executing program
executing program
executing program
executing program
executing program
executing program
executing program
executing program
syzkaller login: [   17.870127] dev_remove_pack: ffff88003d5d5340 not found
executing program
executing program
[   17.926738] ==================================================================
[   17.928141] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0
[   17.928838] Read of size 2 at addr ffff88006c2a0ec0 by task swapper/0/0
[   17.929546] 
[   17.929702] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.13.0-rc7-next-20170901+ #13
[   17.930393] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   17.931172] Call Trace:
[   17.931408]  <IRQ>
[   17.931609]  dump_stack+0x194/0x257
[   17.931947]  ? arch_local_irq_restore+0x53/0x53
[   17.932368]  ? show_regs_print_info+0x65/0x65
[   17.932773]  ? __netif_receive_skb_core+0x2be3/0x33d0
[   17.933250]  print_address_description+0x73/0x250
[   17.933675]  ? __netif_receive_skb_core+0x2be3/0x33d0
[   17.934151]  kasan_report+0x24e/0x340
[   17.934502]  __asan_report_load2_noabort+0x14/0x20
[   17.935191]  __netif_receive_skb_core+0x2be3/0x33d0
[   17.935682]  ? nf_ingress+0x9f0/0x9f0
[   17.936059]  ? __read_once_size_nocheck.constprop.8+0x10/0x10
[   17.936642]  ? secondary_startup_64+0xa5/0xa5
[   17.937059]  ? x86_64_start_kernel+0x87/0x8a
[   17.937464]  ? bpf_prog_alloc+0x310/0x310
[   17.937846]  ? check_noncircular+0x20/0x20
[   17.938236]  ? unwind_next_frame.part.6+0x1ae/0xc70
[   17.938691]  ? lock_release+0xd70/0xd70
[   17.939064]  ? unwind_dump+0x4c0/0x4c0
[   17.939422]  ? check_noncircular+0x20/0x20
[   17.939948]  ? find_held_lock+0x39/0x1d0
[   17.940324]  ? lock_downgrade+0x990/0x990
[   17.940683]  ? lock_acquire+0x1d5/0x580
[   17.941047]  ? netif_receive_skb_internal+0x1d7/0x5e0
[   17.941521]  ? find_held_lock+0x39/0x1d0
[   17.941902]  ? pvclock_read_flags+0x160/0x160
[   17.942312]  ? lock_downgrade+0x990/0x990
[   17.942699]  ? lock_acquire+0x1d5/0x580
[   17.943065]  ? netif_receive_skb_internal+0x93/0x5e0
[   17.943530]  ? ktime_get_with_offset+0x2c1/0x420
[   17.943972]  ? lock_release+0xd70/0xd70
[   17.944337]  ? ktime_get+0x3a0/0x3a0
[   17.944689]  __netif_receive_skb+0x2c/0x1b0
[   17.945083]  ? __netif_receive_skb+0x2c/0x1b0
[   17.945496]  netif_receive_skb_internal+0x10b/0x5e0
[   17.945951]  ? __build_skb+0x9d/0x450
[   17.946279]  ? dev_cpu_dead+0xb00/0xb00
[   17.946612]  ? net_rx_action+0x1910/0x1910
[   17.946993]  ? kmem_cache_alloc+0x469/0x760
[   17.947418]  ? rcu_pm_notify+0xc0/0xc0
[   17.947771]  ? refcount_sub_and_test+0x115/0x1b0
[   17.948209]  ? skb_gro_reset_offset+0x17b/0x300
[   17.948635]  napi_gro_receive+0x3d0/0x500
[   17.949009]  ? dev_gro_receive+0x19b0/0x19b0
[   17.949403]  ? __alloc_pages_nodemask+0xd80/0xd80
[   17.949836]  ? eth_type_trans+0x2a3/0x650
[   17.950208]  ? rcu_pm_notify+0xc0/0xc0
[   17.950560]  ? eth_gro_receive+0x810/0x810
[   17.950951]  e1000_clean_rx_irq+0x58d/0x1330
[   17.951361]  ? e1000_clean_jumbo_rx_irq+0x27d0/0x27d0
[   17.951834]  ? dql_init+0x2e0/0x2e0
[   17.952173]  ? __dev_kfree_skb_any+0x8a/0xa0
[   17.952573]  ? e1000_unmap_and_free_tx_resource.isra.46+0x1eb/0x390
[   17.953148]  ? save_stack_trace+0x16/0x20
[   17.953528]  ? e1000_clean_jumbo_rx_irq+0x27d0/0x27d0
[   17.953997]  e1000_clean+0xb39/0x2610
[   17.954363]  ? e1000_unmap_and_free_tx_resource.isra.46+0x390/0x390
[   17.954938]  ? unwind_next_frame.part.6+0x1ae/0xc70
[   17.955393]  ? unwind_dump+0x4c0/0x4c0
[   17.955750]  ? unwind_dump+0x4c0/0x4c0
[   17.956117]  ? net_rx_action+0x49b/0x1910
[   17.956722]  net_rx_action+0x792/0x1910
[   17.957092]  ? napi_complete_done+0x6c0/0x6c0
[   17.957502]  ? check_noncircular+0x20/0x20
[   17.957898]  ? __lock_acquire+0x20fd/0x4620
[   17.958283]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   17.958764]  ? find_held_lock+0x39/0x1d0
[   17.959141]  ? lock_downgrade+0x990/0x990
[   17.959527]  ? __wake_up+0x1e/0x50
[   17.959838]  ? do_raw_spin_trylock+0x190/0x190
[   17.960247]  ? match_held_lock+0x980/0x9f0
[   17.960629]  ? kill_fasync+0x3ba/0x540
[   17.960946]  ? send_sigio+0x320/0x320
[   17.961321]  ? _raw_spin_unlock_irqrestore+0xa6/0xba
[   17.961787]  ? __wake_up+0x3f/0x50
[   17.962115]  ? check_noncircular+0x20/0x20
[   17.962504]  ? credit_entropy_bits+0x4bc/0x880
[   17.962924]  ? add_interrupt_randomness+0x422/0x7f0
[   17.963381]  ? crng_reseed+0x5f0/0x5f0
[   17.963710]  ? rcu_read_lock_sched_held+0x108/0x120
[   17.964175]  ? __handle_irq_event_percpu+0x308/0x9d0
[   17.964643]  ? rcu_pm_notify+0xc0/0xc0
[   17.965008]  __do_softirq+0x2bb/0xbd0
[   17.965364]  ? __softirqentry_text_start+0x8/0x8
[   17.965799]  ? do_raw_spin_trylock+0x190/0x190
[   17.966214]  ? handle_irq_event_percpu+0x141/0x1b0
[   17.966657]  ? __handle_irq_event_percpu+0x9d0/0x9d0
[   17.967125]  ? kvm_guest_apic_eoi_write+0x6a/0x80
[   17.967566]  ? ioapic_ack_level+0x165/0x450
[   17.967964]  ? _raw_spin_lock+0x32/0x40
[   17.968330]  ? ioapic_ir_ack_level+0xd0/0xd0
[   17.968733]  ? _raw_spin_unlock+0x22/0x30
[   17.969113]  ? handle_fasteoi_irq+0x2db/0x510
[   17.969532]  irq_exit+0x1d3/0x210
[   17.969852]  do_IRQ+0xf6/0x190
[   17.970150]  common_interrupt+0x9d/0x9d
[   17.970435]  </IRQ>
[   17.970646] RIP: 0010:native_safe_halt+0x6/0x10
[   17.971072] RSP: 0018:ffffffff85a07d10 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffc5
[   17.971772] RAX: dffffc0000000000 RBX: 1ffffffff0b40fa5 RCX: 0000000000000000
[   17.972433] RDX: 1ffffffff0b59308 RSI: 0000000000000001 RDI: ffffffff85ac9840
[   17.973089] RBP: ffffffff85a07d10 R08: ffffffff8161c679 R09: 0000000000000000
[   17.973824] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85ac9830
[   17.974481] R13: ffffffff85a07dc8 R14: 0000000000000000 R15: ffffffff85a2f380
[   17.975144]  ? tick_nohz_idle_enter+0xd9/0x160
[   17.975569]  default_idle+0xbf/0x460
[   17.975915]  ? __sched_text_end+0x4/0x4
[   17.976294]  arch_cpu_idle+0xa/0x10
[   17.976627]  default_idle_call+0x36/0x90
[   17.977001]  do_idle+0x256/0x3b0
[   17.977256]  cpu_startup_entry+0x18/0x20
[   17.977863]  rest_init+0xed/0xf0
[   17.978175]  start_kernel+0x72e/0x754
[   17.978524]  ? mem_encrypt_init+0xb/0xb
[   17.978893]  ? memcpy_orig+0x54/0x110
[   17.979248]  x86_64_start_reservations+0x2a/0x2c
[   17.979681]  x86_64_start_kernel+0x87/0x8a
[   17.980083]  secondary_startup_64+0xa5/0xa5
[   17.980489] 
[   17.980642] Allocated by task 3063:
[   17.980973]  save_stack_trace+0x16/0x20
[   17.981335]  save_stack+0x43/0xd0
[   17.981650]  kasan_kmalloc+0xad/0xe0
[   17.981988]  kmem_cache_alloc_trace+0x136/0x750
[   17.982411]  fanout_add+0xa50/0x1190
[   17.982750]  packet_setsockopt+0xfdc/0x1e80
[   17.983171]  SyS_setsockopt+0x189/0x360
[   17.983532]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   17.983963] 
[   17.984114] Freed by task 2996:
[   17.984414]  save_stack_trace+0x16/0x20
[   17.984779]  save_stack+0x43/0xd0
[   17.985095]  kasan_slab_free+0x71/0xc0
[   17.985452]  kfree+0xca/0x250
[   17.985767]  packet_release+0xa8f/0xd70
[   17.986131]  sock_release+0x8d/0x1e0
[   17.986470]  sock_close+0x16/0x20
[   17.986786]  __fput+0x333/0x7f0
[   17.987087]  ____fput+0x15/0x20
[   17.987328]  task_work_run+0x199/0x270
[   17.987680]  do_exit+0xa52/0x1b40
[   17.988006]  do_group_exit+0x149/0x400
[   17.988363]  SyS_exit_group+0x1d/0x20
[   17.988711]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   17.989142] 
[   17.989294] The buggy address belongs to the object at ffff88006c2a0640
[   17.989294]  which belongs to the cache kmalloc-4096 of size 4096
[   17.990446] The buggy address is located 2176 bytes inside of
[   17.990446]  4096-byte region [ffff88006c2a0640, ffff88006c2a1640)
[   17.991528] The buggy address belongs to the page:
[   17.991980] page:ffffea0001b0a800 count:1 mapcount:0 mapping:ffff88006c2a0640 index:0x0 compound_mapcount: 0
[   17.992886] flags: 0x500000000008100(slab|head)
[   17.993312] raw: 0500000000008100 ffff88006c2a0640 0000000000000000 0000000100000001
[   17.994025] raw: ffffea0001b0d420 ffffea0001b061a0 ffff88003e800dc0 0000000000000000
[   17.994733] page dumped because: kasan: bad access detected
[   17.995248] 
[   17.995423] Memory state around the buggy address:
[   17.995874]  ffff88006c2a0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   17.996585]  ffff88006c2a0e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   17.997246] >ffff88006c2a0e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   17.997921]                                            ^
[   17.998414]  ffff88006c2a0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   17.999316]  ffff88006c2a0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.000014] ==================================================================
[   18.000675] Disabling lock debugging due to kernel taint
[   18.001181] Kernel panic - not syncing: panic_on_warn set ...
[   18.001181] 
[   18.001838] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G    B           4.13.0-rc7-next-20170901+ #13
[   18.002639] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
[   18.003373] Call Trace:
[   18.003605]  <IRQ>
[   18.003803]  dump_stack+0x194/0x257
[   18.004138]  ? arch_local_irq_restore+0x53/0x53
[   18.004558]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.004988]  ? __netif_receive_skb_core+0x2bc0/0x33d0
[   18.005455]  panic+0x1e4/0x417
[   18.005744]  ? __warn+0x1d9/0x1d9
[   18.006060]  ? __netif_receive_skb_core+0x2be3/0x33d0
[   18.006549]  kasan_end_report+0x50/0x50
[   18.006906]  kasan_report+0x137/0x340
[   18.007249]  __asan_report_load2_noabort+0x14/0x20
[   18.007690]  __netif_receive_skb_core+0x2be3/0x33d0
[   18.008147]  ? nf_ingress+0x9f0/0x9f0
[   18.008493]  ? __read_once_size_nocheck.constprop.8+0x10/0x10
[   18.009021]  ? secondary_startup_64+0xa5/0xa5
[   18.009428]  ? x86_64_start_kernel+0x87/0x8a
[   18.009834]  ? bpf_prog_alloc+0x310/0x310
[   18.010208]  ? check_noncircular+0x20/0x20
[   18.010590]  ? unwind_next_frame.part.6+0x1ae/0xc70
[   18.011040]  ? lock_release+0xd70/0xd70
[   18.011399]  ? unwind_dump+0x4c0/0x4c0
[   18.011749]  ? check_noncircular+0x20/0x20
[   18.012135]  ? find_held_lock+0x39/0x1d0
[   18.012507]  ? lock_downgrade+0x990/0x990
[   18.012884]  ? lock_acquire+0x1d5/0x580
[   18.013241]  ? netif_receive_skb_internal+0x1d7/0x5e0
[   18.013706]  ? find_held_lock+0x39/0x1d0
[   18.014076]  ? pvclock_read_flags+0x160/0x160
[   18.014480]  ? lock_downgrade+0x990/0x990
[   18.014855]  ? lock_acquire+0x1d5/0x580
[   18.015213]  ? netif_receive_skb_internal+0x93/0x5e0
[   18.015669]  ? ktime_get_with_offset+0x2c1/0x420
[   18.016106]  ? lock_release+0xd70/0xd70
[   18.016464]  ? ktime_get+0x3a0/0x3a0
[   18.016804]  __netif_receive_skb+0x2c/0x1b0
[   18.017195]  ? __netif_receive_skb+0x2c/0x1b0
[   18.017601]  netif_receive_skb_internal+0x10b/0x5e0
[   18.018051]  ? __build_skb+0x9d/0x450
[   18.018421]  ? dev_cpu_dead+0xb00/0xb00
[   18.018863]  ? net_rx_action+0x1910/0x1910
[   18.019245]  ? kmem_cache_alloc+0x469/0x760
[   18.019634]  ? rcu_pm_notify+0xc0/0xc0
[   18.019990]  ? refcount_sub_and_test+0x115/0x1b0
[   18.020649]  ? skb_gro_reset_offset+0x17b/0x300
[   18.021069]  napi_gro_receive+0x3d0/0x500
[   18.021443]  ? dev_gro_receive+0x19b0/0x19b0
[   18.021865]  ? __alloc_pages_nodemask+0xd80/0xd80
[   18.022329]  ? eth_type_trans+0x2a3/0x650
[   18.022701]  ? rcu_pm_notify+0xc0/0xc0
[   18.023053]  ? eth_gro_receive+0x810/0x810
[   18.023439]  e1000_clean_rx_irq+0x58d/0x1330
[   18.023842]  ? e1000_clean_jumbo_rx_irq+0x27d0/0x27d0
[   18.024325]  ? dql_init+0x2e0/0x2e0
[   18.024654]  ? __dev_kfree_skb_any+0x8a/0xa0
[   18.025051]  ? e1000_unmap_and_free_tx_resource.isra.46+0x1eb/0x390
[   18.025651]  ? save_stack_trace+0x16/0x20
[   18.026025]  ? e1000_clean_jumbo_rx_irq+0x27d0/0x27d0
[   18.026488]  e1000_clean+0xb39/0x2610
[   18.026755]  ? e1000_unmap_and_free_tx_resource.isra.46+0x390/0x390
[   18.027193]  ? unwind_next_frame.part.6+0x1ae/0xc70
[   18.027646]  ? unwind_dump+0x4c0/0x4c0
[   18.028000]  ? unwind_dump+0x4c0/0x4c0
[   18.028354]  ? net_rx_action+0x49b/0x1910
[   18.028730]  net_rx_action+0x792/0x1910
[   18.029093]  ? napi_complete_done+0x6c0/0x6c0
[   18.029499]  ? check_noncircular+0x20/0x20
[   18.029880]  ? __lock_acquire+0x20fd/0x4620
[   18.030271]  ? debug_check_no_locks_freed+0x3d0/0x3d0
[   18.030745]  ? find_held_lock+0x39/0x1d0
[   18.031117]  ? lock_downgrade+0x990/0x990
[   18.031521]  ? __wake_up+0x1e/0x50
[   18.031845]  ? do_raw_spin_trylock+0x190/0x190
[   18.032252]  ? match_held_lock+0x980/0x9f0
[   18.032625]  ? kill_fasync+0x3ba/0x540
[   18.032969]  ? send_sigio+0x320/0x320
[   18.033307]  ? _raw_spin_unlock_irqrestore+0xa6/0xba
[   18.033751]  ? __wake_up+0x3f/0x50
[   18.034064]  ? check_noncircular+0x20/0x20
[   18.034376]  ? credit_entropy_bits+0x4bc/0x880
[   18.034777]  ? add_interrupt_randomness+0x422/0x7f0
[   18.035216]  ? crng_reseed+0x5f0/0x5f0
[   18.035587]  ? rcu_read_lock_sched_held+0x108/0x120
[   18.036034]  ? __handle_irq_event_percpu+0x308/0x9d0
[   18.036493]  ? rcu_pm_notify+0xc0/0xc0
[   18.036874]  __do_softirq+0x2bb/0xbd0
[   18.037220]  ? __softirqentry_text_start+0x8/0x8
[   18.037648]  ? do_raw_spin_trylock+0x190/0x190
[   18.038059]  ? handle_irq_event_percpu+0x141/0x1b0
[   18.038498]  ? __handle_irq_event_percpu+0x9d0/0x9d0
[   18.038956]  ? kvm_guest_apic_eoi_write+0x6a/0x80
[   18.039387]  ? ioapic_ack_level+0x165/0x450
[   18.039772]  ? _raw_spin_lock+0x32/0x40
[   18.040131]  ? ioapic_ir_ack_level+0xd0/0xd0
[   18.040525]  ? _raw_spin_unlock+0x22/0x30
[   18.040896]  ? handle_fasteoi_irq+0x2db/0x510
[   18.041305]  irq_exit+0x1d3/0x210
[   18.041615]  do_IRQ+0xf6/0x190
[   18.042134]  common_interrupt+0x9d/0x9d
[   18.042487]  </IRQ>
[   18.042690] RIP: 0010:native_safe_halt+0x6/0x10
[   18.043104] RSP: 0018:ffffffff85a07d10 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffc5
[   18.043787] RAX: dffffc0000000000 RBX: 1ffffffff0b40fa5 RCX: 0000000000000000
[   18.044286] RDX: 1ffffffff0b59308 RSI: 0000000000000001 RDI: ffffffff85ac9840
[   18.044812] RBP: ffffffff85a07d10 R08: ffffffff8161c679 R09: 0000000000000000
[   18.045450] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85ac9830
[   18.046089] R13: ffffffff85a07dc8 R14: 0000000000000000 R15: ffffffff85a2f380
[   18.046735]  ? tick_nohz_idle_enter+0xd9/0x160
[   18.047146]  default_idle+0xbf/0x460
[   18.047543]  ? __sched_text_end+0x4/0x4
[   18.047909]  arch_cpu_idle+0xa/0x10
[   18.048235]  default_idle_call+0x36/0x90
[   18.048598]  do_idle+0x256/0x3b0
[   18.048862]  cpu_startup_entry+0x18/0x20
[   18.049252]  rest_init+0xed/0xf0
[   18.049581]  start_kernel+0x72e/0x754
[   18.049846]  ? mem_encrypt_init+0xb/0xb
[   18.050112]  ? memcpy_orig+0x54/0x110
[   18.050416]  x86_64_start_reservations+0x2a/0x2c
[   18.050840]  x86_64_start_kernel+0x87/0x8a
[   18.051218]  secondary_startup_64+0xa5/0xa5
[   18.051640] Dumping ftrace buffer:
[   18.051893]    (ftrace buffer empty)
[   18.052145] Kernel Offset: disabled
[   18.052393] Rebooting in 86400 seconds..