INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-next-kasan-gce-4,10.128.0.10' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 43.753886] dev_remove_pack: ffff8801cb47f3c0 not found executing program executing program executing program [ 43.815259] ================================================================== [ 43.822668] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0 [ 43.830173] Read of size 2 at addr ffff8801cb615640 by task syzkaller960656/4040 [ 43.837673] [ 43.839288] CPU: 1 PID: 4040 Comm: syzkaller960656 Not tainted 4.13.0-rc7-next-20170901+ #13 [ 43.847835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 43.857172] Call Trace: [ 43.859741] [ 43.861866] dump_stack+0x194/0x257 [ 43.865467] ? arch_local_irq_restore+0x53/0x53 [ 43.870122] ? show_regs_print_info+0x65/0x65 [ 43.874600] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 43.879763] print_address_description+0x73/0x250 [ 43.884578] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 43.889744] kasan_report+0x24e/0x340 [ 43.893520] __asan_report_load2_noabort+0x14/0x20 [ 43.898431] __netif_receive_skb_core+0x2be3/0x33d0 [ 43.903430] ? __bpf_address_lookup+0x2b0/0x2b0 [ 43.908088] ? nf_ingress+0x9f0/0x9f0 [ 43.911865] ? unwind_dump+0x4c0/0x4c0 [ 43.915757] ? check_noncircular+0x20/0x20 [ 43.919988] ? __kernel_text_address+0xae/0xe0 [ 43.924548] ? unwind_get_return_address+0x61/0xa0 [ 43.929815] ? __save_stack_trace+0x7e/0xd0 [ 43.934116] ? depot_save_stack+0x12c/0x490 [ 43.938423] ? find_held_lock+0x39/0x1d0 [ 43.942467] ? lock_downgrade+0x990/0x990 [ 43.946585] ? evict+0x44a/0x920 [ 43.949939] ? lock_acquire+0x1d5/0x580 [ 43.953917] ? netif_receive_skb_internal+0x1d7/0x5e0 [ 43.959081] ? find_held_lock+0x39/0x1d0 [ 43.963127] ? pvclock_read_flags+0x160/0x160 [ 43.967596] ? lock_downgrade+0x990/0x990 [ 43.971722] ? lock_acquire+0x1d5/0x580 [ 43.975669] ? netif_receive_skb_internal+0x93/0x5e0 [ 43.980756] ? ktime_get_with_offset+0x2c1/0x420 [ 43.985490] ? lock_release+0xd70/0xd70 [ 43.989464] ? ktime_get+0x3a0/0x3a0 [ 43.993162] __netif_receive_skb+0x2c/0x1b0 [ 43.997452] ? __netif_receive_skb+0x2c/0x1b0 [ 44.001920] netif_receive_skb_internal+0x10b/0x5e0 [ 44.006909] ? dev_cpu_dead+0xb00/0xb00 [ 44.010854] ? __alloc_pages_nodemask+0xd80/0xd80 [ 44.015670] ? net_rx_action+0x1910/0x1910 [ 44.019903] ? rcu_pm_notify+0xc0/0xc0 [ 44.023784] ? skb_gro_reset_offset+0x17b/0x300 [ 44.028474] napi_gro_receive+0x3d0/0x500 [ 44.032605] ? dev_gro_receive+0x19b0/0x19b0 [ 44.037004] ? eth_type_trans+0x2a3/0x650 [ 44.041149] ? eth_gro_receive+0x810/0x810 [ 44.045398] receive_buf+0xcc5/0x51f0 [ 44.049185] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 44.053751] ? print_usage_bug+0x480/0x480 [ 44.057976] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.063154] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 44.069010] ? complete+0x5f/0x80 [ 44.072433] ? complete+0x5f/0x80 [ 44.075861] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.081037] ? __lock_is_held+0xbc/0x140 [ 44.085102] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.090095] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.095097] ? __lock_acquire+0x732/0x4620 [ 44.099307] ? unwind_dump+0x4c0/0x4c0 [ 44.103186] ? wake_q_add+0x90/0x90 [ 44.106795] ? lock_downgrade+0x990/0x990 [ 44.110930] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.116105] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 44.121962] ? hrtimer_interrupt+0x1d4/0x5f0 [ 44.126340] ? hrtimer_interrupt+0x1d4/0x5f0 [ 44.130722] ? save_stack_trace+0x16/0x20 [ 44.134843] ? __lock_acquire+0x20fd/0x4620 [ 44.139143] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.144134] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.149124] ? unwind_dump+0x4c0/0x4c0 [ 44.152985] ? unwind_dump+0x4c0/0x4c0 [ 44.156884] ? __unwind_start+0x169/0x330 [ 44.161008] ? unwind_get_return_address+0x61/0xa0 [ 44.165927] ? __save_stack_trace+0x61/0xd0 [ 44.170233] ? get_stack_info+0x37/0x150 [ 44.174272] ? update_stack_state+0x225/0x700 [ 44.178754] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 44.184618] ? lock_release+0x6aa/0xd70 [ 44.188570] ? find_held_lock+0x39/0x1d0 [ 44.192631] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.197642] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.202636] ? unwind_dump+0x4c0/0x4c0 [ 44.206505] ? unwind_dump+0x4c0/0x4c0 [ 44.210375] ? pvclock_read_flags+0x160/0x160 [ 44.214850] ? __unwind_start+0x169/0x330 [ 44.218976] ? print_usage_bug+0x480/0x480 [ 44.223186] ? unwind_get_return_address+0x61/0xa0 [ 44.228093] ? __save_stack_trace+0x61/0xd0 [ 44.232399] ? lock_release+0x6aa/0xd70 [ 44.236378] ? save_stack_trace+0x16/0x20 [ 44.240501] ? __lock_acquire+0x20fd/0x4620 [ 44.244802] ? vring_use_dma_api+0x7f/0xa0 [ 44.249022] ? vring_unmap_one+0x49/0x3d0 [ 44.253148] ? detach_buf+0x463/0x6a0 [ 44.256941] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 44.261673] ? common_interrupt+0x9d/0x9d [ 44.265810] ? detach_buf+0x6a0/0x6a0 [ 44.269591] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 44.274601] virtnet_poll+0x304/0xad0 [ 44.278395] ? receive_buf+0x51f0/0x51f0 [ 44.282446] ? unwind_dump+0x4c0/0x4c0 [ 44.286317] ? net_rx_action+0x49b/0x1910 [ 44.290443] net_rx_action+0x792/0x1910 [ 44.294400] ? napi_complete_done+0x6c0/0x6c0 [ 44.298871] ? save_stack_trace+0x16/0x20 [ 44.302998] ? __lock_acquire+0x20fd/0x4620 [ 44.307310] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.312478] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 44.317666] ? lock_downgrade+0x990/0x990 [ 44.321791] ? check_noncircular+0x20/0x20 [ 44.326008] ? rcu_pm_notify+0xc0/0xc0 [ 44.329895] ? rcu_read_lock_sched_held+0x108/0x120 [ 44.334892] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 44.339708] ? raise_softirq+0x490/0x490 [ 44.343743] ? lock_downgrade+0x990/0x990 [ 44.347870] ? lock_acquire+0x1d5/0x580 [ 44.351816] ? clockevents_program_event+0x163/0x2e0 [ 44.356897] ? trace_hardirqs_off+0xd/0x10 [ 44.361108] ? __napi_schedule+0x25e/0x370 [ 44.365318] ? netdev_info+0x170/0x170 [ 44.369176] ? check_noncircular+0x20/0x20 [ 44.373387] ? check_noncircular+0x20/0x20 [ 44.377599] ? rcu_pm_notify+0xc0/0xc0 [ 44.381475] ? rcu_read_lock_sched_held+0x108/0x120 [ 44.386468] ? __handle_irq_event_percpu+0x308/0x9d0 [ 44.391548] ? rcu_pm_notify+0xc0/0xc0 [ 44.395422] __do_softirq+0x2bb/0xbd0 [ 44.399208] ? __softirqentry_text_start+0x8/0x8 [ 44.403939] ? do_raw_spin_trylock+0x190/0x190 [ 44.408491] ? handle_irq_event_percpu+0x141/0x1b0 [ 44.413417] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 44.418519] ? _raw_spin_lock+0x32/0x40 [ 44.422485] ? _raw_spin_unlock+0x22/0x30 [ 44.426700] ? handle_edge_irq+0x2b4/0x7c0 [ 44.430920] irq_exit+0x1d3/0x210 [ 44.434346] do_IRQ+0xf6/0x190 [ 44.437512] common_interrupt+0x9d/0x9d [ 44.441461] [ 44.443693] RIP: 0010:lock_release+0x6aa/0xd70 [ 44.448243] RSP: 0018:ffff8801cbc77098 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff2e [ 44.455926] RAX: dffffc0000000000 RBX: 1ffff1003978ee18 RCX: ffff8801cb5f68c8 [ 44.463182] RDX: 1ffffffff0b59305 RSI: 0000000000000001 RDI: 0000000000000282 [ 44.470430] RBP: ffff8801cbc77248 R08: ffff8801cbc76bc0 R09: 1ffff1003978ee24 [ 44.477671] R10: ffff8801cb5f6000 R11: 0000000000000000 R12: ffff8801cbc77120 [ 44.484911] R13: ffff8801cb5f6000 R14: 0000000000000000 R15: 0000000000000003 [ 44.492215] ? lock_downgrade+0x990/0x990 [ 44.496335] ? __unwind_start+0x169/0x330 [ 44.500462] ? inode_wait_for_writeback+0x1f/0x40 [ 44.505318] ? lock_release+0xd70/0xd70 [ 44.509285] ? __inode_wait_for_writeback+0x292/0x330 [ 44.514458] ? inode_switch_wbs_rcu_fn+0x200/0x200 [ 44.519381] ? bit_waitqueue+0x30/0x30 [ 44.523252] _raw_spin_unlock+0x1a/0x30 [ 44.527202] inode_wait_for_writeback+0x2f/0x40 [ 44.531844] evict+0x44a/0x920 [ 44.535015] ? destroy_inode+0x200/0x200 [ 44.539101] ? do_raw_spin_trylock+0x190/0x190 [ 44.543662] ? __cpuidle_text_end+0x4/0x4 [ 44.547784] ? _atomic_dec_and_lock+0x125/0x196 [ 44.552463] ? _atomic_dec_and_lock+0xe8/0x196 [ 44.557028] ? cpumask_local_spread+0x250/0x250 [ 44.561730] iput+0x7b9/0xaf0 [ 44.564814] ? evict_inodes+0x590/0x590 [ 44.568764] ? is_bpf_text_address+0xa4/0x120 [ 44.573234] ? __kernel_text_address+0xae/0xe0 [ 44.577799] ? unwind_get_return_address+0x61/0xa0 [ 44.582711] ? do_raw_spin_trylock+0x190/0x190 [ 44.587264] ? __bfs+0x6f0/0x750 [ 44.590610] ? depot_save_stack+0x12c/0x490 [ 44.594926] dentry_unlink_inode+0x4b0/0x5e0 [ 44.599311] ? release_dentry_name_snapshot+0x70/0x70 [ 44.604477] ? __d_drop+0x2b9/0x4b0 [ 44.608078] ? lockref_mark_dead+0xcc/0x140 [ 44.612372] ? d_exact_alias+0x620/0x620 [ 44.616410] ? lock_acquire+0x1d5/0x580 [ 44.620367] ? dput.part.24+0x478/0x740 [ 44.624325] __dentry_kill+0x3b7/0x6d0 [ 44.628199] ? check_and_drop+0x170/0x170 [ 44.632331] ? check_same_owner+0x320/0x320 [ 44.636625] ? free_modinfo_version+0x70/0x70 [ 44.641096] ? rcu_note_context_switch+0x710/0x710 [ 44.646004] ? dput.part.24+0x2a/0x740 [ 44.649866] ? dput.part.24+0x2a/0x740 [ 44.653725] dput.part.24+0x62c/0x740 [ 44.657499] ? sock_release+0x1e0/0x1e0 [ 44.661455] dput+0x1f/0x30 [ 44.664367] __fput+0x52b/0x7f0 [ 44.667625] ? fput+0x140/0x140 [ 44.670877] ? _raw_spin_unlock_irq+0x27/0x70 [ 44.675374] ____fput+0x15/0x20 [ 44.678627] task_work_run+0x199/0x270 [ 44.682490] ? task_work_cancel+0x210/0x210 [ 44.686785] ? _raw_spin_unlock+0x22/0x30 [ 44.690912] ? switch_task_namespaces+0x87/0xc0 [ 44.695557] do_exit+0xa52/0x1b40 [ 44.698985] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.703992] ? trace_hardirqs_on+0xd/0x10 [ 44.708137] ? __hrtimer_get_remaining+0x181/0x1c0 [ 44.713041] ? mm_update_next_owner+0x930/0x930 [ 44.717685] ? __hrtimer_get_remaining+0x1c0/0x1c0 [ 44.722596] ? check_same_owner+0x320/0x320 [ 44.726905] ? _do_fork+0x2f5/0xfe0 [ 44.730507] ? rcu_note_context_switch+0x710/0x710 [ 44.735413] ? __might_sleep+0x95/0x190 [ 44.739379] ? do_nanosleep+0x508/0x6f0 [ 44.743333] ? schedule_timeout_idle+0x90/0x90 [ 44.747917] ? memset+0x31/0x40 [ 44.751178] ? hrtimer_nanosleep+0x2cc/0x860 [ 44.755565] ? nanosleep_copyout+0x100/0x100 [ 44.759941] ? __might_sleep+0x95/0x190 [ 44.763895] ? kasan_check_write+0x14/0x20 [ 44.768105] ? _copy_from_user+0x99/0x110 [ 44.772230] ? __hrtimer_init+0x140/0x140 [ 44.776352] ? syscall_return_slowpath+0x500/0x500 [ 44.781259] do_group_exit+0x149/0x400 [ 44.785151] ? SyS_exit+0x30/0x30 [ 44.788580] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 44.793569] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 44.798297] SyS_exit_group+0x1d/0x20 [ 44.802075] entry_SYSCALL_64_fastpath+0x1f/0xbe [ 44.806799] RIP: 0033:0x445d39 [ 44.809971] RSP: 002b:00007ffe3a862bd8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7