==================================================================
BUG: KASAN: slab-out-of-bounds in ecryptfs_verify_auth_tok_from_key+0x324/0x360 fs/ecryptfs/keystore.c:465
Read of size 2 at addr ffff0000f2258e99 by task syz.6.875/8361

CPU: 0 UID: 0 PID: 8361 Comm: syz.6.875 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xb0/0x238 mm/kasan/report.c:378
 print_report+0x68/0x84 mm/kasan/report.c:482
 kasan_report+0x8c/0xc4 mm/kasan/report.c:595
 __asan_report_load_n_noabort+0x1c/0x28 mm/kasan/report_generic.c:391
 ecryptfs_verify_auth_tok_from_key+0x324/0x360 fs/ecryptfs/keystore.c:465
 ecryptfs_keyring_auth_tok_for_sig+0xe8/0x1a0 fs/ecryptfs/keystore.c:1606
 ecryptfs_init_global_auth_toks fs/ecryptfs/main.c:194 [inline]
 ecryptfs_validate_options fs/ecryptfs/main.c:420 [inline]
 ecryptfs_get_tree+0x478/0x1044 fs/ecryptfs/main.c:453
 vfs_get_tree+0x90/0x28c fs/super.c:1933
 fc_mount+0x24/0xac fs/namespace.c:1198
 do_new_mount_fc fs/namespace.c:3772 [inline]
 do_new_mount+0x2a4/0x538 fs/namespace.c:3848
 path_mount+0x5f0/0xa88 fs/namespace.c:4168
 do_mount+0xe8/0x148 fs/namespace.c:4181
 __do_sys_mount fs/namespace.c:4397 [inline]
 __se_sys_mount fs/namespace.c:4374 [inline]
 __arm64_sys_mount+0x33c/0x388 fs/namespace.c:4374
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

Allocated by task 6608:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:78
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:570
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_noprof+0x34c/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 user_preparse+0x94/0x160 security/keys/user_defined.c:67
 __key_create_or_update+0x2a4/0x848 security/keys/key.c:857
 key_create_or_update+0x60/0x7c security/keys/key.c:1021
 __do_sys_add_key security/keys/keyctl.c:134 [inline]
 __se_sys_add_key security/keys/keyctl.c:74 [inline]
 __arm64_sys_add_key+0x384/0x43c security/keys/keyctl.c:74
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

The buggy address belongs to the object at ffff0000f2258e80
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes to the right of
 allocated 25-byte region [ffff0000f2258e80, ffff0000f2258e99)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000f2258040 pfn:0x132258
flags: 0x5ffc00000000200(workingset|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000200 ffff0000c0001780 fffffdffc3c8dc50 fffffdffc3751410
raw: ffff0000f2258040 000000000040003c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f2258d80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff0000f2258e00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
>ffff0000f2258e80: 00 00 00 01 fc fc fc fc fa fb fb fb fc fc fc fc
                            ^
 ffff0000f2258f00: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
 ffff0000f2258f80: fa fb fb fb fc fc fc fc fa fb fb fb fc fc fc fc
==================================================================
ecryptfs_verify_version: Minor version number mismatch. Expected [4]; got [197]
Data structure version mismatch. Userspace tools must match eCryptfs kernel module with major version [0] and minor version [4]
Could not find valid key in user session keyring for sig specified in mount option: [syz0]
One or more global auth toks could not properly register; rc = [-22]
Error validating options; rc = [-22]