KASAN: slab-out-of-bounds Write in selinux_sb_copy_data

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 54068d61 Merge 4.9.122 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=12e63316400000
kernel config: https://syzkaller.appspot.com/x/.config?x=c7451be69185755b
dashboard link: https://syzkaller.appspot.com/bug?extid=18c267e8c27e211344f0
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1428326a400000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10c0001e400000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+18c267...@syzkaller.appspotmail.com

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
IPVS: Creating netns size=2536 id=1
==================================================================
BUG: KASAN: slab-out-of-bounds in strcpy+0x9e/0xb0 lib/string.c:91
Write of size 1 at addr ffff8801da3bd20b by task syz-executor501/3794

CPU: 0 PID: 3794 Comm: syz-executor501 Not tainted 4.9.122-g54068d6 #78
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
ffff8801b7aef4c8 ffffffff81eb8829 ffffea000768ee00 ffff8801da3bd20b
0000000000000001 ffff8801da3bd20b dffffc0000000000 ffff8801b7aef500
ffffffff8156b6be ffff8801da3bd20b 0000000000000001 0000000000000001
Call Trace:
[<ffffffff81eb8829>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81eb8829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff8156b6be>] print_address_description+0x6c/0x234
mm/kasan/report.c:256
[<ffffffff8156bac8>] kasan_report_error mm/kasan/report.c:355 [inline]
[<ffffffff8156bac8>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
[<ffffffff8153f347>] __asan_report_store1_noabort+0x17/0x20
mm/kasan/report.c:435
[<ffffffff81ed4eee>] strcpy+0x9e/0xb0 lib/string.c:91
[<ffffffff81d0d927>] selinux_sb_copy_data+0x207/0x380
security/selinux/hooks.c:2680
[<ffffffff81cef45b>] security_sb_copy_data+0x7b/0xb0
security/security.c:283
[<ffffffff8197fa86>] parse_security_options+0x36/0x90 fs/btrfs/super.c:1493
[<ffffffff81990ab3>] btrfs_mount+0x2f3/0x2bc0 fs/btrfs/super.c:1572
[<ffffffff81581d9c>] mount_fs+0x28c/0x370 fs/super.c:1206
[<ffffffff815e1681>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
[<ffffffff815e19c0>] vfs_kern_mount+0x40/0x60 fs/namespace.c:982
[<ffffffff81990bcb>] mount_subvol fs/btrfs/super.c:1395 [inline]
[<ffffffff81990bcb>] btrfs_mount+0x40b/0x2bc0 fs/btrfs/super.c:1566
[<ffffffff81581d9c>] mount_fs+0x28c/0x370 fs/super.c:1206
[<ffffffff815e1681>] vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
[<ffffffff815e8ea9>] vfs_kern_mount fs/namespace.c:982 [inline]
[<ffffffff815e8ea9>] do_new_mount fs/namespace.c:2537 [inline]
[<ffffffff815e8ea9>] do_mount+0x3c9/0x2740 fs/namespace.c:2859
[<ffffffff815ebbfe>] SYSC_mount fs/namespace.c:3075 [inline]
[<ffffffff815ebbfe>] SyS_mount+0xfe/0x110 fs/namespace.c:3052
[<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
[<ffffffff83a00cd3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 3794:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
save_stack+0x43/0xd0 mm/kasan/kasan.c:505
set_track mm/kasan/kasan.c:517 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
__kmalloc+0x11d/0x300 mm/slub.c:3741
kmalloc include/linux/slab.h:495 [inline]
setup_root_args fs/btrfs/super.c:1358 [inline]
mount_subvol fs/btrfs/super.c:1389 [inline]
btrfs_mount+0x1c6/0x2bc0 fs/btrfs/super.c:1566
mount_fs+0x28c/0x370 fs/super.c:1206
vfs_kern_mount.part.29+0xd1/0x3d0 fs/namespace.c:1000
vfs_kern_mount fs/namespace.c:982 [inline]
do_new_mount fs/namespace.c:2537 [inline]
do_mount+0x3c9/0x2740 fs/namespace.c:2859
SYSC_mount fs/namespace.c:3075 [inline]
SyS_mount+0xfe/0x110 fs/namespace.c:3052
do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801da3bc200
which belongs to the cache kmalloc-8192 of size 8192
The buggy address is located 4107 bytes inside of
8192-byte region [ffff8801da3bc200, ffff8801da3be200)
The buggy address belongs to the page:
page:ffffea000768ee00 count:1 mapcount:0 mapping: (null) index:0x0
compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801da3bd100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801da3bd180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> ffff8801da3bd200: 00 03 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8801da3bd280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801da3bd300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches