INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-9,10.128.15.204' (ECDSA) to the list of known hosts.
2017/09/20 18:33:12 parsed 1 programs
2017/09/20 18:33:12 executed programs: 0
syzkaller login: [   52.956008] ==================================================================
[   52.963455] BUG: KASAN: use-after-free in packet_getsockopt+0xc72/0xe00
[   52.970180] Read of size 8 at addr ffff8801cc8c2e58 by task syz-executor0/3141
[   52.977508] 
[   52.979111] CPU: 1 PID: 3141 Comm: syz-executor0 Not tainted 4.14.0-rc1+ #93
[   52.986275] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   52.995602] Call Trace:
[   52.998162]  dump_stack+0x194/0x257
[   53.001764]  ? arch_local_irq_restore+0x53/0x53
[   53.006404]  ? show_regs_print_info+0x65/0x65
[   53.010883]  ? lock_release+0xd70/0xd70
[   53.014833]  ? packet_getsockopt+0xc72/0xe00
[   53.019214]  print_address_description+0x73/0x250
[   53.024030]  ? packet_getsockopt+0xc72/0xe00
[   53.028412]  kasan_report+0x24e/0x340
[   53.032190]  __asan_report_load8_noabort+0x14/0x20
[   53.037091]  packet_getsockopt+0xc72/0xe00
[   53.041300]  ? packet_notifier+0x950/0x950
[   53.045509]  ? iput+0x540/0xaf0
[   53.048775]  ? __fget_light+0x29d/0x390
[   53.052722]  ? sock_has_perm+0x29c/0x400
[   53.056757]  ? selinux_tun_dev_create+0xc0/0xc0
[   53.061397]  ? free_modinfo_version+0x70/0x70
[   53.065864]  ? __sk_free+0x5c/0x230
[   53.069469]  ? exit_to_usermode_loop+0x98/0x300
[   53.074112]  ? trace_hardirqs_off+0xd/0x10
[   53.078318]  ? exit_to_usermode_loop+0x1a8/0x300
[   53.083051]  ? selinux_socket_getsockopt+0x36/0x40
[   53.087954]  ? security_socket_getsockopt+0x89/0xb0
[   53.092952]  SyS_getsockopt+0x178/0x340
[   53.096910]  ? SyS_setsockopt+0x360/0x360
[   53.101034]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   53.105848]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   53.110835]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   53.115566]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   53.120291] RIP: 0033:0x4520a9
[   53.123451] RSP: 002b:00007eff0969ec08 EFLAGS: 00000216 ORIG_RAX: 0000000000000037
[   53.131132] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[   53.138370] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000c
[   53.145618] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   53.152861] R10: 0000000020ec8000 R11: 0000000000000216 R12: 00000000004bb9a3
[   53.160100] R13: 00000000ffffffff R14: 000000000000000a R15: 0000000000000001
[   53.167356] 
[   53.168959] Allocated by task 3140:
[   53.172562]  save_stack_trace+0x16/0x20
[   53.176509]  save_stack+0x43/0xd0
[   53.179930]  kasan_kmalloc+0xad/0xe0
[   53.183615]  kmem_cache_alloc_trace+0x136/0x750
[   53.188257]  fanout_add+0x345/0x1190
[   53.191942]  packet_setsockopt+0xfdc/0x1e80
[   53.196234]  SyS_setsockopt+0x189/0x360
[   53.200181]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   53.204901] 
[   53.206498] Freed by task 3140:
[   53.209745]  save_stack_trace+0x16/0x20
[   53.213687]  save_stack+0x43/0xd0
[   53.217107]  kasan_slab_free+0x71/0xc0
[   53.220963]  kfree+0xca/0x250
[   53.224038]  fanout_add+0x2d0/0x1190
[   53.227723]  packet_setsockopt+0xfdc/0x1e80
[   53.232022]  SyS_setsockopt+0x189/0x360
[   53.235964]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   53.240685] 
[   53.242284] The buggy address belongs to the object at ffff8801cc8c2e40
[   53.242284]  which belongs to the cache kmalloc-128 of size 128
[   53.254916] The buggy address is located 24 bytes inside of
[   53.254916]  128-byte region [ffff8801cc8c2e40, ffff8801cc8c2ec0)
[   53.266673] The buggy address belongs to the page:
[   53.271577] page:ffffea0007323080 count:1 mapcount:0 mapping:ffff8801cc8c2000 index:0x0
[   53.279692] flags: 0x200000000000100(slab)
[   53.283900] raw: 0200000000000100 ffff8801cc8c2000 0000000000000000 0000000100000015
[   53.291750] raw: ffffea000734e120 ffffea000732e620 ffff8801dac00640 0000000000000000
[   53.299601] page dumped because: kasan: bad access detected
[   53.305278] 
[   53.306875] Memory state around the buggy address:
[   53.311773]  ffff8801cc8c2d00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   53.319102]  ffff8801cc8c2d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   53.326430] >ffff8801cc8c2e00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   53.333758]                                                     ^
[   53.339959]  ffff8801cc8c2e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   53.347286]  ffff8801cc8c2f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   53.354611] ==================================================================
[   53.361937] Disabling lock debugging due to kernel taint
[   53.367428] Kernel panic - not syncing: panic_on_warn set ...
[   53.367428] 
[   53.374769] CPU: 1 PID: 3141 Comm: syz-executor0 Tainted: G    B           4.14.0-rc1+ #93
[   53.383133] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   53.392460] Call Trace:
[   53.395016]  dump_stack+0x194/0x257
[   53.398610]  ? arch_local_irq_restore+0x53/0x53
[   53.403248]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   53.407975]  ? packet_getsockopt+0xc20/0xe00
[   53.412350]  panic+0x1e4/0x417
[   53.415509]  ? __warn+0x1d9/0x1d9
[   53.418934]  ? packet_getsockopt+0xc72/0xe00
[   53.423310]  kasan_end_report+0x50/0x50
[   53.427250]  kasan_report+0x137/0x340
[   53.431017]  __asan_report_load8_noabort+0x14/0x20
[   53.435926]  packet_getsockopt+0xc72/0xe00
[   53.440127]  ? packet_notifier+0x950/0x950
[   53.444324]  ? iput+0x540/0xaf0
[   53.447570]  ? __fget_light+0x29d/0x390
[   53.451511]  ? sock_has_perm+0x29c/0x400
[   53.455538]  ? selinux_tun_dev_create+0xc0/0xc0
[   53.460175]  ? free_modinfo_version+0x70/0x70
[   53.464635]  ? __sk_free+0x5c/0x230
[   53.468227]  ? exit_to_usermode_loop+0x98/0x300
[   53.472865]  ? trace_hardirqs_off+0xd/0x10
[   53.477062]  ? exit_to_usermode_loop+0x1a8/0x300
[   53.481782]  ? selinux_socket_getsockopt+0x36/0x40
[   53.486677]  ? security_socket_getsockopt+0x89/0xb0
[   53.491661]  SyS_getsockopt+0x178/0x340
[   53.495605]  ? SyS_setsockopt+0x360/0x360
[   53.499723]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   53.504531]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   53.509511]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   53.514234]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   53.518952] RIP: 0033:0x4520a9
[   53.522108] RSP: 002b:00007eff0969ec08 EFLAGS: 00000216 ORIG_RAX: 0000000000000037
[   53.529779] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[   53.537012] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000c
[   53.544246] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   53.551481] R10: 0000000020ec8000 R11: 0000000000000216 R12: 00000000004bb9a3
[   53.558715] R13: 00000000ffffffff R14: 000000000000000a R15: 0000000000000001
[   53.565999] Dumping ftrace buffer:
[   53.569504]    (ftrace buffer empty)
[   53.573179] Kernel Offset: disabled
[   53.576773] Rebooting in 86400 seconds..