==================================================================
BUG: KASAN: slab-use-after-free in ecryptfs_write_tag_70_packet+0xea0/0xedc fs/ecryptfs/keystore.c:742
Read of size 4 at addr ffff0000c497e298 by task syz.5.143/5588

CPU: 0 UID: 0 PID: 5588 Comm: syz.5.143 Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391
 ecryptfs_write_tag_70_packet+0xea0/0xedc fs/ecryptfs/keystore.c:742
 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline]
 ecryptfs_encrypt_and_encode_filename+0x3e8/0x7ac fs/ecryptfs/crypto.c:1789
 ecryptfs_lookup+0x19c/0x694 fs/ecryptfs/inode.c:402
 __lookup_slow+0x1e4/0x2b4 fs/namei.c:1919
 lookup_slow+0x60/0x84 fs/namei.c:1936
 walk_component fs/namei.c:2282 [inline]
 lookup_last fs/namei.c:2789 [inline]
 path_lookupat+0x358/0x798 fs/namei.c:2813
 filename_lookup+0x1d0/0x3c8 fs/namei.c:2842
 vfs_statx+0xf0/0x1d8 fs/stat.c:353
 vfs_fstatat+0xa4/0xd0 fs/stat.c:373
 __do_sys_newfstatat fs/stat.c:538 [inline]
 __se_sys_newfstatat fs/stat.c:532 [inline]
 __arm64_sys_newfstatat+0x134/0x1c8 fs/stat.c:532
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

Allocated by task 4717:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f4/0x5fc mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ____ip_mc_inc_group+0x550/0xd64 net/ipv4/igmp.c:1601
 __ip_mc_inc_group net/ipv4/igmp.c:1639 [inline]
 ip_mc_inc_group net/ipv4/igmp.c:1645 [inline]
 ip_mc_up+0x100/0x31c net/ipv4/igmp.c:1950
 inetdev_event+0xb6c/0x1184 net/ipv4/devinet.c:1630
 notifier_call_chain+0x1a4/0x4cc kernel/notifier.c:85
 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
 call_netdevice_notifiers_info+0xb8/0x120 net/core/dev.c:2275
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 __dev_notify_flags+0x288/0x438 net/core/dev.c:9896
 netif_change_flags+0xd0/0x15c net/core/dev.c:9925
 do_setlink+0xc28/0x31e8 net/core/rtnetlink.c:3271
 rtnl_changelink net/core/rtnetlink.c:3910 [inline]
 __rtnl_newlink net/core/rtnetlink.c:4081 [inline]
 rtnl_newlink+0xf44/0x138c net/core/rtnetlink.c:4220
 rtnetlink_rcv_msg+0x66c/0x9bc net/core/rtnetlink.c:7137
 netlink_rcv_skb+0x238/0x414 net/netlink/af_netlink.c:2575
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:7164
 netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
 netlink_unicast+0x600/0x7f8 net/netlink/af_netlink.c:1364
 netlink_sendmsg+0x648/0x948 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg+0xc8/0x17c net/socket.c:815
 __sys_sendto+0x250/0x328 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __arm64_sys_sendto+0xec/0x10c net/socket.c:2284
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

Freed by task 15:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 __rcu_free_sheaf_prepare+0x130/0x2b4 mm/slub.c:3009
 rcu_free_sheaf+0x28/0xd8 mm/slub.c:6061
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x790/0xfbc kernel/rcu/tree.c:2919
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2936
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 run_ksoftirqd+0x70/0xbc kernel/softirq.c:1099
 smpboot_thread_fn+0x4e4/0x97c kernel/smpboot.c:160
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854

The buggy address belongs to the object at ffff0000c497e200
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 152 bytes inside of
 freed 256-byte region [ffff0000c497e200, ffff0000c497e300)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10497e
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 05ffc00000000001 fffffdffc3125f81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000c497e180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000c497e200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000c497e280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff0000c497e300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000c497e380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
netlink: 32 bytes leftover after parsing attributes in process `syz.5.143'.