INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-9,10.128.0.51' (ECDSA) to the list of known hosts.
2017/09/12 02:38:30 parsed 1 programs
2017/09/12 02:38:30 executed programs: 0
2017/09/12 02:38:35 executed programs: 569
2017/09/12 02:38:40 executed programs: 1081
2017/09/12 02:38:45 executed programs: 1596
2017/09/12 02:38:50 executed programs: 2117
2017/09/12 02:38:55 executed programs: 2641
2017/09/12 02:39:00 executed programs: 3163
2017/09/12 02:39:05 executed programs: 3683
2017/09/12 02:39:10 executed programs: 4203
2017/09/12 02:39:15 executed programs: 4724
2017/09/12 02:39:20 executed programs: 5242
2017/09/12 02:39:25 executed programs: 5763
syzkaller login: [  109.950810] ==================================================================
[  109.952037] BUG: KASAN: use-after-free in get_work_pool+0x1c2/0x1e0
[  109.953141] Read of size 8 at addr ffff8801cc7fe338 by task syz-executor7/1637
[  109.954145] 
[  109.954405] CPU: 1 PID: 1637 Comm: syz-executor7 Not tainted 4.13.0+ #79
[  109.955310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  109.956581] Call Trace:
[  109.956945]  dump_stack+0x194/0x257
[  109.957444]  ? arch_local_irq_restore+0x53/0x53
[  109.958086]  ? show_regs_print_info+0x65/0x65
[  109.958697]  ? __kernel_text_address+0xae/0xe0
[  109.959315]  ? get_work_pool+0x1c2/0x1e0
[  109.959867]  print_address_description+0x73/0x250
[  109.960518]  ? get_work_pool+0x1c2/0x1e0
[  109.961069]  kasan_report+0x24e/0x340
[  109.961591]  __asan_report_load8_noabort+0x14/0x20
[  109.962283]  get_work_pool+0x1c2/0x1e0
[  109.962814]  ? check_flush_dependency+0x370/0x370
[  109.963467]  ? save_stack_trace+0x16/0x20
[  109.964048]  ? save_stack+0x43/0xd0
[  109.964542]  ? kasan_kmalloc+0xad/0xe0
[  109.965080]  ? kasan_slab_alloc+0x12/0x20
[  109.965641]  ? kmem_cache_alloc+0x12e/0x760
[  109.966226]  ? kcm_ioctl+0x2d1/0x1610
[  109.966744]  ? sock_do_ioctl+0x65/0xb0
[  109.967275]  __queue_work+0x235/0x1150
[  109.967815]  ? insert_work+0x5d0/0x5d0
[  109.968356]  ? lock_downgrade+0x990/0x990
[  109.968916]  ? init_timer_key+0x126/0x3b0
[  109.969479]  ? retint_kernel+0x10/0x10
[  109.970027]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  109.970699]  ? kcm_ioctl+0x81a/0x1610
[  109.972756]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  109.977492]  ? retint_kernel+0x10/0x10
[  109.981355]  ? kcm_ioctl+0x81a/0x1610
[  109.985140]  queue_work_on+0x16a/0x1c0
[  109.989004]  strp_check_rcv+0x25/0x30
[  109.992782]  kcm_ioctl+0x826/0x1610
[  109.996390]  ? kcm_unattach+0x1510/0x1510
[  110.000513]  ? avc_ss_reset+0x110/0x110
[  110.004468]  ? lock_release+0xd70/0xd70
[  110.008417]  ? __lock_is_held+0xbc/0x140
[  110.012485]  sock_do_ioctl+0x65/0xb0
[  110.016174]  sock_ioctl+0x2c2/0x440
[  110.019779]  ? dlci_ioctl_set+0x40/0x40
[  110.023726]  do_vfs_ioctl+0x1b1/0x1530
[  110.027593]  ? ioctl_preallocate+0x2b0/0x2b0
[  110.031981]  ? selinux_capable+0x40/0x40
[  110.036027]  ? SyS_futex+0x260/0x390
[  110.039710]  ? SyS_futex+0x269/0x390
[  110.043396]  ? vfs_write+0x1cb/0x510
[  110.047095]  ? security_file_ioctl+0x7d/0xb0
[  110.051478]  ? security_file_ioctl+0x89/0xb0
[  110.055864]  SyS_ioctl+0x8f/0xc0
[  110.059212]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  110.063943] RIP: 0033:0x451e59
[  110.067107] RSP: 002b:00007fa38043dc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  110.074791] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  110.082033] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000b
[  110.089276] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  110.096518] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b9fa6
[  110.103770] R13: 00000000ffffffff R14: 000000000000000b R15: 00000000000089e0
[  110.111039] 
[  110.112641] Allocated by task 1637:
[  110.116241]  save_stack_trace+0x16/0x20
[  110.120186]  save_stack+0x43/0xd0
[  110.123612]  kasan_kmalloc+0xad/0xe0
[  110.127297]  kasan_slab_alloc+0x12/0x20
[  110.131241]  kmem_cache_alloc+0x12e/0x760
[  110.135367]  kcm_ioctl+0x2d1/0x1610
[  110.138964]  sock_do_ioctl+0x65/0xb0
[  110.142648]  sock_ioctl+0x2c2/0x440
[  110.146248]  do_vfs_ioctl+0x1b1/0x1530
[  110.150106]  SyS_ioctl+0x8f/0xc0
[  110.153445]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  110.158168] 
[  110.159769] Freed by task 1645:
[  110.163024]  save_stack_trace+0x16/0x20
[  110.166972]  save_stack+0x43/0xd0
[  110.170396]  kasan_slab_free+0x71/0xc0
[  110.174262]  kmem_cache_free+0x77/0x280
[  110.178206]  kcm_unattach+0xe50/0x1510
[  110.182067]  kcm_ioctl+0xdf0/0x1610
[  110.185664]  sock_do_ioctl+0x65/0xb0
[  110.189350]  sock_ioctl+0x2c2/0x440
[  110.192947]  do_vfs_ioctl+0x1b1/0x1530
[  110.196805]  SyS_ioctl+0x8f/0xc0
[  110.200143]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  110.204869] 
[  110.206470] The buggy address belongs to the object at ffff8801cc7fe200
[  110.206470]  which belongs to the cache kcm_psock_cache of size 664
[  110.219445] The buggy address is located 312 bytes inside of
[  110.219445]  664-byte region [ffff8801cc7fe200, ffff8801cc7fe498)
[  110.231288] The buggy address belongs to the page:
[  110.236190] page:ffffea000731ff80 count:1 mapcount:0 mapping:ffff8801cc7fe200 index:0x0 compound_mapcount: 0
[  110.246141] flags: 0x200000000008100(slab|head)
[  110.250783] raw: 0200000000008100 ffff8801cc7fe200 0000000000000000 0000000100000009
[  110.258638] raw: ffffea00072e4320 ffffea00072d99a0 ffff8801d2e59cc0 0000000000000000
[  110.266490] page dumped because: kasan: bad access detected
[  110.272167] 
[  110.273767] Memory state around the buggy address:
[  110.278666]  ffff8801cc7fe200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.285997]  ffff8801cc7fe280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.293332] >ffff8801cc7fe300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.300663]                                         ^
[  110.305821]  ffff8801cc7fe380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.313151]  ffff8801cc7fe400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  110.320480] ==================================================================
[  110.327806] Disabling lock debugging due to kernel taint
[  110.333218] Kernel panic - not syncing: panic_on_warn set ...
[  110.333218] 
[  110.340546] CPU: 1 PID: 1637 Comm: syz-executor7 Tainted: G    B           4.13.0+ #79
[  110.348563] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  110.357886] Call Trace:
[  110.360442]  dump_stack+0x194/0x257
[  110.364037]  ? arch_local_irq_restore+0x53/0x53
[  110.368673]  ? vprintk_default+0x28/0x30
[  110.372711]  ? get_work_pool+0xf0/0x1e0
[  110.376653]  panic+0x1e4/0x417
[  110.379812]  ? __warn+0x1d9/0x1d9
[  110.383239]  ? get_work_pool+0x1c2/0x1e0
[  110.387266]  kasan_end_report+0x50/0x50
[  110.391208]  kasan_report+0x137/0x340
[  110.394975]  __asan_report_load8_noabort+0x14/0x20
[  110.399869]  get_work_pool+0x1c2/0x1e0
[  110.403724]  ? check_flush_dependency+0x370/0x370
[  110.408621]  ? save_stack_trace+0x16/0x20
[  110.412735]  ? save_stack+0x43/0xd0
[  110.416326]  ? kasan_kmalloc+0xad/0xe0
[  110.420178]  ? kasan_slab_alloc+0x12/0x20
[  110.424291]  ? kmem_cache_alloc+0x12e/0x760
[  110.428579]  ? kcm_ioctl+0x2d1/0x1610
[  110.432346]  ? sock_do_ioctl+0x65/0xb0
[  110.436202]  __queue_work+0x235/0x1150
[  110.440063]  ? insert_work+0x5d0/0x5d0
[  110.443925]  ? lock_downgrade+0x990/0x990
[  110.448038]  ? init_timer_key+0x126/0x3b0
[  110.452152]  ? retint_kernel+0x10/0x10
[  110.456008]  ? trace_hardirqs_on_caller+0x421/0x5c0
[  110.460988]  ? kcm_ioctl+0x81a/0x1610
[  110.464755]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  110.469480]  ? retint_kernel+0x10/0x10
[  110.473335]  ? kcm_ioctl+0x81a/0x1610
[  110.477110]  queue_work_on+0x16a/0x1c0
[  110.480968]  strp_check_rcv+0x25/0x30
[  110.484740]  kcm_ioctl+0x826/0x1610
[  110.488339]  ? kcm_unattach+0x1510/0x1510
[  110.492459]  ? avc_ss_reset+0x110/0x110
[  110.496402]  ? lock_release+0xd70/0xd70
[  110.500343]  ? __lock_is_held+0xbc/0x140
[  110.504386]  sock_do_ioctl+0x65/0xb0
[  110.508068]  sock_ioctl+0x2c2/0x440
[  110.511662]  ? dlci_ioctl_set+0x40/0x40
[  110.515602]  do_vfs_ioctl+0x1b1/0x1530
[  110.519460]  ? ioctl_preallocate+0x2b0/0x2b0
[  110.523836]  ? selinux_capable+0x40/0x40
[  110.527866]  ? SyS_futex+0x260/0x390
[  110.531543]  ? SyS_futex+0x269/0x390
[  110.535222]  ? vfs_write+0x1cb/0x510
[  110.538908]  ? security_file_ioctl+0x7d/0xb0
[  110.543285]  ? security_file_ioctl+0x89/0xb0
[  110.547663]  SyS_ioctl+0x8f/0xc0
[  110.550998]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  110.555723] RIP: 0033:0x451e59
[  110.558878] RSP: 002b:00007fa38043dc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  110.566551] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  110.573788] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000b
[  110.581023] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  110.588258] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b9fa6
[  110.595493] R13: 00000000ffffffff R14: 000000000000000b R15: 00000000000089e0
[  110.603163] Dumping ftrace buffer:
[  110.606670]    (ftrace buffer empty)
[  110.610346] Kernel Offset: disabled
[  110.613939] Rebooting in 86400 seconds..