[....] Starting enhanced syslogd: rsyslogd[ 9.886846] audit: type=1400 audit(1515865044.145:4): avc: denied { syslog } for pid=3173 comm="rsyslogd" capability=34 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=capability2 permissive=1 [?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Starting mcstransd: [....] Starting periodic command scheduler: cron[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting file context maintaining daemon: restorecond[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.60' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 33.735096] ================================================================== [ 33.736290] BUG: KASAN: use-after-free in __lock_acquire+0x2eff/0x3640 [ 33.737182] Read of size 8 at addr ffff8801ccb6cfb8 by task syzkaller290577/3345 [ 33.738168] [ 33.738419] CPU: 1 PID: 3345 Comm: syzkaller290577 Not tainted 4.9.76-g8e170a5 #21 [ 33.739447] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 33.740691] ffff8801c830f870 ffffffff81d93149 ffffea000732db00 ffff8801ccb6cfb8 [ 33.741854] 0000000000000000 ffff8801ccb6cfb8 ffff8801ccb6cfb8 ffff8801c830f8a8 [ 33.743057] ffffffff8153cb43 ffff8801ccb6cfb8 0000000000000008 0000000000000000 [ 33.744237] Call Trace: [ 33.744698] [] dump_stack+0xc1/0x128 [ 33.745424] [] print_address_description+0x73/0x280 [ 33.746302] [] kasan_report+0x275/0x360 [ 33.747050] [] ? __lock_acquire+0x2eff/0x3640 [ 33.747862] [] __asan_report_load8_noabort+0x14/0x20 [ 33.748768] [] __lock_acquire+0x2eff/0x3640 [ 33.749556] [] ? __lock_acquire+0x629/0x3640 [ 33.750374] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 33.751296] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 33.752252] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 33.753174] [] ? mark_held_locks+0xaf/0x100 [ 33.753966] [] ? mutex_lock_nested+0x5e3/0x870 [ 33.754791] [] lock_acquire+0x12e/0x410 [ 33.756396] [] ? remove_wait_queue+0x14/0x40 [ 33.762424] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 33.768719] [] ? remove_wait_queue+0x14/0x40 [ 33.774748] [] remove_wait_queue+0x14/0x40 [ 33.780604] [] ep_unregister_pollwait.isra.6+0xaf/0x240 [ 33.787585] [] ? ep_unregister_pollwait.isra.6+0x12a/0x240 [ 33.794836] [] ? ep_free+0x1b0/0x1b0 [ 33.800166] [] ep_free+0x96/0x1b0 [ 33.805244] [] ? ep_free+0x1b0/0x1b0 [ 33.810579] [] ep_eventpoll_release+0x44/0x60 [ 33.816691] [] __fput+0x28c/0x6e0 [ 33.821764] [] ____fput+0x15/0x20 [ 33.826840] [] task_work_run+0x115/0x190 [ 33.832531] [] do_exit+0x7e7/0x2a40 [ 33.837777] [] ? __pmd_alloc+0x410/0x410 [ 33.843459] [] ? release_task+0x1240/0x1240 [ 33.849401] [] ? __do_page_fault+0x5ec/0xd40 [ 33.855429] [] ? up_read+0x1a/0x40 [ 33.860586] [] ? __do_page_fault+0x3bd/0xd40 [ 33.866610] [] do_group_exit+0x108/0x320 [ 33.872287] [] ? do_group_exit+0x320/0x320 [ 33.878139] [] SyS_exit_group+0x1d/0x20 [ 33.883730] [] do_fast_syscall_32+0x2f7/0x890 [ 33.889842] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 33.896477] [] entry_SYSENTER_compat+0x74/0x83 [ 33.902676] [ 33.904272] Allocated by task 3345: [ 33.907866] save_stack_trace+0x16/0x20 [ 33.911813] save_stack+0x43/0xd0 [ 33.915240] kasan_kmalloc+0xad/0xe0 [ 33.918924] kmem_cache_alloc_trace+0xfb/0x2a0 [ 33.923475] binder_get_thread+0x15d/0x750 [ 33.927677] binder_poll+0x4a/0x210 [ 33.931276] SyS_epoll_ctl+0x11d7/0x2190 [ 33.935304] do_fast_syscall_32+0x2f7/0x890 [ 33.939594] entry_SYSENTER_compat+0x74/0x83 [ 33.943970] [ 33.945564] Freed by task 3345: [ 33.948813] save_stack_trace+0x16/0x20 [ 33.952761] save_stack+0x43/0xd0 [ 33.956183] kasan_slab_free+0x72/0xc0 [ 33.960039] kfree+0x103/0x300 [ 33.963198] binder_thread_dec_tmpref+0x1cc/0x240 [ 33.968010] binder_thread_release+0x27d/0x540 [ 33.972571] binder_ioctl+0x9c0/0x11b0 [ 33.976429] compat_SyS_ioctl+0x15f/0x2050 [ 33.980632] do_fast_syscall_32+0x2f7/0x890 [ 33.984931] entry_SYSENTER_compat+0x74/0x83 [ 33.989301] [ 33.990899] The buggy address belongs to the object at ffff8801ccb6cf00 [ 33.990899] which belongs to the cache kmalloc-512 of size 512 [ 34.003524] The buggy address is located 184 bytes inside of [ 34.003524] 512-byte region [ffff8801ccb6cf00, ffff8801ccb6d100) [ 34.015363] The buggy address belongs to the page: [ 34.020260] page:ffffea000732db00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 34.030437] flags: 0x8000000000004080(slab|head) [ 34.035159] page dumped because: kasan: bad access detected [ 34.040832] [ 34.042426] Memory state around the buggy address: [ 34.047320] ffff8801ccb6ce80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 34.054644] ffff8801ccb6cf00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.061977] >ffff8801ccb6cf80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.069305] ^ [ 34.074464] ffff8801ccb6d000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.081793] ffff8801ccb6d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 34.089117] ================================================================== [ 34.096450] Disabling lock debugging due to kernel taint [ 34.101868] Kernel panic - not syncing: panic_on_warn set ... [ 34.101868] [ 34.109200] CPU: 1 PID: 3345 Comm: syzkaller290577 Tainted: G B 4.9.76-g8e170a5 #21 [ 34.118091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 34.127415] ffff8801c830f7c8 ffffffff81d93149 ffffffff84195c17 ffff8801c830f8a0 [ 34.135382] 0000000000000000 ffff8801ccb6cfb8 ffff8801ccb6cfb8 ffff8801c830f890 [ 34.143348] ffffffff8142e371 0000000041b58ab3 ffffffff84189678 ffffffff8142e1b5 [ 34.151314] Call Trace: [ 34.153876] [] dump_stack+0xc1/0x128 [ 34.159208] [] panic+0x1bc/0x3a8 [ 34.164196] [] ? percpu_up_read_preempt_enable.constprop.53+0xd7/0xd7 [ 34.172390] [] ? add_taint+0x40/0x50 [ 34.177734] [] kasan_end_report+0x50/0x50 [ 34.183504] [] kasan_report+0x167/0x360 [ 34.189107] [] ? __lock_acquire+0x2eff/0x3640 [ 34.195219] [] __asan_report_load8_noabort+0x14/0x20 [ 34.201941] [] __lock_acquire+0x2eff/0x3640 [ 34.207882] [] ? __lock_acquire+0x629/0x3640 [ 34.213908] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 34.220890] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 34.227874] [] ? debug_check_no_locks_freed+0x2c0/0x2c0 [ 34.234858] [] ? mark_held_locks+0xaf/0x100 [ 34.240818] [] ? mutex_lock_nested+0x5e3/0x870 [ 34.247020] [] lock_acquire+0x12e/0x410 [ 34.252621] [] ? remove_wait_queue+0x14/0x40 [ 34.258649] [] _raw_spin_lock_irqsave+0x4e/0x70 [ 34.264938] [] ? remove_wait_queue+0x14/0x40 [ 34.270965] [] remove_wait_queue+0x14/0x40 [ 34.276824] [] ep_unregister_pollwait.isra.6+0xaf/0x240 [ 34.283808] [] ? ep_unregister_pollwait.isra.6+0x12a/0x240 [ 34.291049] [] ? ep_free+0x1b0/0x1b0 [ 34.296390] [] ep_free+0x96/0x1b0 [ 34.301460] [] ? ep_free+0x1b0/0x1b0 [ 34.306794] [] ep_eventpoll_release+0x44/0x60 [ 34.312913] [] __fput+0x28c/0x6e0 [ 34.317993] [] ____fput+0x15/0x20 [ 34.323070] [] task_work_run+0x115/0x190 [ 34.328754] [] do_exit+0x7e7/0x2a40 [ 34.333999] [] ? __pmd_alloc+0x410/0x410 [ 34.339676] [] ? release_task+0x1240/0x1240 [ 34.345616] [] ? __do_page_fault+0x5ec/0xd40 [ 34.351666] [] ? up_read+0x1a/0x40 [ 34.356829] [] ? __do_page_fault+0x3bd/0xd40 [ 34.362854] [] do_group_exit+0x108/0x320 [ 34.368535] [] ? do_group_exit+0x320/0x320 [ 34.374389] [] SyS_exit_group+0x1d/0x20 [ 34.379983] [] do_fast_syscall_32+0x2f7/0x890 [ 34.386106] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 34.392743] [] entry_SYSENTER_compat+0x74/0x83 [ 34.399348] Dumping ftrace buffer: [ 34.402854] (ftrace buffer empty) [ 34.406532] Kernel Offset: disabled [ 34.410130] Rebooting in 86400 seconds..