program: ioctl$VIDIOC_S_TUNER(0xffffffffffffffff, 0x4054561e, &(0x7f0000000400)={0x9, "1ae0f13cec41a2ed2b5ebaad93fdd700256b4e33897f9ffa820f9016fae61507", 0x1, 0x20, 0x75a9258d, 0xc, 0x1, 0x4, 0x8, 0x101}) userfaultfd(0x801) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SETSEL(r0, 0x541c, &(0x7f0000000000)={0x2, {0x2, 0x3c1, 0x0, 0x10a, 0xa}}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x181743, 0x0) fsopen(0x0, 0x0) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="04002bbd7000fbdbdf2501000000000000000841000000140018000000087564703a73797a3000000000"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x40001) r2 = add_key$user(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)='X', 0x1, 0xfffffffffffffffe) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000580), 0x100, 0x0) syz_ublk_setup_io_uring(0x34a2, &(0x7f0000000c00)={0x0, 0x3e03, 0x80, 0x0, 0x77}, &(0x7f0000000c80), &(0x7f0000000cc0), &(0x7f0000000d00)) r4 = add_key$user(&(0x7f0000000280), &(0x7f00000002c0), &(0x7f0000000300), 0x390, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000340)={r2, r4, r4}, 0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={'streebog512-generic\x00'}}) socket$inet6(0xa, 0x3, 0x1) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000540), r1) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r6, 0x400448cc, 0x0) sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x8c100519f124c3cc}, 0xc, &(0x7f00000005c0)={&(0x7f0000000b80)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="00032bbd7000ffdbdf25010000000000000002410000001000137564703a73797a3100000000cb80a9ae8163845fcd8ba3429d25813563cfd0d8494b4f1a55b7ae5d783a59307676a4f64ace68d954e36140a526539facd1"], 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x900) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x109042, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000000640), &(0x7f0000000680)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f00000006c0)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./proc\x00', &(0x7f0000000740)='proc\x00', 0x0, 0x0) r7 = syz_open_dev$media(&(0x7f0000000800), 0x8, 0x80940) r8 = syz_open_dev$media(&(0x7f0000000880), 0x3, 0x20040) ioctl$MEDIA_IOC_ENUM_LINKS(r8, 0xc0287c02, &(0x7f00000009c0)={0x80000000, 0x0, &(0x7f0000000a00)=[{}, {{}, {0x80000000}}]}) ioctl$MEDIA_IOC_ENUM_ENTITIES(r7, 0xc1007c01, &(0x7f0000000a80)={r9}) add_key$user(&(0x7f0000000780), &(0x7f00000000c0), &(0x7f0000000d40)="3fbb7bf6f50e4ba8f4e71c45437ac8d3571ce908de5ae3aa6fbf3d5b4e9d2fa2f37d3d2a02000adf112a48148ad25c7b9d1ead6ba763cda7d4fbb810d480bacac4ce56e79a479f56b1d19484cfe2fdfc8053134f4a1e26411419108fbf3941dcd918120468eb3183000d619103a87ea3fc0e99197b9792e72a3485e4cecbd3718f50d9003d2c3da07d07baf2017e501e7175bf0562957009000000850c2a513f31c83799de395bb70946b390aaebaa957506c40df2466f7f2421a5d7639c3c7e1abad6e1917da75c9a6a582512bd452105217eb0b772b062324d4ebf94abfaca4091e1062c1852320cc986a665e8264aa8abc42213b29a00000000000000000000e3276b2818eff18d4e9526d8a95ad5532b40dc40ee7d6a5af72a07a84f9ca9aaa0749f25738d451453e2f9511d040453acde99e1670e993254b903b79ab32c93a58e64f6fc8d6e5e1489ae43ee4f2c9b17d7ec4e80d5857f5d12fe2a9dadc43090871f9c08e2901e739425198d27ead4ca594944a89a8948111f4a27c1e117cdda5beb00a63f873df58e6b8bcd270b7b3c05bd32a37af0f7155475007d7fb220afa4f47df2e0add9feb1cb59d334477c8c1ff69633af05a92497d340", 0x1bd, 0xfffffffffffffffb) mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./mnt\x00', 0x1ff) mount(&(0x7f0000000880), &(0x7f00000008c0)='./mnt\x00', &(0x7f0000000900)='ecryptfs\x00', 0x0, &(0x7f0000000940)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') write$P9_RSTATu(r3, &(0x7f0000000480)=ANY=[], 0x234) ioctl$TCSETS2(r0, 0x402c542b, &(0x7f0000000080)={0x1, 0x10000, 0x1fc0, 0xa, 0xb2, "35969809006e24a7446d8073145e6c31c267a0", 0x101, 0xfffffffe}) [ 135.960642][ T4668] Bluetooth: hci0: command tx timeout [ 136.191026][ T5346] ================================================================== [ 136.191042][ T5346] BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.191245][ T5346] Read of size 2 at addr ffff888041ba0b59 by task syz.0.0/5346 [ 136.191256][ T5346] [ 136.191276][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 136.191291][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.191299][ T5346] Call Trace: [ 136.191306][ T5346] [ 136.191313][ T5346] dump_stack_lvl+0xe8/0x150 [ 136.191336][ T5346] print_address_description+0x55/0x1e0 [ 136.191359][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.191380][ T5346] print_report+0x58/0x70 [ 136.191396][ T5346] kasan_report+0x117/0x150 [ 136.191415][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.191437][ T5346] ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.191457][ T5346] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250 [ 136.191489][ T5346] ecryptfs_get_tree+0x547/0x12a0 [ 136.191505][ T5346] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 136.191522][ T5346] ? __pfx_ecryptfs_get_tree+0x10/0x10 [ 136.191540][ T5346] vfs_get_tree+0x92/0x2a0 [ 136.191556][ T5346] do_new_mount+0x325/0xb00 [ 136.191569][ T5346] ? __pfx_do_new_mount+0x10/0x10 [ 136.191582][ T5346] ? ns_capable+0x84/0xe0 [ 136.191600][ T5346] ? path_mount+0x647/0x1050 [ 136.191614][ T5346] ? user_path_at+0xd4/0x160 [ 136.191629][ T5346] __se_sys_mount+0x31d/0x420 [ 136.191644][ T5346] ? __pfx___se_sys_mount+0x10/0x10 [ 136.191659][ T5346] ? __x64_sys_mount+0x20/0xc0 [ 136.191673][ T5346] do_syscall_64+0x166/0x520 [ 136.191749][ T5346] ? trace_irq_disable+0x3b/0x140 [ 136.191768][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.191783][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 136.191796][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.191807][ T5346] RIP: 0033:0x7fa7eb39fb19 [ 136.191829][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.191840][ T5346] RSP: 002b:00007fa7ec306fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 136.191855][ T5346] RAX: ffffffffffffffda RBX: 00007fa7eb625fa0 RCX: 00007fa7eb39fb19 [ 136.191864][ T5346] RDX: 0000200000000900 RSI: 00002000000008c0 RDI: 0000200000000880 [ 136.191874][ T5346] RBP: 00007fa7eb437af8 R08: 0000200000000940 R09: 0000000000000000 [ 136.191882][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.191889][ T5346] R13: 00007fa7eb626038 R14: 00007fa7eb625fa0 R15: 00007ffde3e4cde8 [ 136.191902][ T5346] [ 136.191906][ T5346] [ 136.191909][ T5346] Allocated by task 5346: [ 136.191915][ T5346] kasan_save_track+0x3e/0x80 [ 136.191931][ T5346] __kasan_kmalloc+0x93/0xb0 [ 136.191946][ T5346] __kmalloc_noprof+0x366/0x710 [ 136.191959][ T5346] user_preparse+0x9e/0x160 [ 136.191973][ T5346] __key_create_or_update+0x360/0xa90 [ 136.194207][ T5346] key_create_or_update+0x42/0x60 [ 136.194222][ T5346] __se_sys_add_key+0x349/0x420 [ 136.194232][ T5346] do_syscall_64+0x166/0x520 [ 136.194246][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.194257][ T5346] [ 136.194260][ T5346] The buggy address belongs to the object at ffff888041ba0b40 [ 136.194260][ T5346] which belongs to the cache kmalloc-32 of size 32 [ 136.194270][ T5346] The buggy address is located 0 bytes to the right of [ 136.194270][ T5346] allocated 25-byte region [ffff888041ba0b40, ffff888041ba0b59) [ 136.194282][ T5346] [ 136.194286][ T5346] The buggy address belongs to the physical page: [ 136.194293][ T5346] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x41ba0 [ 136.194305][ T5346] flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff) [ 136.194316][ T5346] page_type: f5(slab) [ 136.194328][ T5346] raw: 04fff00000000000 ffff88801c841780 dead000000000100 dead000000000122 [ 136.194339][ T5346] raw: 0000000000000000 0000000000400040 00000000f5000000 0000000000000000 [ 136.194346][ T5346] page dumped because: kasan: bad access detected [ 136.194353][ T5346] page_owner tracks the page as allocated [ 136.194357][ T5346] page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5012, tgid 5012 (dhcpcd), ts 103924272717 [ 136.194376][ T5346] post_alloc_hook+0x1f9/0x250 [ 136.194386][ T5346] get_page_from_freelist+0x220f/0x2280 [ 136.194400][ T5346] __alloc_frozen_pages_noprof+0x1fe/0x410 [ 136.194413][ T5346] allocate_slab+0x7d/0x5e0 [ 136.194429][ T5346] refill_objects+0x2d5/0x350 [ 136.194446][ T5346] __pcs_replace_empty_main+0x2c8/0x6c0 [ 136.194460][ T5346] __kmalloc_cache_noprof+0x396/0x600 [ 136.194482][ T5346] kmem_cache_free+0x156/0x650 [ 136.194495][ T5346] __put_anon_vma+0x126/0x2d0 [ 136.194505][ T5346] anon_vma_fork+0x1f0/0x4d0 [ 136.194515][ T5346] dup_mmap+0x9a8/0x1e10 [ 136.194526][ T5346] copy_mm+0x115/0x470 [ 136.194540][ T5346] copy_process+0x1ecc/0x4510 [ 136.194553][ T5346] kernel_clone+0x2d7/0x940 [ 136.194568][ T5346] __x64_sys_clone+0x1b6/0x230 [ 136.194584][ T5346] do_syscall_64+0x166/0x520 [ 136.194598][ T5346] page last free pid 4928 tgid 4928 ts 95078870465 stack trace: [ 136.194607][ T5346] __free_frozen_pages+0xc97/0xd90 [ 136.194617][ T5346] tlb_remove_table_rcu+0x85/0x100 [ 136.194628][ T5346] rcu_core+0x92e/0x1230 [ 136.194642][ T5346] handle_softirqs+0x265/0x8d0 [ 136.194656][ T5346] __irq_exit_rcu+0xc6/0x220 [ 136.194670][ T5346] irq_exit_rcu+0x9/0x30 [ 136.194683][ T5346] sysvec_apic_timer_interrupt+0xa6/0xc0 [ 136.194695][ T5346] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 136.194708][ T5346] [ 136.194710][ T5346] Memory state around the buggy address: [ 136.194717][ T5346] ffff888041ba0a00: 00 00 00 fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 136.194724][ T5346] ffff888041ba0a80: 00 00 00 fc fc fc fc fc 00 00 00 00 fc fc fc fc [ 136.194732][ T5346] >ffff888041ba0b00: 00 00 00 00 fc fc fc fc 00 00 00 01 fc fc fc fc [ 136.194738][ T5346] ^ [ 136.194744][ T5346] ffff888041ba0b80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc [ 136.194751][ T5346] ffff888041ba0c00: fa fb fb fb fc fc fc fc 00 00 00 fc fc fc fc fc [ 136.194757][ T5346] ================================================================== [ 136.197651][ T5346] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 136.450816][ T5346] CPU: 0 UID: 0 PID: 5346 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) [ 136.454464][ T5346] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 136.459520][ T5346] Call Trace: [ 136.461258][ T5346] [ 136.462629][ T5346] vpanic+0x26f/0x710 [ 136.464383][ T5346] panic+0xc5/0xd0 [ 136.466055][ T5346] ? __pfx_panic+0x10/0x10 [ 136.467959][ T5346] ? preempt_schedule_thunk+0x16/0x40 [ 136.470276][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.472847][ T5346] check_panic_on_warn+0x89/0xb0 [ 136.477334][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.480053][ T5346] end_report+0x73/0x170 [ 136.481860][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.484594][ T5346] kasan_report+0x128/0x150 [ 136.486768][ T5346] ? ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.489600][ T5346] ecryptfs_verify_auth_tok_from_key+0x350/0x3a0 [ 136.491966][ T5346] ecryptfs_keyring_auth_tok_for_sig+0xec/0x250 [ 136.494265][ T5346] ecryptfs_get_tree+0x547/0x12a0 [ 136.496219][ T5346] ? __pfx_vfs_parse_comma_sep+0x10/0x10 [ 136.498289][ T5346] ? __pfx_ecryptfs_get_tree+0x10/0x10 [ 136.500386][ T5346] vfs_get_tree+0x92/0x2a0 [ 136.502244][ T5346] do_new_mount+0x325/0xb00 [ 136.504113][ T5346] ? __pfx_do_new_mount+0x10/0x10 [ 136.506141][ T5346] ? ns_capable+0x84/0xe0 [ 136.507862][ T5346] ? path_mount+0x647/0x1050 [ 136.509793][ T5346] ? user_path_at+0xd4/0x160 [ 136.511621][ T5346] __se_sys_mount+0x31d/0x420 [ 136.513393][ T5346] ? __pfx___se_sys_mount+0x10/0x10 [ 136.515570][ T5346] ? __x64_sys_mount+0x20/0xc0 [ 136.517513][ T5346] do_syscall_64+0x166/0x520 [ 136.519324][ T5346] ? trace_irq_disable+0x3b/0x140 [ 136.521185][ T5346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.523691][ T5346] ? clear_bhb_loop+0x70/0xc0 [ 136.525741][ T5346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.528209][ T5346] RIP: 0033:0x7fa7eb39fb19 [ 136.530192][ T5346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 136.537850][ T5346] RSP: 002b:00007fa7ec306fe8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 136.540727][ T5346] RAX: ffffffffffffffda RBX: 00007fa7eb625fa0 RCX: 00007fa7eb39fb19 [ 136.543757][ T5346] RDX: 0000200000000900 RSI: 00002000000008c0 RDI: 0000200000000880 [ 136.547024][ T5346] RBP: 00007fa7eb437af8 R08: 0000200000000940 R09: 0000000000000000 [ 136.550577][ T5346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.554168][ T5346] R13: 00007fa7eb626038 R14: 00007fa7eb625fa0 R15: 00007ffde3e4cde8 [ 136.557617][ T5346] [ 136.559459][ T5346] Kernel Offset: disabled [ 136.561417][ T5346] Rebooting in 86400 seconds..