INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-4,10.128.0.44' (ECDSA) to the list of known hosts.
2017/09/21 00:28:32 parsed 1 programs
2017/09/21 00:28:32 executed programs: 0
2017/09/21 00:28:37 executed programs: 74
syzkaller login: [   39.199615] ==================================================================
[   39.207010] BUG: KASAN: use-after-free in packet_getsockopt+0xc72/0xe00
[   39.213730] Read of size 8 at addr ffff8801cd649c18 by task syz-executor0/3283
[   39.221056] 
[   39.222658] CPU: 0 PID: 3283 Comm: syz-executor0 Not tainted 4.14.0-rc1-next-20170920+ #26
[   39.231027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.240357] Call Trace:
[   39.242918]  dump_stack+0x194/0x257
[   39.246518]  ? arch_local_irq_restore+0x53/0x53
[   39.251162]  ? show_regs_print_info+0x65/0x65
[   39.255626]  ? lock_release+0xd70/0xd70
[   39.259574]  ? packet_getsockopt+0xc72/0xe00
[   39.263952]  print_address_description+0x73/0x250
[   39.268763]  ? packet_getsockopt+0xc72/0xe00
[   39.273141]  kasan_report+0x24e/0x340
[   39.276916]  __asan_report_load8_noabort+0x14/0x20
[   39.281816]  packet_getsockopt+0xc72/0xe00
[   39.286022]  ? packet_notifier+0x950/0x950
[   39.290224]  ? iput+0x540/0xaf0
[   39.293479]  ? __fget_light+0x29d/0x390
[   39.297422]  ? sock_has_perm+0x29c/0x400
[   39.301453]  ? selinux_tun_dev_create+0xc0/0xc0
[   39.306090]  ? free_modinfo_version+0x70/0x70
[   39.310554]  ? __sk_free+0x5c/0x230
[   39.314150]  ? sk_free+0x2f/0x40
[   39.317501]  ? selinux_socket_getsockopt+0x36/0x40
[   39.322401]  ? security_socket_getsockopt+0x89/0xb0
[   39.327390]  SyS_getsockopt+0x178/0x340
[   39.331336]  ? SyS_setsockopt+0x360/0x360
[   39.335456]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   39.340273]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   39.345261]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   39.349992]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   39.354715] RIP: 0033:0x4520a9
[   39.357874] RSP: 002b:00007f85f63adc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000037
[   39.365555] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[   39.372794] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000c
[   39.380032] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   39.387271] R10: 0000000020ec8000 R11: 0000000000000216 R12: 0000000000000000
[   39.394509] R13: 00007ffe443abb1f R14: 00007f85f63ae9c0 R15: 0000000000000002
[   39.401770] 
[   39.403369] Allocated by task 3282:
[   39.406966]  save_stack_trace+0x16/0x20
[   39.410912]  save_stack+0x43/0xd0
[   39.414334]  kasan_kmalloc+0xad/0xe0
[   39.418015]  kmem_cache_alloc_trace+0x136/0x750
[   39.422653]  fanout_add+0x345/0x1190
[   39.426333]  packet_setsockopt+0xfdc/0x1e80
[   39.430635]  SyS_setsockopt+0x189/0x360
[   39.434578]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   39.439300] 
[   39.440899] Freed by task 3282:
[   39.444145]  save_stack_trace+0x16/0x20
[   39.448088]  save_stack+0x43/0xd0
[   39.451510]  kasan_slab_free+0x71/0xc0
[   39.455368]  kfree+0xca/0x250
[   39.458443]  fanout_add+0x2d0/0x1190
[   39.462123]  packet_setsockopt+0xfdc/0x1e80
[   39.466414]  SyS_setsockopt+0x189/0x360
[   39.470357]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   39.475080] 
[   39.476676] The buggy address belongs to the object at ffff8801cd649c00
[   39.476676]  which belongs to the cache kmalloc-128 of size 128
[   39.489300] The buggy address is located 24 bytes inside of
[   39.489300]  128-byte region [ffff8801cd649c00, ffff8801cd649c80)
[   39.501051] The buggy address belongs to the page:
[   39.505949] page:ffffea0007359240 count:1 mapcount:0 mapping:ffff8801cd649000 index:0x0
[   39.514061] flags: 0x200000000000100(slab)
[   39.518266] raw: 0200000000000100 ffff8801cd649000 0000000000000000 0000000100000015
[   39.526113] raw: ffffea0007316e60 ffff8801dac01550 ffff8801dac00640 0000000000000000
[   39.533958] page dumped because: kasan: bad access detected
[   39.539634] 
[   39.541233] Memory state around the buggy address:
[   39.546129]  ffff8801cd649b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.553454]  ffff8801cd649b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   39.560780] >ffff8801cd649c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   39.568573]                             ^
[   39.572745]  ffff8801cd649c80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[   39.580088]  ffff8801cd649d00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[   39.587414] ==================================================================
[   39.594738] Disabling lock debugging due to kernel taint
[   39.600206] Kernel panic - not syncing: panic_on_warn set ...
[   39.600206] 
[   39.607535] CPU: 0 PID: 3283 Comm: syz-executor0 Tainted: G    B           4.14.0-rc1-next-20170920+ #26
[   39.617112] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   39.626429] Call Trace:
[   39.628989]  dump_stack+0x194/0x257
[   39.632585]  ? arch_local_irq_restore+0x53/0x53
[   39.637217]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   39.641937]  ? packet_getsockopt+0xc30/0xe00
[   39.646311]  panic+0x1e4/0x417
[   39.649468]  ? __warn+0x1d9/0x1d9
[   39.652892]  ? packet_getsockopt+0xc72/0xe00
[   39.657263]  kasan_end_report+0x50/0x50
[   39.661198]  kasan_report+0x137/0x340
[   39.664965]  __asan_report_load8_noabort+0x14/0x20
[   39.669859]  packet_getsockopt+0xc72/0xe00
[   39.674057]  ? packet_notifier+0x950/0x950
[   39.678253]  ? iput+0x540/0xaf0
[   39.681499]  ? __fget_light+0x29d/0x390
[   39.685437]  ? sock_has_perm+0x29c/0x400
[   39.689461]  ? selinux_tun_dev_create+0xc0/0xc0
[   39.694091]  ? free_modinfo_version+0x70/0x70
[   39.698555]  ? __sk_free+0x5c/0x230
[   39.702152]  ? sk_free+0x2f/0x40
[   39.705489]  ? selinux_socket_getsockopt+0x36/0x40
[   39.710380]  ? security_socket_getsockopt+0x89/0xb0
[   39.715361]  SyS_getsockopt+0x178/0x340
[   39.719299]  ? SyS_setsockopt+0x360/0x360
[   39.723415]  ? entry_SYSCALL_64_fastpath+0x5/0xbe
[   39.728225]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   39.733204]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   39.737925]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   39.742642] RIP: 0033:0x4520a9
[   39.745804] RSP: 002b:00007f85f63adc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000037
[   39.753474] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[   39.760710] RDX: 0000000000000015 RSI: 0000000000000107 RDI: 000000000000000c
[   39.767942] RBP: 0000000000000082 R08: 00000000208a5000 R09: 0000000000000000
[   39.775177] R10: 0000000020ec8000 R11: 0000000000000216 R12: 0000000000000000
[   39.782411] R13: 00007ffe443abb1f R14: 00007f85f63ae9c0 R15: 0000000000000002
[   39.789685] Dumping ftrace buffer:
[   39.793188]    (ftrace buffer empty)
[   39.796863] Kernel Offset: disabled
[   39.800457] Rebooting in 86400 seconds..