==================================================================
BUG: KASAN: slab-out-of-bounds in strcpy+0x9e/0xb0 lib/string.c:91
Write of size 1 at addr ffff8801b772900b by task syz-executor1/6984

CPU: 0 PID: 6984 Comm: syz-executor1 Not tainted 4.9.122-g54068d6 #78
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801b77ef4c8 ffffffff81eb8829 ffffea0006ddca00 ffff8801b772900b
 0000000000000001 ffff8801b772900b dffffc0000000000 ffff8801b77ef500
 ffffffff8156b6be ffff8801b772900b 0000000000000001 0000000000000001
Call Trace:
 [<ffffffff81eb8829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb8829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8156b6be>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff8156bac8>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff8156bac8>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153f347>] __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435
 [<ffffffff81ed4eee>] strcpy+0x9e/0xb0 lib/string.c:91
 [<ffffffff81d0d927>] selinux_sb_copy_data+0x207/0x380 security/selinux/hooks.c:2680
 [<ffffffff81cef45b>] security_sb_copy_data+0x7b/0xb0 security/security.c:283
 [<ffffffff8197fa86>] parse_security_options+0x36/0x90 fs/btrfs/super.c:1493
 [<ffffffff81990ab3>] btrfs_mount+0x2f3/0x2bc0 fs/btrfs/super.c:1572
 [<ffffffff81581d9c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815e1681>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
 [<ffffffff815e19c0>] vfs_kern_mount+0x40/0x60 fs/namespace.c:982
 [<ffffffff81990bcb>] mount_subvol fs/btrfs/super.c:1395 [inline]
 [<ffffffff81990bcb>] btrfs_mount+0x40b/0x2bc0 fs/btrfs/super.c:1566
 [<ffffffff81581d9c>] mount_fs+0x28c/0x370 fs/super.c:1206
 [<ffffffff815e1681>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
 [<ffffffff815e8ea9>] vfs_kern_mount fs/namespace.c:982 [inline]
 [<ffffffff815e8ea9>] do_new_mount fs/namespace.c:2537 [inline]
 [<ffffffff815e8ea9>] do_mount+0x3c9/0x2740 fs/namespace.c:2859
 [<ffffffff815ebbfe>] SYSC_mount fs/namespace.c:3075 [inline]
 [<ffffffff815ebbfe>] SyS_mount+0xfe/0x110 fs/namespace.c:3052
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff83a00cd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 6984:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 __kmalloc+0x11d/0x300 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 setup_root_args fs/btrfs/super.c:1358 [inline]
 mount_subvol fs/btrfs/super.c:1389 [inline]
 btrfs_mount+0x1c6/0x2bc0 fs/btrfs/super.c:1566
 mount_fs+0x28c/0x370 fs/super.c:1206
 vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
 vfs_kern_mount fs/namespace.c:982 [inline]
 do_new_mount fs/namespace.c:2537 [inline]
 do_mount+0x3c9/0x2740 fs/namespace.c:2859
 SYSC_mount fs/namespace.c:3075 [inline]
 SyS_mount+0xfe/0x110 fs/namespace.c:3052
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801b7728000
 which belongs to the cache kmalloc-8192 of size 8192
The buggy address is located 4107 bytes inside of
 8192-byte region [ffff8801b7728000, ffff8801b772a000)
The buggy address belongs to the page:
page:ffffea0006ddca00 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801b7728f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801b7728f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801b7729000: 00 03 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff8801b7729080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801b7729100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================