Extracting prog: 29.527495739s Minimizing prog: 24m50.200000957s Simplifying prog options: 0s Extracting C: 20.64823748s Simplifying C: 3m10.24871775s extracting reproducer from 38 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) r8 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) write(r8, &(0x7f00000005c0)="1f0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f", 0x8014) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet single: successfully extracted reproducer found reproducer with 26 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) eventfd2(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r4 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r4, 0x4) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, 0x0}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r3 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r3, 0x4) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_from_hex testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r3 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r3, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, &(0x7f00000000c0)) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', 0x0, &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', 0x0, 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, 0x0, 0x101042, 0x9d) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_from_hex testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_from_hex testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block validation run: crashed=true reproducing took 30m52.860610217s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in md5_block+0x95/0x8d0 lib/crypto/md5.c:40 Read of size 64 at addr ffff88803cd38ce0 by task syz.0.17/5918 CPU: 3 UID: 0 PID: 5918 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 md5_block+0x95/0x8d0 lib/crypto/md5.c:40 md5_blocks lib/crypto/md5.c:126 [inline] md5_update+0xf7/0x210 lib/crypto/md5.c:161 md5+0xc7/0x120 lib/crypto/md5.c:202 ecryptfs_write_tag_70_packet+0x880/0x1410 fs/ecryptfs/keystore.c:741 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline] ecryptfs_encrypt_and_encode_filename+0x428/0xa60 fs/ecryptfs/crypto.c:1789 ecryptfs_lookup+0x1f7/0x830 fs/ecryptfs/inode.c:402 lookup_open+0xa79/0x1990 fs/namei.c:4528 open_last_lookups fs/namei.c:4767 [inline] path_openat+0xa2c/0x2440 fs/namei.c:4997 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f360739e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4223f518 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f3607625fa0 RCX: 00007f360739e199 RDX: 0000000000101042 RSI: 0000200000000580 RDI: ffffffffffffff9c RBP: 00007f36074358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000009d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3607625fac R14: 00007f3607625fa0 R15: 00007f3607625fa0 Allocated by task 5918: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_flags_noprof+0x370/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline] slab_post_alloc_hook mm/slub.c:4702 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x653/0x840 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] lsm_blob_alloc+0x68/0x90 security/security.c:218 lsm_cred_alloc security/security.c:235 [inline] security_prepare_creds+0x2d/0x290 security/security.c:2866 prepare_creds+0x5d6/0x950 kernel/cred.c:215 join_session_keyring+0x17/0x350 security/keys/process_keys.c:844 lookup_user_key+0xbf9/0x1300 security/keys/process_keys.c:674 __do_sys_add_key+0x2a6/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88803cd38c00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 224 bytes inside of allocated 256-byte region [ffff88803cd38c00, ffff88803cd38d00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cd38 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5781, tgid 5781 (syz-executor), ts 52716855222 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] tc_action_net_init include/net/act_api.h:164 [inline] bpf_init_net+0x56/0x270 net/sched/act_bpf.c:434 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x118/0x3a0 net/core/net_namespace.c:443 copy_net_ns+0x345/0x7a0 net/core/net_namespace.c:582 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0xf2/0x220 kernel/nsproxy.c:234 ksys_unshare+0x4a2/0xa70 kernel/fork.c:3297 __do_sys_unshare kernel/fork.c:3361 [inline] __se_sys_unshare kernel/fork.c:3359 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3359 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 page last free pid 15 tgid 15 ts 52626345993 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 run_ksoftirqd kernel/softirq.c:1099 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1091 smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88803cd38c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88803cd38c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88803cd38d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88803cd38d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88803cd38e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in md5_block+0x95/0x8d0 lib/crypto/md5.c:40 Read of size 64 at addr ffff88803cd38ce0 by task syz.0.17/5918 CPU: 3 UID: 0 PID: 5918 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 md5_block+0x95/0x8d0 lib/crypto/md5.c:40 md5_blocks lib/crypto/md5.c:126 [inline] md5_update+0xf7/0x210 lib/crypto/md5.c:161 md5+0xc7/0x120 lib/crypto/md5.c:202 ecryptfs_write_tag_70_packet+0x880/0x1410 fs/ecryptfs/keystore.c:741 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline] ecryptfs_encrypt_and_encode_filename+0x428/0xa60 fs/ecryptfs/crypto.c:1789 ecryptfs_lookup+0x1f7/0x830 fs/ecryptfs/inode.c:402 lookup_open+0xa79/0x1990 fs/namei.c:4528 open_last_lookups fs/namei.c:4767 [inline] path_openat+0xa2c/0x2440 fs/namei.c:4997 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f360739e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4223f518 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f3607625fa0 RCX: 00007f360739e199 RDX: 0000000000101042 RSI: 0000200000000580 RDI: ffffffffffffff9c RBP: 00007f36074358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000009d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3607625fac R14: 00007f3607625fa0 R15: 00007f3607625fa0 Allocated by task 5918: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_flags_noprof+0x370/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline] slab_post_alloc_hook mm/slub.c:4702 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_noprof+0x653/0x840 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] lsm_blob_alloc+0x68/0x90 security/security.c:218 lsm_cred_alloc security/security.c:235 [inline] security_prepare_creds+0x2d/0x290 security/security.c:2866 prepare_creds+0x5d6/0x950 kernel/cred.c:215 join_session_keyring+0x17/0x350 security/keys/process_keys.c:844 lookup_user_key+0xbf9/0x1300 security/keys/process_keys.c:674 __do_sys_add_key+0x2a6/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88803cd38c00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 224 bytes inside of allocated 256-byte region [ffff88803cd38c00, ffff88803cd38d00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cd38 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5781, tgid 5781 (syz-executor), ts 52716855222 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] tc_action_net_init include/net/act_api.h:164 [inline] bpf_init_net+0x56/0x270 net/sched/act_bpf.c:434 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137 setup_net+0x118/0x3a0 net/core/net_namespace.c:443 copy_net_ns+0x345/0x7a0 net/core/net_namespace.c:582 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0xf2/0x220 kernel/nsproxy.c:234 ksys_unshare+0x4a2/0xa70 kernel/fork.c:3297 __do_sys_unshare kernel/fork.c:3361 [inline] __se_sys_unshare kernel/fork.c:3359 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3359 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 page last free pid 15 tgid 15 ts 52626345993 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 rcu_do_batch kernel/rcu/tree.c:2650 [inline] rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 run_ksoftirqd kernel/softirq.c:1099 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1091 smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff88803cd38c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88803cd38c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88803cd38d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88803cd38d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88803cd38e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================