INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-8,10.128.0.15' (ECDSA) to the list of known hosts.
2017/09/20 02:58:43 parsed 1 programs
2017/09/20 02:58:43 executed programs: 0
2017/09/20 02:58:48 executed programs: 99
syzkaller login: [   49.184152] dev_remove_pack: ffff8801cc1b32c0 not found
[   49.206196] ==================================================================
[   49.213574] BUG: KASAN: use-after-free in __dev_remove_pack+0x305/0x3b0
[   49.220296] Read of size 8 at addr ffff8801cbaa9728 by task syz-executor0/3552
[   49.227621] 
[   49.229220] CPU: 1 PID: 3552 Comm: syz-executor0 Not tainted 4.13.0-mm1+ #7
[   49.236285] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.245607] Call Trace:
[   49.248166]  dump_stack+0x194/0x257
[   49.251768]  ? arch_local_irq_restore+0x53/0x53
[   49.256408]  ? show_regs_print_info+0x65/0x65
[   49.260884]  ? __dev_remove_pack+0x305/0x3b0
[   49.265264]  print_address_description+0x73/0x250
[   49.270080]  ? __dev_remove_pack+0x305/0x3b0
[   49.274463]  kasan_report+0x24e/0x340
[   49.278249]  __asan_report_load8_noabort+0x14/0x20
[   49.283147]  __dev_remove_pack+0x305/0x3b0
[   49.287352]  ? dev_get_by_name_rcu+0x270/0x270
[   49.291905]  ? refcount_sub_and_test+0x115/0x1b0
[   49.296639]  __unregister_prot_hook+0x211/0x280
[   49.301284]  packet_release+0x8bb/0xd70
[   49.305235]  ? packet_set_ring+0x1b70/0x1b70
[   49.309613]  ? dentry_free+0xcd/0x130
[   49.313386]  ? rcu_read_lock_sched_held+0x108/0x120
[   49.318375]  ? kmem_cache_free+0x249/0x280
[   49.322580]  ? dentry_free+0xd2/0x130
[   49.326353]  ? locks_remove_file+0x3fa/0x5a0
[   49.330731]  ? fcntl_setlk+0x10d0/0x10d0
[   49.334763]  ? __fsnotify_parent+0xb4/0x3a0
[   49.339055]  ? fsnotify+0x1af0/0x1af0
[   49.342842]  sock_release+0x8d/0x1e0
[   49.346523]  ? sock_release+0x8d/0x1e0
[   49.350378]  ? sock_release+0x1e0/0x1e0
[   49.354319]  sock_close+0x16/0x20
[   49.357740]  __fput+0x333/0x7f0
[   49.360996]  ? fput+0x140/0x140
[   49.364246]  ? check_same_owner+0x320/0x320
[   49.368538]  ? _raw_spin_unlock_irq+0x27/0x70
[   49.373010]  ____fput+0x15/0x20
[   49.376258]  task_work_run+0x199/0x270
[   49.380117]  ? task_work_cancel+0x210/0x210
[   49.384408]  ? _raw_spin_unlock+0x22/0x30
[   49.388524]  ? switch_task_namespaces+0x87/0xc0
[   49.393167]  do_exit+0xa52/0x1b40
[   49.396590]  ? plist_check_list+0xa0/0xa0
[   49.400720]  ? plist_del+0x47b/0x990
[   49.404404]  ? mm_update_next_owner+0x930/0x930
[   49.409042]  ? plist_add+0x760/0x760
[   49.412737]  ? check_same_owner+0x320/0x320
[   49.417032]  ? find_held_lock+0x39/0x1d0
[   49.421074]  ? check_noncircular+0x20/0x20
[   49.425278]  ? lock_downgrade+0x990/0x990
[   49.429397]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   49.434748]  ? find_held_lock+0x39/0x1d0
[   49.438789]  ? lock_downgrade+0x990/0x990
[   49.442908]  ? recalc_sigpending_tsk+0x117/0x150
[   49.447636]  ? recalc_sigpending+0x103/0x160
[   49.452014]  ? recalc_sigpending_tsk+0x150/0x150
[   49.456736]  ? get_signal+0x397/0x17e0
[   49.460605]  do_group_exit+0x149/0x400
[   49.464465]  ? __lock_is_held+0xbc/0x140
[   49.468495]  ? SyS_exit+0x30/0x30
[   49.471922]  ? _raw_spin_unlock_irq+0x27/0x70
[   49.476392]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   49.481386]  get_signal+0x7e8/0x17e0
[   49.485100]  ? ptrace_notify+0x130/0x130
[   49.489133]  ? trace_hardirqs_on+0xd/0x10
[   49.493248]  ? _raw_spin_unlock_irq+0x27/0x70
[   49.497716]  ? __schedule+0x13cd/0x2070
[   49.501657]  ? lock_release+0xd70/0xd70
[   49.505608]  ? exit_robust_list+0x240/0x240
[   49.509913]  do_signal+0x94/0x1ee0
[   49.513429]  ? iterate_fd+0x3f0/0x3f0
[   49.517201]  ? setup_sigcontext+0x7d0/0x7d0
[   49.521493]  ? __lock_is_held+0xbc/0x140
[   49.525525]  ? schedule+0x108/0x440
[   49.529121]  ? __schedule+0x2070/0x2070
[   49.533065]  ? __fget_light+0x29d/0x390
[   49.537011]  ? selinux_tun_dev_create+0xc0/0xc0
[   49.541652]  ? selinux_netlbl_socket_setsockopt+0x10c/0x460
[   49.547331]  ? selinux_netlbl_sock_rcv_skb+0x730/0x730
[   49.552575]  ? alloc_file+0x284/0x3a0
[   49.556345]  ? exit_to_usermode_loop+0x98/0x300
[   49.560993]  exit_to_usermode_loop+0x224/0x300
[   49.565549]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   49.571068]  syscall_return_slowpath+0x42f/0x500
[   49.575797]  ? prepare_exit_to_usermode+0x2c0/0x2c0
[   49.580790]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[   49.585692]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   49.590681]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   49.595413]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   49.600137] RIP: 0033:0x4520a9
[   49.603295] RSP: 002b:00007f788995dcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   49.610972] RAX: fffffffffffffe00 RBX: 0000000000718028 RCX: 00000000004520a9
[   49.618210] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000718028
[   49.625446] RBP: 0000000000718000 R08: 0000000000000000 R09: 0000000000000000
[   49.632683] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   49.639920] R13: 0000000000a6f7ef R14: 00007f788995e9c0 R15: 0000000000000000
[   49.647177] 
[   49.648775] Allocated by task 3552:
[   49.652377]  save_stack_trace+0x16/0x20
[   49.656321]  save_stack+0x43/0xd0
[   49.659742]  kasan_kmalloc+0xad/0xe0
[   49.663425]  kmem_cache_alloc_trace+0x136/0x750
[   49.668063]  fanout_add+0xa50/0x1190
[   49.671744]  packet_setsockopt+0xfdc/0x1e80
[   49.676035]  SyS_setsockopt+0x189/0x360
[   49.679979]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   49.684698] 
[   49.686293] Freed by task 3552:
[   49.689538]  save_stack_trace+0x16/0x20
[   49.693479]  save_stack+0x43/0xd0
[   49.696900]  kasan_slab_free+0x71/0xc0
[   49.700756]  kfree+0xca/0x250
[   49.703829]  packet_release+0xa8f/0xd70
[   49.707772]  sock_release+0x8d/0x1e0
[   49.711452]  sock_close+0x16/0x20
[   49.714879]  __fput+0x333/0x7f0
[   49.718124]  ____fput+0x15/0x20
[   49.721371]  task_work_run+0x199/0x270
[   49.725226]  do_exit+0xa52/0x1b40
[   49.728645]  do_group_exit+0x149/0x400
[   49.732498]  get_signal+0x7e8/0x17e0
[   49.736178]  do_signal+0x94/0x1ee0
[   49.739686]  exit_to_usermode_loop+0x224/0x300
[   49.744237]  syscall_return_slowpath+0x42f/0x500
[   49.748959]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   49.753678] 
[   49.755275] The buggy address belongs to the object at ffff8801cbaa8e80
[   49.755275]  which belongs to the cache kmalloc-4096 of size 4096
[   49.768072] The buggy address is located 2216 bytes inside of
[   49.768072]  4096-byte region [ffff8801cbaa8e80, ffff8801cbaa9e80)
[   49.780092] The buggy address belongs to the page:
[   49.784991] page:ffffea00072eaa00 count:1 mapcount:0 mapping:ffff8801cbaa8e80 index:0x0 compound_mapcount: 0
[   49.794936] flags: 0x200000000008100(slab|head)
[   49.799576] raw: 0200000000008100 ffff8801cbaa8e80 0000000000000000 0000000100000001
[   49.807423] raw: ffffea00072ea220 ffff8801dac01a50 ffff8801dac00dc0 0000000000000000
[   49.815267] page dumped because: kasan: bad access detected
[   49.820941] 
[   49.822534] Memory state around the buggy address:
[   49.827438]  ffff8801cbaa9600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.834764]  ffff8801cbaa9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.842089] >ffff8801cbaa9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.849415]                                   ^
[   49.854052]  ffff8801cbaa9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.861384]  ffff8801cbaa9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   49.868710] ==================================================================
[   49.876034] Disabling lock debugging due to kernel taint
[   49.881520] Kernel panic - not syncing: panic_on_warn set ...
[   49.881520] 
[   49.888852] CPU: 1 PID: 3552 Comm: syz-executor0 Tainted: G    B           4.13.0-mm1+ #7
[   49.897127] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   49.906443] Call Trace:
[   49.908996]  dump_stack+0x194/0x257
[   49.912586]  ? arch_local_irq_restore+0x53/0x53
[   49.917220]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   49.921944]  ? __dev_remove_pack+0x2f0/0x3b0
[   49.926317]  panic+0x1e4/0x417
[   49.929476]  ? __warn+0x1d9/0x1d9
[   49.932900]  ? __dev_remove_pack+0x305/0x3b0
[   49.937272]  kasan_end_report+0x50/0x50
[   49.941208]  kasan_report+0x137/0x340
[   49.944976]  __asan_report_load8_noabort+0x14/0x20
[   49.949882]  __dev_remove_pack+0x305/0x3b0
[   49.954088]  ? dev_get_by_name_rcu+0x270/0x270
[   49.958633]  ? refcount_sub_and_test+0x115/0x1b0
[   49.963358]  __unregister_prot_hook+0x211/0x280
[   49.967993]  packet_release+0x8bb/0xd70
[   49.971935]  ? packet_set_ring+0x1b70/0x1b70
[   49.976309]  ? dentry_free+0xcd/0x130
[   49.980074]  ? rcu_read_lock_sched_held+0x108/0x120
[   49.985053]  ? kmem_cache_free+0x249/0x280
[   49.989252]  ? dentry_free+0xd2/0x130
[   49.993018]  ? locks_remove_file+0x3fa/0x5a0
[   49.997391]  ? fcntl_setlk+0x10d0/0x10d0
[   50.001416]  ? __fsnotify_parent+0xb4/0x3a0
[   50.005702]  ? fsnotify+0x1af0/0x1af0
[   50.009468]  sock_release+0x8d/0x1e0
[   50.013144]  ? sock_release+0x8d/0x1e0
[   50.016998]  ? sock_release+0x1e0/0x1e0
[   50.020933]  sock_close+0x16/0x20
[   50.024355]  __fput+0x333/0x7f0
[   50.027603]  ? fput+0x140/0x140
[   50.031242]  ? check_same_owner+0x320/0x320
[   50.035531]  ? _raw_spin_unlock_irq+0x27/0x70
[   50.039994]  ____fput+0x15/0x20
[   50.043236]  task_work_run+0x199/0x270
[   50.047437]  ? task_work_cancel+0x210/0x210
[   50.051722]  ? _raw_spin_unlock+0x22/0x30
[   50.055835]  ? switch_task_namespaces+0x87/0xc0
[   50.060469]  do_exit+0xa52/0x1b40
[   50.063887]  ? plist_check_list+0xa0/0xa0
[   50.068003]  ? plist_del+0x47b/0x990
[   50.071681]  ? mm_update_next_owner+0x930/0x930
[   50.076313]  ? plist_add+0x760/0x760
[   50.079995]  ? check_same_owner+0x320/0x320
[   50.084284]  ? find_held_lock+0x39/0x1d0
[   50.088310]  ? check_noncircular+0x20/0x20
[   50.092508]  ? lock_downgrade+0x990/0x990
[   50.096621]  ? refill_pi_state_cache.part.6+0x2f0/0x2f0
[   50.101958]  ? find_held_lock+0x39/0x1d0
[   50.105989]  ? lock_downgrade+0x990/0x990
[   50.110110]  ? recalc_sigpending_tsk+0x117/0x150
[   50.114828]  ? recalc_sigpending+0x103/0x160
[   50.119198]  ? recalc_sigpending_tsk+0x150/0x150
[   50.123913]  ? get_signal+0x397/0x17e0
[   50.127770]  do_group_exit+0x149/0x400
[   50.131620]  ? __lock_is_held+0xbc/0x140
[   50.135644]  ? SyS_exit+0x30/0x30
[   50.139059]  ? _raw_spin_unlock_irq+0x27/0x70
[   50.143518]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   50.148497]  get_signal+0x7e8/0x17e0
[   50.152188]  ? ptrace_notify+0x130/0x130
[   50.156213]  ? trace_hardirqs_on+0xd/0x10
[   50.160323]  ? _raw_spin_unlock_irq+0x27/0x70
[   50.164780]  ? __schedule+0x13cd/0x2070
[   50.168717]  ? lock_release+0xd70/0xd70
[   50.172658]  ? exit_robust_list+0x240/0x240
[   50.176951]  do_signal+0x94/0x1ee0
[   50.180460]  ? iterate_fd+0x3f0/0x3f0
[   50.184228]  ? setup_sigcontext+0x7d0/0x7d0