INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-next-kasan-gce-1,10.128.0.21' (ECDSA) to the list of known hosts.
2017/09/28 03:21:50 parsed 1 programs
2017/09/28 03:21:50 executed programs: 0
syzkaller login: [   37.467710] ==================================================================
[   37.475194] BUG: KASAN: use-after-free in __do_page_fault+0xc03/0xd60
[   37.481776] Read of size 8 at addr ffff8801cc385890 by task syz-executor6/3772
[   37.489130] 
[   37.490758] CPU: 0 PID: 3772 Comm: syz-executor6 Not tainted 4.14.0-rc2-next-20170927+ #30
[   37.499156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   37.508514] Call Trace:
[   37.511083]  dump_stack+0x194/0x257
[   37.514706]  ? arch_local_irq_restore+0x53/0x53
[   37.519379]  ? show_regs_print_info+0x65/0x65
[   37.523886]  ? __do_page_fault+0xc03/0xd60
[   37.528128]  print_address_description+0x73/0x250
[   37.532962]  ? __do_page_fault+0xc03/0xd60
[   37.537188]  kasan_report+0x25b/0x340
[   37.540987]  __asan_report_load8_noabort+0x14/0x20
[   37.545919]  __do_page_fault+0xc03/0xd60
[   37.549988]  ? mm_fault_error+0x2c0/0x2c0
[   37.554121]  ? free_pidmap.isra.0+0x70/0x70
[   37.558437]  ? trace_hardirqs_off+0xd/0x10
[   37.562659]  do_page_fault+0xee/0x720
[   37.566440]  ? __do_page_fault+0xd60/0xd60
[   37.570669]  ? SyS_futex+0x269/0x390
[   37.574394]  ? do_futex+0x20d0/0x20d0
[   37.578188]  ? __task_pid_nr_ns+0x2c7/0x540
[   37.582498]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   37.587410]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   37.592255]  page_fault+0x22/0x30
[   37.595691] RIP: 0033:0x44bcf0
[   37.598862] RSP: 002b:00007f2c84aaf758 EFLAGS: 00010202
[   37.604218] RAX: 00007f2c84aaf800 RBX: 0000000000718000 RCX: 000000000000000e
[   37.611484] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f2c84aaf800
[   37.618744] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   37.626008] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   37.633268] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   37.640550] 
[   37.642167] Allocated by task 3772:
[   37.645782]  save_stack_trace+0x16/0x20
[   37.649740]  save_stack+0x43/0xd0
[   37.653180]  kasan_kmalloc+0xad/0xe0
[   37.656874]  kasan_slab_alloc+0x12/0x20
[   37.660822]  kmem_cache_alloc+0x12e/0x760
[   37.664950]  mmap_region+0x7ee/0x15a0
[   37.668732]  do_mmap+0x6a1/0xd50
[   37.672077]  vm_mmap_pgoff+0x1de/0x280
[   37.675950]  SyS_mmap_pgoff+0x23b/0x5f0
[   37.679903]  SyS_mmap+0x16/0x20
[   37.683156]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   37.687883] 
[   37.689497] Freed by task 3778:
[   37.692760]  save_stack_trace+0x16/0x20
[   37.696717]  save_stack+0x43/0xd0
[   37.700164]  kasan_slab_free+0x71/0xc0
[   37.704037]  kmem_cache_free+0x77/0x280
[   37.707991]  remove_vma+0x162/0x1b0
[   37.711597]  do_munmap+0x82a/0xdf0
[   37.715109]  mmap_region+0x59e/0x15a0
[   37.718888]  do_mmap+0x6a1/0xd50
[   37.722239]  vm_mmap_pgoff+0x1de/0x280
[   37.726098]  SyS_mmap_pgoff+0x23b/0x5f0
[   37.730046]  SyS_mmap+0x16/0x20
[   37.733301]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   37.738031] 
[   37.739639] The buggy address belongs to the object at ffff8801cc385840
[   37.739639]  which belongs to the cache vm_area_struct of size 200
[   37.753182] The buggy address is located 80 bytes inside of
[   37.753182]  200-byte region [ffff8801cc385840, ffff8801cc385908)
[   37.764944] The buggy address belongs to the page:
[   37.769848] page:ffffea000730e140 count:1 mapcount:0 mapping:ffff8801cc385000 index:0x0
[   37.777974] flags: 0x200000000000100(slab)
[   37.782186] raw: 0200000000000100 ffff8801cc385000 0000000000000000 000000010000000f
[   37.790050] raw: ffffea00072b4f20 ffffea000734bca0 ffff8801dae0a9c0 0000000000000000
[   37.797904] page dumped because: kasan: bad access detected
[   37.803593] 
[   37.805197] Memory state around the buggy address:
[   37.810099]  ffff8801cc385780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.817442]  ffff8801cc385800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   37.824774] >ffff8801cc385880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.832117]                          ^
[   37.835988]  ffff8801cc385900: fb fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb
[   37.843320]  ffff8801cc385980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   37.850648] ==================================================================
[   37.857976] Disabling lock debugging due to kernel taint
[   37.863501] Kernel panic - not syncing: panic_on_warn set ...
[   37.863501] 
[   37.870853] CPU: 0 PID: 3772 Comm: syz-executor6 Tainted: G    B           4.14.0-rc2-next-20170927+ #30
[   37.880452] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   37.889781] Call Trace:
[   37.892342]  dump_stack+0x194/0x257
[   37.895956]  ? arch_local_irq_restore+0x53/0x53
[   37.900614]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   37.905348]  ? __do_page_fault+0xb90/0xd60
[   37.909555]  panic+0x1e4/0x417
[   37.912720]  ? __warn+0x1d9/0x1d9
[   37.916159]  ? __do_page_fault+0xc03/0xd60
[   37.920372]  kasan_end_report+0x50/0x50
[   37.924332]  kasan_report+0x144/0x340
[   37.928106]  __asan_report_load8_noabort+0x14/0x20
[   37.933008]  __do_page_fault+0xc03/0xd60
[   37.937057]  ? mm_fault_error+0x2c0/0x2c0
[   37.941187]  ? free_pidmap.isra.0+0x70/0x70
[   37.945492]  ? trace_hardirqs_off+0xd/0x10
[   37.949710]  do_page_fault+0xee/0x720
[   37.953481]  ? __do_page_fault+0xd60/0xd60
[   37.957694]  ? SyS_futex+0x269/0x390
[   37.961383]  ? do_futex+0x20d0/0x20d0
[   37.965159]  ? __task_pid_nr_ns+0x2c7/0x540
[   37.969451]  ? entry_SYSCALL_64_fastpath+0x4b/0xbe
[   37.974349]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   37.979163]  page_fault+0x22/0x30
[   37.982593] RIP: 0033:0x44bcf0
[   37.985750] RSP: 002b:00007f2c84aaf758 EFLAGS: 00010202
[   37.991080] RAX: 00007f2c84aaf800 RBX: 0000000000718000 RCX: 000000000000000e
[   37.998315] RDX: 0000000000000400 RSI: 0000000020012fe0 RDI: 00007f2c84aaf800
[   38.005653] RBP: 0000000000005e10 R08: 0000000000000400 R09: 0000000000000000
[   38.012890] R10: 00000000000f4245 R11: 0000000000000246 R12: 00000000004bbc27
[   38.020125] R13: 00000000ffffffff R14: 0000000020012fee R15: 0000000000000000
[   38.027777] Dumping ftrace buffer:
[   38.031286]    (ftrace buffer empty)
[   38.034962] Kernel Offset: disabled
[   38.038558] Rebooting in 86400 seconds..