/0x140 [ 94.905490][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.905502][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 94.905514][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.905527][ T5322] RIP: 0033:0x7fd06f59e159 [ 94.905539][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 94.905550][ T5322] RSP: 002b:00007fd0704b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 94.905564][ T5322] RAX: ffffffffffffffda RBX: 00007fd06f825fa0 RCX: 00007fd06f59e159 [ 94.905572][ T5322] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c [ 94.905586][ T5322] RBP: 00007fd06f63506b R08: 0000000000000000 R09: 0000000000000000 [ 94.905593][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 94.905601][ T5322] R13: 00007fd06f826038 R14: 00007fd06f825fa0 R15: 00007ffe5ac99bb8 [ 94.905613][ T5322] [ 94.905617][ T5322] [ 94.905620][ T5322] Allocated by task 5322: [ 94.905625][ T5322] kasan_save_track+0x3e/0x80 [ 94.905636][ T5322] __kasan_kmalloc+0x93/0xb0 [ 94.905647][ T5322] __kvmalloc_node_noprof+0x50f/0x820 [ 94.905658][ T5322] __se_sys_add_key+0x289/0x420 [ 94.905676][ T5322] do_syscall_64+0x166/0x520 [ 94.905690][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.905700][ T5322] [ 94.905702][ T5322] Freed by task 5322: [ 94.905707][ T5322] kasan_save_track+0x3e/0x80 [ 94.905716][ T5322] kasan_save_free_info+0x40/0x50 [ 94.905729][ T5322] __kasan_slab_free+0x5c/0x80 [ 94.905739][ T5322] kfree+0x1c5/0x650 [ 94.905750][ T5322] __se_sys_add_key+0x3a3/0x420 [ 94.905762][ T5322] do_syscall_64+0x166/0x520 [ 94.905774][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.905784][ T5322] [ 94.905788][ T5322] The buggy address belongs to the object at ffff888042e35e00 [ 94.905788][ T5322] which belongs to the cache kmalloc-256 of size 256 [ 94.905797][ T5322] The buggy address is located 152 bytes inside of [ 94.905797][ T5322] freed 256-byte region [ffff888042e35e00, ffff888042e35f00) [ 94.905808][ T5322] [ 94.905812][ T5322] The buggy address belongs to the physical page: [ 94.905818][ T5322] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42e35 [ 94.905840][ T5322] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 94.905851][ T5322] page_type: f5(slab) [ 94.905862][ T5322] raw: 04fff00000000000 ffff88801b041b40 dead000000000122 0000000000000000 [ 94.905870][ T5322] raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 [ 94.905874][ T5322] page dumped because: kasan: bad access detected [ 94.905878][ T5322] page_owner tracks the page as allocated [ 94.905881][ T5322] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5285, tgid 5285 (syz-executor), ts 92599714718 [ 94.905898][ T5322] post_alloc_hook+0x1f9/0x250 [ 94.905913][ T5322] get_page_from_freelist+0x2209/0x2280 [ 94.905922][ T5322] __alloc_frozen_pages_noprof+0x217/0x5a0 [ 94.905932][ T5322] allocate_slab+0x7d/0x620 [ 94.905945][ T5322] refill_objects+0x2d5/0x350 [ 94.905956][ T5322] __pcs_replace_empty_main+0x2c8/0x6c0 [ 94.905966][ T5322] __kmalloc_noprof+0x47b/0x720 [ 94.905980][ T5322] genl_family_rcv_msg_attrs_parse+0xd0/0x2f0 [ 94.906005][ T5322] genl_family_rcv_msg_doit+0xda/0x340 [ 94.906018][ T5322] genl_rcv_msg+0x614/0x7a0 [ 94.906030][ T5322] netlink_rcv_skb+0x226/0x4a0 [ 94.906044][ T5322] genl_rcv+0x28/0x40 [ 94.906052][ T5322] netlink_unicast+0x7bd/0x940 [ 94.906061][ T5322] netlink_sendmsg+0x813/0xb40 [ 94.906067][ T5322] sock_sendmsg_nosec+0x13a/0x180 [ 94.906084][ T5322] __sys_sendto+0x408/0x5a0 [ 94.906092][ T5322] page last free pid 5285 tgid 5285 ts 92120831574 stack trace: [ 94.906099][ T5322] __free_frozen_pages+0xc93/0xd90 [ 94.906109][ T5322] __slab_free+0x274/0x2c0 [ 94.906118][ T5322] qlist_free_all+0x99/0x100 [ 94.906127][ T5322] kasan_quarantine_reduce+0x148/0x160 [ 94.906143][ T5322] __kasan_slab_alloc+0x22/0x80 [ 94.906155][ T5322] __kmalloc_cache_noprof+0x29f/0x600 [ 94.906171][ T5322] __request_module+0x2d0/0x630 [ 94.906186][ T5322] dev_ioctl+0x680/0x1150 [ 94.906205][ T5322] sock_do_ioctl+0x23e/0x320 [ 94.906214][ T5322] sock_ioctl+0x57a/0x7e0 [ 94.906226][ T5322] __se_sys_ioctl+0xfc/0x170 [ 94.906235][ T5322] do_syscall_64+0x166/0x520 [ 94.906248][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 94.906259][ T5322] [ 94.906262][ T5322] Memory state around the buggy address: [ 94.906267][ T5322] ffff888042e35d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.906275][ T5322] ffff888042e35e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.906283][ T5322] >ffff888042e35e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 94.906289][ T5322] ^ [ 94.906295][ T5322] ffff888042e35f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.906303][ T5322] ffff888042e35f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 94.906308][ T5322] ================================================================== [ 94.906491][ T5322] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 95.197673][ T5322] CPU: 0 UID: 0 PID: 5322 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 95.200634][ T5322] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 95.204056][ T5322] Call Trace: [ 95.205451][ T5322] [ 95.206790][ T5322] vpanic+0x56d/0xa60 [ 95.208641][ T5322] ? __pfx_vpanic+0x10/0x10 [ 95.210711][ T5322] panic+0xc5/0xd0 [ 95.212312][ T5322] ? __pfx_panic+0x10/0x10 [ 95.214261][ T5322] ? preempt_schedule_thunk+0x16/0x40 [ 95.216603][ T5322] ? preempt_schedule_thunk+0x16/0x40 [ 95.218937][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.221540][ T5322] check_panic_on_warn+0x89/0xb0 [ 95.223569][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.226137][ T5322] end_report+0x73/0x170 [ 95.227856][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.230481][ T5322] kasan_report+0x128/0x150 [ 95.232430][ T5322] ? ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.234953][ T5322] ecryptfs_write_tag_70_packet+0x1241/0x12e0 [ 95.237382][ T5322] ecryptfs_encrypt_and_encode_filename+0x576/0x1580 [ 95.240122][ T5322] ? __pfx_ecryptfs_encrypt_and_encode_filename+0x10/0x10 [ 95.243268][ T5322] ? d_alloc_parallel+0x1535/0x16b0 [ 95.245591][ T5322] ecryptfs_lookup+0x20e/0x780 [ 95.247638][ T5322] ? __pfx_ecryptfs_lookup+0x10/0x10 [ 95.249947][ T5322] ? d_lookup+0x1f/0xa0 [ 95.251756][ T5322] ? seqcount_lockdep_reader_access+0xa9/0x100 [ 95.254449][ T5322] lookup_open+0x9e1/0x1a40 [ 95.256497][ T5322] path_openat+0x677/0x1d60 [ 95.258531][ T5322] do_file_open+0x23e/0x4a0 [ 95.260588][ T5322] ? __pfx_do_file_open+0x10/0x10 [ 95.262739][ T5322] ? _raw_spin_unlock+0x28/0x50 [ 95.264757][ T5322] ? alloc_fd+0x651/0x6c0 [ 95.266711][ T5322] do_sys_openat2+0x115/0x200 [ 95.268589][ T5322] ? __se_sys_futex+0x3a8/0x450 [ 95.270596][ T5322] ? __pfx_do_sys_openat2+0x10/0x10 [ 95.272805][ T5322] ? rcu_is_watching+0x16/0xb0 [ 95.274755][ T5322] __x64_sys_openat+0x138/0x170 [ 95.276794][ T5322] do_syscall_64+0x166/0x520 [ 95.278839][ T5322] ? trace_irq_disable+0x3b/0x140 [ 95.281092][ T5322] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.283795][ T5322] ? clear_bhb_loop+0x70/0xc0 [ 95.285870][ T5322] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 95.288498][ T5322] RIP: 0033:0x7fd06f59e159 [ 95.290574][ T5322] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 95.300169][ T5322] RSP: 002b:00007fd0704b6fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 95.303554][ T5322] RAX: ffffffffffffffda RBX: 00007fd06f825fa0 RCX: 00007fd06f59e159 [ 95.306635][ T5322] RDX: 0000000000000800 RSI: 0000200000000680 RDI: ffffffffffffff9c [ 95.309304][ T5322] RBP: 00007fd06f63506b R08: 0000000000000000 R09: 0000000000000000 [ 95.312369][ T5322] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 95.315410][ T5322] R13: 00007fd06f826038 R14: 00007fd06f825fa0 R15: 00007ffe5ac99bb8 [ 95.318538][ T5322] [ 95.320289][ T5322] Kernel Offset: disabled [ 95.322160][ T5322] Rebooting in 86400 seconds..