Extracting prog: 28.32273426s Minimizing prog: 22m41.07066734s Simplifying prog options: 0s Extracting C: 24.578174186s Simplifying C: 6m45.290419128s extracting reproducer from 38 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun-openat-write detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) r8 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) write(r8, &(0x7f00000005c0)="1f0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f", 0x8014) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet single: successfully extracted reproducer found reproducer with 26 syscalls minimizing guilty program testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-write$tun detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) write$tun(0xffffffffffffffff, &(0x7f0000000c00)={@val={0x8, 0x800}, @val={0x7, 0x0, 0x0, 0x0, 0x16}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1b, 0xfc0, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x16}}, {0x4e24, 0x4e20, 0xfac, 0x0, @gue={{0x2, 0x0, 0x1, 0xa, 0x100, @val=0x80}, "db61c3e61e153b3cba6a2b9ccd973a55baebe0cc6c880fbf3255007bd80c3a7f2347e6154e6baa4586c2fd4d56caf6f7dda6f46e474eb90a5d2988cf92177ec15f1e043502d9986e4362deaeac47a4dc83c01a409532fd775e0dd5961e94ac1a914d7a77fe2e06150c22004a04942846d769b476d1a6f8585a8a4466120924dde2a5f576cbcc79723603ffd32fd11791dabbc41a02879a6cb6a9212d41ec618a98a5e28cf9d29799754d718bbb5a3d53cbc361906c0b8ce78b8750bbeffb3197c3d92e1fa1c25309b26430990a44224fcffc44ba66e3ecd4d391974e206bb674a85cb04fa995ae05e466cfb42b52aa2942d5016fd5b065ed1d35c9f095b22f7634bd50d3c9328b995f65925a37b1676720eb7cf3534ca26eae5b99c9354444fc10290a0b8cd982d8ceb5ff4c2d90059150190403c2dd5dcdc7bb17cb800515ff4b3c17b7e9ec18856cf5597ebc626ac392872b232bee4348172a27022e8ce77bd2593bcc48c3f832beea34be9f4755885b95de063d39548fb206ae3c0e1bff802f24d1e5d077201d598941f496db64514ad428eea5290f8687809a685ac69997341b74c47b93d7f31325ec70ddcc44e32ddbd56a5bf76584ac37bb2be158a64962ca5cf48f4b2de95935ad81d3db40f4c4c8278eb855233b15168949cfd0b9ae5235431b4df56e6925dbfaf8605063a8d48f21598454de6529c48c66adab559b0bb270bc7cd3ce360617873f62040a4fc8b5b866e37f09fc25b85b06a194b6dc53566deb592423e6e9ff8de160931fa6cb603973b75e2a97a01ff9b6e44a647365ed4f9d76c30f862ca6b8cfad3833e6b316bed36c60998e70b644b3b7caf24525556d4a39672afeb242c7f49a68e2a167b325a85557822a88be660ccadac778d042ab2c72e87eda52af5305060413dc26249218338a827d46e258d30c159cc36f4e092bc83d9753e9662e46afffa21c584e5c09f6780b3600e8bc0a058ae7d530a853d398620d72a7ac82c0c0099f7eb217412e9a87a488749d9cbf8bf7b8239ab93ff35a32c85a3e15eab81be762936a164f45a3e762251247083ce4c1dbfb4db61b1b2b1cee53b29a4f48c0eaff215f6d42dcc809bb5abd56d3773a949bce28f6d55a283788bc615652664bc3e385d89810d4ce46f9f778814ead4c1608c8037cafe30866640efe6fd424098f73a749665c244ddbb12dbbf5964d81dcae68a403e98706f7faf8f402107b641e321330a149c197dbd6d85a4c0cfc39df65f3ca71beb281d72f51e0880b939dd06b1792d5456d09d0b54696697ad40a1c045e183edc7c044b0fee739f60143676d92e4b9b7235190b86af7d11685cd3967a7576941ba4ccefabc92035a65b525a12426b0faf910decf2bf7856e890dbbf8acfa283fc11a6baa4fd11b692329aef4903f8c2a8e41c69b950dbd97d447eb57f96afdedacbd97bdb754bfeb8e60828a409d72320761391a19a8b6ec631a0673461ebbc61d227f6f214906bd8a7527b895f9650848daf4c729ed2eaa02236047235ba1bb35ec93db01ed27379aefeafbfdc5724d53438e6cb8dd28bd681d05f2b7f59b923d9f71c12b7454234f8518c2b771e5c69cc0610f420b15008b1101bfa85699e8da3e5bbc2bfd8e82d6d905885305404e47611ac6fcf71d93fefde0244d004e172bc311956e2ec4e39280d3e03b774d71148dd9eda7fa4b85218df29bbfe84b9e6ab9d440939f2440603c5b638e1289b3c70fc4f193488864271351ad2e284163b21798bc7446ecc5bef95ef9cb1f3359c2f9c2838ebe06a899e4837b3b95202ee7022b4bca2b609202d4321d2d7e50ce8d044e4b1dc5e0709bd70f0fdd5b12af7b8d8200348460d2e863b3fe6e7782deafc59cb7e67b22c2a639f0b9f2319d643dfc078a7b1b3bda3bb099898dc4b0a6156462c63c266dbaf5d6fd9ab0d92733f005126397e2822d3976ccf808aec9c96ebe3b277d00e18b96f8ced5a546ef3b692038ecc557603b65475f4a0d31d7a725be9dfb23b4026957a84982188ac04e8ecdc75ba6e3f45fe497e52a98e376105bf98e34711d7829cba04bca6a7ba5e5e1840d896ce82b533b736123deca0ce7a7d86731c6485ff413fe22aa90253e64ebe482ba0fabd931ae041a13164b7ca8445f12ed15daee9a1660b994db4efd0b2a07bab16ac8a417fc0152166ff54c437077ba8643ab31f66f4c4be97486c00b0b4bff0add21204635c17833268e460bc04a5cadf7c9f2f9d0a46c50e886b743f90b7fec9901d445fc553e80f97e6c1ba604979c8828b31012271892e48bb26d53ad222a2aec11ec2b88514e28230b3ea5291f3c1c4ecee5374ffa0306c474d6ebde1d6c7073be6bf0ceb154df1a4f38166df762c9f401625ec58e7295befd1d93c989afd85aebad59429447479ac823820d2a8028cf916c7cfa8a9d102485a3bfddcaa9a8c540c7bee473033c504242b652834f9471e8b6744d23197a68b2d7160384933f54cb36dd198675bfe07375c5f6ab8fb11d4fc82f8e2867236462a87b65f4711beace711afa40f51c28c0119903e552bbb64dd595fe9d120eab83a6fd54b85e1567fb9222baafca0bfe4a871ad04d924355954769976ea65b77f2081358f6c0f4e49fa1e32f9e27602be07a3dbb8efe9aafba7e3a7fc06a16199d432dc14061b7e8cab5e454444611454a3f7191f83fe00b6cbdb33a883ea93ad286bc373953c08d21b758eb4e588a9993149c889603d793366495f188a3966c7e8d242de8628e05ce3d22f85f1c4756650272068fb5c63615e17446dd55107ecec828a470c262bafccad339e2834bd9fde451eb0537ba8a50d7c08dba284a2b9bab72ff4f58a6f4bd5dfdc387305b521fd895b3feb84741be22df169b9ef0802ef2439d424263b57d245014a8b14a9974cea2099a759e94048a2166b4bb60b20ea195968d524ad7198958f7126bec0b833b8f54968e96756c0f9045654fff3a63266b9d8a5d4e2c97335b73aa84f1d820466726461cabd38eb612acc479765d370a81f86cf9c74eb7a67f9c86306f625d1dcae857940cf9ef2a02204db8ccd140557b609cd5510051927f3b6dbeccff4692c118e5312db376f26bb53c36df31dd8c101c653f15abe922b9d472721202882481bbba609b3115e0644b9b3397f9c3b8bf9420baa1e8124179d59505882bad73f147d08d1131a0241add4cf947b0b0e9c27f4775ab68f641a671e299329953b2196a62194ca8670c138c461cff486fb3921f53c71332ef0765736de339c8a3b10f7e1d7b11f521ea1eeaa1b8e5c03d249c6cb3433aef5bc36e9469f10bb304c50428e611d4338d8dc68c108cd49ee2a93f13f7c5d361ac391916cb152062b0291d171d4b6a8df4c6b173eadde95470abac6ba751f76a44a9a05391d092366ec00e774b28b005144d951cae84dbf3194a6283367d0c089c11e4a1fa49a717586b25c902e03ae657bb29edd1c936bf0759ebc7d9da25bd656a21f9ec9c62cfbc1b37af0b0fdec02a13928a3e988bbf45a5f5d22d725955f70a34a881ac78e229355aa7d410c60e95d57c02044e405aa269ab2aab910a32f8f91f5925c782dac55d7258832f18e1dd9c432f257905b11677dff1dce01f0ae59a0472988d73545ae1ca21d52a0d2914635e42c87e520890dc55803080260ecff524016dfd92d3a49f1fa1a46ddd8bb72c4128bca41c975e77b443718d1681817b514dcc6beef467785d2dcc3f1791847b5fb4a5cb954f64f3c66f598100e7a254db6a2525775e1322a546d145e60be46600650f0292a0e804669bd995ffd98e6d44a7888a906f2e98af0911dce268082c6749e1e9740a3dc3f8b016411cc229a33ed462d39156f56e8031d475ada4637806f67352f999ca3e03a4a8d24e967699a028baadfad8cd108e5d663a6c487ff93a82515e7dc937a495e77d352127a11500d9c0c13d86ed7372906bc954813554be4b9005096066e569e79798caf2049760b591477b8de5a8338a62682134fb49d59fa63077371d0a85faec87022f7a9e38f34840aa0f7c8224360d51c1d632dad2610ab5ae43cd671e57275fd6c3dd6dae23b1ff3d704977d2165cce257d9da4f7a76abba44eb80997a0f4ef71f6a8e9eebd97df9448f07461e3da7b7622c1c13f8d131ae5b482bf8f588a1c2541cf52fa6a561ab59765ec2d4cadadc98d5754f955345d1973185dac96def53e8ea12133225f025c34334adb15fb80cf0188eb2729a24c3811f2a1da3783dbdff25e13cba8c705895859c8b55ecd68d752d40ba65ebd969104133fa3c4ca6232f85a64ab24cc0865d6246d6da8d7b82b88d2cb02e292f78034e0d93b5c6a8186b9fb675e9ae7f2c4b57b9e9474e77668f5159711af5e1cf6c133db8a50fccbbe283f3ff2574c2f12a07c67b25a0ba295a7f4e6a04d31989b5c7927bcdfc71794cadf4233f8388d9073913fcf91763031a450108cc3acb7a053f82979af066bd90b17a2179024ee100f20723b7ccb0218965a072cb73be9d8251555f4a264007a3627e5d2ad7aa5fe9a43926133b657a7ec6e107bb71e72b2140f1a2faec9c43f5b08b892b5c1135180fb658b78d5e686b30a00d5e8fdf451b127f9ba3496fc68715654455c4f19aa5b34a7e8bb7d79e7c4585e78dabb69b6715cb0648ee4cd3265c018b33ed94e05bfacc248b5a1bcda4b14b1ae8d0e401293aa2d1d73e9e47a452c119f65b6345e85a3710b1fd21825fa22025dc1ede18c8ef37f333d47260cdf8ec5cfdc4d58f5c3e1c228e08b69043e2179b253a5c9f85a45125f3f9f3cca36bd05b0610e6f2f88cffbb818a92ba8ca2f8d8dc3fd41edf758fb17673a4132363bc0d61e1b1845960c2ba3dc172790c454ed31cdc0ac252d09b67d27f3dd21832492fa74f7e5f954b7498c01f435d6ad10fa56dd6318f9bc0161f988839d2b854a1c442da65be30b9be1308c6cff31dcfff0600d717562099a8316805847dd3facf8be6dc8823d422599dd84a01d1f2a4295d1686734ce2d0ac3f062c7a2bbb71752c8cef570f12c5d8a0d023cae4a99cac97df78bf2c11e1d595917aae04b8b6c47e40d9f5a7445ee754318f4b8e5f320533b41b1ee4641277da89efbb20a840dfdab24d77739e657a8de00962e88e0eb35147d72ee6d09038596f352ce515e92cc9e7e5c0b902cb7b2bb26e7bab5acf1bfe853589ea400620b48129a2fd594317e2875b6c1f76985fd6ffedd934647dd5d60243b11e97961868ca0a7c54fdff447447dfcd34c9194cc0078da89752669c4d02c0d9332627c641953198900a5ef54e29f6af39c8aebd0f37fb8b5418b95c6dfe0e556afeb25059036e8360a497f179094eb8174828bd5ffd18260de3736c9affa5790a752982a4c41852a53371015435c0e55df11cf6bf7b6ca7f8f29c78319e741a79500468d28c6c66bf943425d7f4f0aed83bc83a8c23efe31a3458c4220d1f1e11bac4f98b9ea156d2a4c5765af8a6b5c498ae900292618d37662e276c8668e9df896a6cc37b2cdc89459099e63fdbb789e09db5c4b48a03d0966103159acbe6eaf4a49d526a50b620fe1ce9125ae87a71447817d1b1a2ac029f7968f4006574350eae8c92aa724ea62c51d9d39bd8d20e5cb4b9a771809ac036149a69af"}}}}, 0xfce) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-io_getevents-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) io_getevents(r7, 0x1, 0x1, &(0x7f0000000000)=[{}], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-io_submit-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) r6 = eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)=0x0) io_submit(r7, 0x1, &(0x7f0000000440)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x1fd, r6, 0x0, 0x0, 0x8, 0x0, 0x1, r6}]) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in ecryptfs_from_hex testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-io_setup-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) eventfd2(0x0, 0x0) io_setup(0x8, &(0x7f0000000400)) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-eventfd2-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) eventfd2(0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-memfd_create-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) memfd_create(&(0x7f0000000100)='),),\x00', 0x4) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-ioctl$TUNSETIFF-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-setsockopt$IPT_SO_SET_REPLACE-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) r4 = dup(r3) syz_ublk_setup_queues(r4, r2, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r5 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r5, 0x4) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, 0x0}, 0x20) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000a80)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x1f0, 0x288, 0x320, 0x3b8, 0x158, 0x1f0, 0x288, 0x320, 0x3b8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffffffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffffffffffe}}}}, 0x3f0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-bpf$MAP_DELETE_ELEM-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r4 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r4, 0x4) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, 0x0}, 0x20) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-setsockopt$IPT_SO_SET_REPLACE-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r3 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r3, 0x4) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000680)=@security={'security\x00', 0xe, 0x4, 0x2f8, 0xffffffff, 0xd0, 0x0, 0xd0, 0xffffffff, 0xffffffff, 0x260, 0x260, 0x260, 0xffffffff, 0x4, &(0x7f0000000140), {[{{@uncond, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0xcb, 0xa, [0x1, 0x6, 0x1a, 0x32, 0x0, 0x1e, 0x3f, 0x3e, 0x3e, 0x36, 0x34, 0x1d, 0x17, 0x1f, 0x3a, 0x29], 0x2, 0x9, 0x4}}}, {{@ip={@multicast2, @empty, 0x0, 0xffffff, 'virt_wifi0\x00', 'pimreg1\x00', {0xff}, {}, 0x37, 0x2, 0x1}, 0x0, 0x90, 0xc0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x2, 0x8, 0x8, 0x1}}}, {{@ip={@rand_addr=0x64010102, @remote, 0xffffff00, 0xff, 'gre0\x00', 'veth0_to_team\x00', {}, {}, 0x6c, 0x3, 0x5}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @local, 0x6, 0xf, [0x3a, 0x12, 0x1c, 0x10, 0x1b, 0x3c, 0x11, 0xd, 0x16, 0x3b, 0x39, 0x3a, 0x3e, 0x2f, 0x27, 0x40], 0x1, 0x71, 0x7fffffff}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x358) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-fchmod-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') r3 = open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) fchmod(r3, 0x4) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-open-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') open(&(0x7f00000001c0)='./mnt\x00', 0x8000, 0x129) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mkdirat-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./mnt\x00', 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-getsockopt$TIPC_DEST_DROPPABLE-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-syz_ublk_setup_queues-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) syz_ublk_setup_queues(r2, r0, &(0x7f0000000180)={0x0, 0x9436, 0x0, 0x1, 0x1fb}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe704, 0x80, 0x1000002, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x5c86, 0x20, 0x3, 0x3a7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x1f71, 0x2, 0x40040001, 0x313}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4, 0x200, 0x1, 0xffffffff}}], 0x1, 0x0, 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-dup-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-socket$inet6_tcp-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-syz_ublk_add_dev-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000440)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-bpf$MAP_CREATE-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="170000000000000004000000ff"], 0x48) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-socket$inet_udp-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-mount-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) mount(&(0x7f0000000080)=@filename='mtd0\x00', &(0x7f00000000c0)='./mnt\x00', &(0x7f0000000000)='jffs2\x00', 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, 0x0, 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, &(0x7f00000000c0)) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), 0x0) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffd) mount(&(0x7f0000000400), &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(0x0, &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', 0x0, &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', 0x0, 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, 0x0, 0x101042, 0x9d) program did not crash extracting C reproducer testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block simplifying C reproducer testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program did not crash testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat program crashed: KASAN: slab-out-of-bounds Read in md5_block testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-use-after-free Read in ecryptfs_write_tag_70_packet validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block validation run: crashed=true testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program did not crash validation run: crashed=false testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-getsockopt$TIPC_DEST_DROPPABLE-add_key$user-mount-openat detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) getsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) mount(&(0x7f0000000400)=@filename='\x00', &(0x7f0000000000)='./mnt\x00', &(0x7f0000000480)='ecryptfs\x00', 0x0, &(0x7f0000000500)='ecryptfs_sig=syz,ecryptfs_fnek_sig=syz,ecryptfs_cipher=aes,ecryptfs_key_bytes=16\x00') openat(0xffffffffffffff9c, &(0x7f0000000580)='./mnt/fillfile\x00', 0x101042, 0x9d) program crashed: KASAN: slab-out-of-bounds Read in md5_block validation run: crashed=true reproducing took 32m51.44840924s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in md5_block+0x95/0x8d0 lib/crypto/md5.c:40 Read of size 64 at addr ffff8880368ab4e0 by task syz.0.17/5920 CPU: 2 UID: 0 PID: 5920 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 md5_block+0x95/0x8d0 lib/crypto/md5.c:40 md5_blocks lib/crypto/md5.c:126 [inline] md5_update+0xf7/0x210 lib/crypto/md5.c:161 md5+0xc7/0x120 lib/crypto/md5.c:202 ecryptfs_write_tag_70_packet+0x880/0x1410 fs/ecryptfs/keystore.c:741 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline] ecryptfs_encrypt_and_encode_filename+0x428/0xa60 fs/ecryptfs/crypto.c:1789 ecryptfs_lookup+0x1f7/0x830 fs/ecryptfs/inode.c:402 lookup_open+0xa79/0x1990 fs/namei.c:4528 open_last_lookups fs/namei.c:4767 [inline] path_openat+0xa2c/0x2440 fs/namei.c:4997 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f272ab9e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc040e72d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f272ae25fa0 RCX: 00007f272ab9e199 RDX: 0000000000101042 RSI: 0000200000000580 RDI: ffffffffffffff9c RBP: 00007f272ac358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000009d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f272ae25fac R14: 00007f272ae25fa0 R15: 00007f272ae25fa0 Allocated by task 5920: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_flags_noprof+0x370/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] __alloc_empty_sheaf mm/slub.c:2822 [inline] alloc_empty_sheaf mm/slub.c:2842 [inline] __pcs_replace_empty_main+0x3fa/0x650 mm/slub.c:4769 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010 key_alloc+0x3c5/0x1310 security/keys/key.c:277 keyring_alloc+0x44/0xc0 security/keys/keyring.c:528 install_session_keyring_to_cred+0x190/0x230 security/keys/process_keys.c:330 join_session_keyring+0x1bc/0x350 security/keys/process_keys.c:851 lookup_user_key+0xbf9/0x1300 security/keys/process_keys.c:674 __do_sys_add_key+0x2a6/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880368ab400 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 224 bytes inside of allocated 256-byte region [ffff8880368ab400, ffff8880368ab500) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x368aa head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5808, tgid 5808 (syz-executor), ts 51117923184 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_flags_noprof+0x6a9/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline] slab_post_alloc_hook mm/slub.c:4702 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kvmalloc_node_noprof+0x750/0x9b0 mm/slub.c:7015 simple_xattr_alloc+0x6c/0xd0 fs/xattr.c:1271 class_simple_xattr_constructor include/linux/xattr.h:166 [inline] shmem_initxattrs+0x16a/0x650 mm/shmem.c:4228 security_inode_init_security+0x242/0x370 security/security.c:1370 shmem_symlink+0x163/0xbf0 mm/shmem.c:4071 vfs_symlink fs/namei.c:5794 [inline] vfs_symlink+0x178/0x4d0 fs/namei.c:5773 filename_symlinkat+0x2a6/0x560 fs/namei.c:5819 page last free pid 5099 tgid 5099 ts 50790925463 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x278/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:663 [inline] netdevice_event+0x308/0x9a0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x7c/0xb0 net/core/dev.c:2327 vlan_dev_inherit_address net/8021q/vlan_dev.c:264 [inline] vlan_dev_inherit_address net/8021q/vlan_dev.c:257 [inline] vlan_dev_open+0x542/0x6d0 net/8021q/vlan_dev.c:282 __dev_open+0x3ad/0x8f0 net/core/dev.c:1724 __dev_change_flags+0x596/0x850 net/core/dev.c:9855 netif_change_flags+0x8d/0x160 net/core/dev.c:9920 vlan_dev_work+0x58d/0x5e0 net/8021q/vlan_dev.c:1040 netdev_work_run net/core/netdev_work.c:127 [inline] netdev_work_proc+0x5e9/0x880 net/core/netdev_work.c:171 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 Memory state around the buggy address: ffff8880368ab400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880368ab480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880368ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880368ab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880368ab600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-out-of-bounds in md5_block+0x95/0x8d0 lib/crypto/md5.c:40 Read of size 64 at addr ffff8880368ab4e0 by task syz.0.17/5920 CPU: 2 UID: 0 PID: 5920 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 md5_block+0x95/0x8d0 lib/crypto/md5.c:40 md5_blocks lib/crypto/md5.c:126 [inline] md5_update+0xf7/0x210 lib/crypto/md5.c:161 md5+0xc7/0x120 lib/crypto/md5.c:202 ecryptfs_write_tag_70_packet+0x880/0x1410 fs/ecryptfs/keystore.c:741 ecryptfs_encrypt_filename fs/ecryptfs/crypto.c:1378 [inline] ecryptfs_encrypt_and_encode_filename+0x428/0xa60 fs/ecryptfs/crypto.c:1789 ecryptfs_lookup+0x1f7/0x830 fs/ecryptfs/inode.c:402 lookup_open+0xa79/0x1990 fs/namei.c:4528 open_last_lookups fs/namei.c:4767 [inline] path_openat+0xa2c/0x2440 fs/namei.c:4997 do_file_open+0x20e/0x430 fs/namei.c:5029 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f272ab9e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc040e72d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f272ae25fa0 RCX: 00007f272ab9e199 RDX: 0000000000101042 RSI: 0000200000000580 RDI: ffffffffffffff9c RBP: 00007f272ac358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000009d R11: 0000000000000246 R12: 0000000000000000 R13: 00007f272ae25fac R14: 00007f272ae25fa0 R15: 00007f272ae25fa0 Allocated by task 5920: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_flags_noprof+0x370/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] __alloc_empty_sheaf mm/slub.c:2822 [inline] alloc_empty_sheaf mm/slub.c:2842 [inline] __pcs_replace_empty_main+0x3fa/0x650 mm/slub.c:4769 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010 key_alloc+0x3c5/0x1310 security/keys/key.c:277 keyring_alloc+0x44/0xc0 security/keys/keyring.c:528 install_session_keyring_to_cred+0x190/0x230 security/keys/process_keys.c:330 join_session_keyring+0x1bc/0x350 security/keys/process_keys.c:851 lookup_user_key+0xbf9/0x1300 security/keys/process_keys.c:674 __do_sys_add_key+0x2a6/0x460 security/keys/keyctl.c:126 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880368ab400 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 224 bytes inside of allocated 256-byte region [ffff8880368ab400, ffff8880368ab500) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x368aa head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5808, tgid 5808 (syz-executor), ts 51117923184 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7418 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_flags_noprof+0x6a9/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline] slab_post_alloc_hook mm/slub.c:4702 [inline] slab_alloc_node mm/slub.c:4996 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kvmalloc_node_noprof+0x750/0x9b0 mm/slub.c:7015 simple_xattr_alloc+0x6c/0xd0 fs/xattr.c:1271 class_simple_xattr_constructor include/linux/xattr.h:166 [inline] shmem_initxattrs+0x16a/0x650 mm/shmem.c:4228 security_inode_init_security+0x242/0x370 security/security.c:1370 shmem_symlink+0x163/0xbf0 mm/shmem.c:4071 vfs_symlink fs/namei.c:5794 [inline] vfs_symlink+0x178/0x4d0 fs/namei.c:5773 filename_symlinkat+0x2a6/0x560 fs/namei.c:5819 page last free pid 5099 tgid 5099 ts 50790925463 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:361 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x278/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:663 [inline] netdevice_event+0x308/0x9a0 drivers/infiniband/core/roce_gid_mgmt.c:822 notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline] call_netdevice_notifiers+0x7c/0xb0 net/core/dev.c:2327 vlan_dev_inherit_address net/8021q/vlan_dev.c:264 [inline] vlan_dev_inherit_address net/8021q/vlan_dev.c:257 [inline] vlan_dev_open+0x542/0x6d0 net/8021q/vlan_dev.c:282 __dev_open+0x3ad/0x8f0 net/core/dev.c:1724 __dev_change_flags+0x596/0x850 net/core/dev.c:9855 netif_change_flags+0x8d/0x160 net/core/dev.c:9920 vlan_dev_work+0x58d/0x5e0 net/8021q/vlan_dev.c:1040 netdev_work_run net/core/netdev_work.c:127 [inline] netdev_work_proc+0x5e9/0x880 net/core/netdev_work.c:171 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 Memory state around the buggy address: ffff8880368ab400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880368ab480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880368ab500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880368ab580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880368ab600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================