[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   11.880358] audit: type=1400 audit(1514163096.628:6): avc:  denied  { map } for  pid=3132 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-3,10.128.0.51' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.067630] audit: type=1400 audit(1514163102.815:7): avc:  denied  { map } for  pid=3146 comm="syzkaller093494" path="/root/syzkaller093494482" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.073290] ==================================================================
[   18.073305] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.073310] Read of size 8 at addr ffff8801ca1c9db8 by task syzkaller093494/3146
[   18.073311] 
[   18.073319] CPU: 0 PID: 3146 Comm: syzkaller093494 Not tainted 4.15.0-rc4-mm1+ #49
[   18.073322] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.073324] Call Trace:
[   18.073333]  dump_stack+0x194/0x257
[   18.073340]  ? arch_local_irq_restore+0x53/0x53
[   18.073348]  ? show_regs_print_info+0x18/0x18
[   18.073353]  ? print_irqtrace_events+0x270/0x270
[   18.073360]  ? __lock_acquire+0x664/0x3e00
[   18.073366]  ? __lock_acquire+0x3d4d/0x3e00
[   18.073374]  print_address_description+0x73/0x250
[   18.073380]  ? __lock_acquire+0x3d4d/0x3e00
[   18.073387]  kasan_report+0x23b/0x360
[   18.073395]  __asan_report_load8_noabort+0x14/0x20
[   18.073400]  __lock_acquire+0x3d4d/0x3e00
[   18.073406]  ? __lock_acquire+0x664/0x3e00
[   18.073411]  ? lock_downgrade+0x980/0x980
[   18.073417]  ? lock_downgrade+0x980/0x980
[   18.073425]  ? remove_wait_queue+0x81/0x350
[   18.073434]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.073440]  ? __lock_acquire+0x664/0x3e00
[   18.073445]  ? check_noncircular+0x20/0x20
[   18.073458]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.073465]  ? lock_acquire+0x1d5/0x580
[   18.073470]  ? lock_acquire+0x1d5/0x580
[   18.073476]  ? ep_free+0xf4/0x320
[   18.073485]  ? lock_release+0xa40/0xa40
[   18.073491]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.073497]  ? print_irqtrace_events+0x270/0x270
[   18.073504]  ? rcu_note_context_switch+0x710/0x710
[   18.073512]  ? __might_sleep+0x95/0x190
[   18.073517]  ? ep_free+0xf4/0x320
[   18.073523]  ? __mutex_lock+0x16f/0x1a80
[   18.073528]  ? ep_free+0xf4/0x320
[   18.073535]  ? print_irqtrace_events+0x270/0x270
[   18.073540]  ? ep_free+0xf4/0x320
[   18.073548]  lock_acquire+0x1d5/0x580
[   18.073553]  ? lock_acquire+0x1d5/0x580
[   18.073559]  ? remove_wait_queue+0x81/0x350
[   18.073565]  ? __lock_acquire+0x664/0x3e00
[   18.073572]  ? lock_release+0xa40/0xa40
[   18.073581]  ? lock_acquire+0x1d5/0x580
[   18.073586]  ? lock_acquire+0x1d5/0x580
[   18.073592]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.073599]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.073605]  ? remove_wait_queue+0x81/0x350
[   18.073611]  remove_wait_queue+0x81/0x350
[   18.073619]  ? add_wait_queue+0x290/0x290
[   18.073630]  ? rcutorture_record_progress+0x10/0x10
[   18.073640]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.073648]  ? __kernel_text_address+0xd/0x40
[   18.073656]  ? clear_tfile_check_list+0x370/0x370
[   18.073663]  ? check_noncircular+0x20/0x20
[   18.073672]  ? locks_remove_file+0x3fa/0x5a0
[   18.073681]  ep_free+0x13f/0x320
[   18.073687]  ? ep_remove+0x800/0x800
[   18.073693]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.073700]  ? ep_free+0x320/0x320
[   18.073706]  ep_eventpoll_release+0x44/0x60
[   18.073713]  __fput+0x327/0x7e0
[   18.073721]  ? fput+0x140/0x140
[   18.073727]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.073736]  ____fput+0x15/0x20
[   18.073742]  task_work_run+0x199/0x270
[   18.073749]  ? task_work_cancel+0x210/0x210
[   18.073755]  ? _raw_spin_unlock+0x22/0x30
[   18.073761]  ? switch_task_namespaces+0x87/0xc0
[   18.073770]  do_exit+0x9bb/0x1ad0
[   18.073779]  ? binder_ioctl+0x551/0x1417
[   18.073785]  ? mm_update_next_owner+0x930/0x930
[   18.073793]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.073803]  ? avc_ss_reset+0x110/0x110
[   18.073810]  ? mutex_unlock+0xd/0x10
[   18.073815]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.073834]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.073839]  ? up_read+0x1a/0x40
[   18.073846]  ? rcu_note_context_switch+0x710/0x710
[   18.073851]  ? __fd_install+0x288/0x740
[   18.073859]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.073865]  ? do_vfs_ioctl+0x486/0x1520
[   18.073870]  ? _cond_resched+0x14/0x30
[   18.073877]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.073885]  ? selinux_capable+0x40/0x40
[   18.073891]  ? __alloc_fd+0x750/0x750
[   18.073899]  do_group_exit+0x149/0x400
[   18.073906]  ? SyS_exit+0x30/0x30
[   18.073912]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.073920]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.073927]  SyS_exit_group+0x1d/0x20
[   18.073934]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.073938] RIP: 0033:0x4429f8
[   18.073941] RSP: 002b:00007ffd0f0929e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.073948] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.073951] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.073954] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.073958] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.073961] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.073969] 
[   18.073972] Allocated by task 3146:
[   18.073978]  save_stack+0x43/0xd0
[   18.073982]  kasan_kmalloc+0xad/0xe0
[   18.073987]  kmem_cache_alloc_trace+0x136/0x750
[   18.073992]  binder_get_thread+0x1cf/0x870
[   18.073996]  binder_poll+0x8c/0x390
[   18.074004]  ep_item_poll.isra.10+0xf2/0x320
[   18.074008]  ep_insert+0x6a2/0x1ac0
[   18.074013]  SyS_epoll_ctl+0x12bf/0x1a80
[   18.074018]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.074019] 
[   18.074021] Freed by task 3146:
[   18.074026]  save_stack+0x43/0xd0
[   18.074030]  kasan_slab_free+0x71/0xc0
[   18.074034]  kfree+0xd6/0x260
[   18.074039]  binder_thread_dec_tmpref+0x27f/0x310
[   18.074043]  binder_thread_release+0x27d/0x540
[   18.074048]  binder_ioctl+0xc02/0x1417
[   18.074052]  do_vfs_ioctl+0x1b1/0x1520
[   18.074056]  SyS_ioctl+0x8f/0xc0
[   18.074061]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.074062] 
[   18.074066] The buggy address belongs to the object at ffff8801ca1c9d00
[   18.074066]  which belongs to the cache kmalloc-512 of size 512
[   18.074071] The buggy address is located 184 bytes inside of
[   18.074071]  512-byte region [ffff8801ca1c9d00, ffff8801ca1c9f00)
[   18.074073] The buggy address belongs to the page:
[   18.074077] page:ffffea0007287240 count:1 mapcount:0 mapping:ffff8801ca1c9080 index:0x0
[   18.074083] flags: 0x2fffc0000000100(slab)
[   18.074091] raw: 02fffc0000000100 ffff8801ca1c9080 0000000000000000 0000000100000006
[   18.074098] raw: ffffea00072af7e0 ffffea0007287360 ffff8801dac00940 0000000000000000
[   18.074100] page dumped because: kasan: bad access detected
[   18.074101] 
[   18.074103] Memory state around the buggy address:
[   18.074108]  ffff8801ca1c9c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.074112]  ffff8801ca1c9d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.074116] >ffff8801ca1c9d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.074118]                                         ^
[   18.074123]  ffff8801ca1c9e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.074127]  ffff8801ca1c9e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.074128] ==================================================================
[   18.074130] Disabling lock debugging due to kernel taint
[   18.074133] Kernel panic - not syncing: panic_on_warn set ...
[   18.074133] 
[   18.074139] CPU: 0 PID: 3146 Comm: syzkaller093494 Tainted: G    B            4.15.0-rc4-mm1+ #49
[   18.074142] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.074143] Call Trace:
[   18.074149]  dump_stack+0x194/0x257
[   18.074155]  ? arch_local_irq_restore+0x53/0x53
[   18.074160]  ? kasan_end_report+0x32/0x50
[   18.074167]  ? lock_downgrade+0x980/0x980
[   18.074172]  ? vsnprintf+0x1ed/0x1900
[   18.074178]  ? __lock_acquire+0x3c90/0x3e00
[   18.074184]  panic+0x1e4/0x41c
[   18.074190]  ? refcount_error_report+0x214/0x214
[   18.074197]  ? add_taint+0x40/0x50
[   18.074202]  ? add_taint+0x1c/0x50
[   18.074209]  ? __lock_acquire+0x3d4d/0x3e00
[   18.074214]  kasan_end_report+0x50/0x50
[   18.074220]  kasan_report+0x148/0x360
[   18.074228]  __asan_report_load8_noabort+0x14/0x20
[   18.074234]  __lock_acquire+0x3d4d/0x3e00
[   18.074239]  ? __lock_acquire+0x664/0x3e00
[   18.074245]  ? lock_downgrade+0x980/0x980
[   18.074250]  ? lock_downgrade+0x980/0x980
[   18.074257]  ? remove_wait_queue+0x81/0x350
[   18.074266]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.074272]  ? __lock_acquire+0x664/0x3e00
[   18.074277]  ? check_noncircular+0x20/0x20
[   18.074289]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.074296]  ? lock_acquire+0x1d5/0x580
[   18.074301]  ? lock_acquire+0x1d5/0x580
[   18.074306]  ? ep_free+0xf4/0x320
[   18.074314]  ? lock_release+0xa40/0xa40
[   18.074320]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.074326]  ? print_irqtrace_events+0x270/0x270
[   18.074333]  ? rcu_note_context_switch+0x710/0x710
[   18.074340]  ? __might_sleep+0x95/0x190
[   18.074346]  ? ep_free+0xf4/0x320
[   18.074351]  ? __mutex_lock+0x16f/0x1a80
[   18.074355]  ? ep_free+0xf4/0x320
[   18.074362]  ? print_irqtrace_events+0x270/0x270
[   18.074367]  ? ep_free+0xf4/0x320
[   18.074375]  lock_acquire+0x1d5/0x580
[   18.074380]  ? lock_acquire+0x1d5/0x580
[   18.074385]  ? remove_wait_queue+0x81/0x350
[   18.074391]  ? __lock_acquire+0x664/0x3e00
[   18.074398]  ? lock_release+0xa40/0xa40
[   18.074408]  ? lock_acquire+0x1d5/0x580
[   18.074413]  ? lock_acquire+0x1d5/0x580
[   18.074419]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.074425]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.074431]  ? remove_wait_queue+0x81/0x350
[   18.074437]  remove_wait_queue+0x81/0x350
[   18.074445]  ? add_wait_queue+0x290/0x290
[   18.074450]  ? rcutorture_record_progress+0x10/0x10
[   18.074460]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.074466]  ? __kernel_text_address+0xd/0x40
[   18.074474]  ? clear_tfile_check_list+0x370/0x370
[   18.074481]  ? check_noncircular+0x20/0x20
[   18.074489]  ? locks_remove_file+0x3fa/0x5a0
[   18.074498]  ep_free+0x13f/0x320
[   18.074504]  ? ep_remove+0x800/0x800
[   18.074509]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.074517]  ? ep_free+0x320/0x320
[   18.074523]  ep_eventpoll_release+0x44/0x60
[   18.074528]  __fput+0x327/0x7e0
[   18.074536]  ? fput+0x140/0x140
[   18.074542]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.074550]  ____fput+0x15/0x20
[   18.074556]  task_work_run+0x199/0x270
[   18.074564]  ? task_work_cancel+0x210/0x210
[   18.074570]  ? _raw_spin_unlock+0x22/0x30
[   18.074575]  ? switch_task_namespaces+0x87/0xc0
[   18.074583]  do_exit+0x9bb/0x1ad0
[   18.074589]  ? binder_ioctl+0x551/0x1417
[   18.074595]  ? mm_update_next_owner+0x930/0x930
[   18.074603]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.074611]  ? avc_ss_reset+0x110/0x110
[   18.074617]  ? mutex_unlock+0xd/0x10
[   18.074622]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.074648]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.074652]  ? up_read+0x1a/0x40
[   18.074659]  ? rcu_note_context_switch+0x710/0x710
[   18.074664]  ? __fd_install+0x288/0x740
[   18.074672]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.074677]  ? do_vfs_ioctl+0x486/0x1520
[   18.074683]  ? _cond_resched+0x14/0x30
[   18.074690]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.074696]  ? selinux_capable+0x40/0x40
[   18.074702]  ? __alloc_fd+0x750/0x750
[   18.074710]  do_group_exit+0x149/0x400
[   18.074717]  ? SyS_exit+0x30/0x30
[   18.074724]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.074730]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.074737]  SyS_exit_group+0x1d/0x20
[   18.074743]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.074746] RIP: 0033:0x4429f8
[   18.074749] RSP: 002b:00007ffd0f0929e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.074755] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.074759] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.074762] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.074765] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.074768] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.093946] Dumping ftrace buffer:
[   18.093950]    (ftrace buffer empty)
[   18.093952] Kernel Offset: disabled
[   19.217873] Rebooting in 86400 seconds..