INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-net-kasan-gce-9,10.128.0.43' (ECDSA) to the list of known hosts.
2017/09/12 02:07:37 parsed 1 programs
2017/09/12 02:07:37 executed programs: 0
2017/09/12 02:07:42 executed programs: 489
2017/09/12 02:07:47 executed programs: 922
2017/09/12 02:07:52 executed programs: 1367
2017/09/12 02:07:57 executed programs: 1814
2017/09/12 02:08:02 executed programs: 2258
2017/09/12 02:08:07 executed programs: 2708
2017/09/12 02:08:12 executed programs: 3159
2017/09/12 02:08:17 executed programs: 3622
2017/09/12 02:08:22 executed programs: 4074
2017/09/12 02:08:27 executed programs: 4521
2017/09/12 02:08:32 executed programs: 4970
2017/09/12 02:08:37 executed programs: 5414
2017/09/12 02:08:42 executed programs: 5875
2017/09/12 02:08:47 executed programs: 6325
syzkaller login: [  560.196301] ==================================================================
[  560.203825] BUG: KASAN: use-after-free in get_work_pool+0x1c2/0x1e0
[  560.210216] Read of size 8 at addr ffff8801c9ae6138 by task syz-executor6/3030
[  560.217546] 
[  560.219148] CPU: 1 PID: 3030 Comm: syz-executor6 Not tainted 4.13.0+ #43
[  560.225955] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  560.235280] Call Trace:
[  560.237844]  dump_stack+0x194/0x257
[  560.241451]  ? arch_local_irq_restore+0x53/0x53
[  560.246093]  ? show_regs_print_info+0x65/0x65
[  560.250569]  ? __kernel_text_address+0xae/0xe0
[  560.255128]  ? get_work_pool+0x1c2/0x1e0
[  560.259170]  print_address_description+0x73/0x250
[  560.263985]  ? get_work_pool+0x1c2/0x1e0
[  560.268025]  kasan_report+0x24e/0x340
[  560.271804]  __asan_report_load8_noabort+0x14/0x20
[  560.276706]  get_work_pool+0x1c2/0x1e0
[  560.280567]  ? check_flush_dependency+0x370/0x370
[  560.285383]  ? save_stack_trace+0x16/0x20
[  560.289506]  ? save_stack+0x43/0xd0
[  560.293107]  ? kasan_kmalloc+0xad/0xe0
[  560.296966]  ? kasan_slab_alloc+0x12/0x20
[  560.301087]  ? kmem_cache_alloc+0x12e/0x760
[  560.305381]  ? kcm_ioctl+0x2d1/0x1610
[  560.309153]  ? sock_do_ioctl+0x65/0xb0
[  560.313023]  __queue_work+0x235/0x1150
[  560.316894]  ? insert_work+0x5d0/0x5d0
[  560.320782]  ? lock_downgrade+0x990/0x990
[  560.324903]  ? init_timer_key+0x126/0x3b0
[  560.329026]  ? retint_kernel+0x10/0x10
[  560.332890]  ? trace_hardirqs_on_caller+0x19e/0x5c0
[  560.337876]  ? kcm_ioctl+0x81a/0x1610
[  560.341654]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  560.346397]  ? retint_kernel+0x10/0x10
[  560.350259]  ? kcm_ioctl+0x81a/0x1610
[  560.354035]  ? __local_bh_enable_ip+0x9d/0x160
[  560.358594]  queue_work_on+0x16a/0x1c0
[  560.362458]  strp_check_rcv+0x25/0x30
[  560.366231]  kcm_ioctl+0x826/0x1610
[  560.369843]  ? kcm_unattach+0x1510/0x1510
[  560.373963]  ? avc_ss_reset+0x110/0x110
[  560.377919]  ? lock_release+0xd70/0xd70
[  560.381872]  ? __lock_is_held+0xbc/0x140
[  560.385944]  sock_do_ioctl+0x65/0xb0
[  560.389634]  sock_ioctl+0x2c2/0x440
[  560.393236]  ? dlci_ioctl_set+0x40/0x40
[  560.397186]  do_vfs_ioctl+0x1b1/0x1530
[  560.401057]  ? ioctl_preallocate+0x2b0/0x2b0
[  560.405445]  ? selinux_capable+0x40/0x40
[  560.409484]  ? SyS_futex+0x260/0x390
[  560.413171]  ? SyS_futex+0x269/0x390
[  560.416857]  ? vfs_write+0x1cb/0x510
[  560.420556]  ? security_file_ioctl+0x7d/0xb0
[  560.424934]  ? security_file_ioctl+0x89/0xb0
[  560.429319]  SyS_ioctl+0x8f/0xc0
[  560.432663]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  560.437389] RIP: 0033:0x451e59
[  560.440553] RSP: 002b:00007f546431dc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  560.448236] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  560.455477] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000b
[  560.462720] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  560.469964] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb500
[  560.477205] R13: 00000000ffffffff R14: 0000000000000002 R15: 0000000000000003
[  560.484470] 
[  560.486073] Allocated by task 3030:
[  560.489676]  save_stack_trace+0x16/0x20
[  560.493620]  save_stack+0x43/0xd0
[  560.497045]  kasan_kmalloc+0xad/0xe0
[  560.500730]  kasan_slab_alloc+0x12/0x20
[  560.504677]  kmem_cache_alloc+0x12e/0x760
[  560.508796]  kcm_ioctl+0x2d1/0x1610
[  560.512394]  sock_do_ioctl+0x65/0xb0
[  560.516082]  sock_ioctl+0x2c2/0x440
[  560.519679]  do_vfs_ioctl+0x1b1/0x1530
[  560.523544]  SyS_ioctl+0x8f/0xc0
[  560.527146]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  560.531868] 
[  560.533468] Freed by task 3038:
[  560.536721]  save_stack_trace+0x16/0x20
[  560.540667]  save_stack+0x43/0xd0
[  560.544092]  kasan_slab_free+0x71/0xc0
[  560.547952]  kmem_cache_free+0x77/0x280
[  560.551899]  kcm_unattach+0xe50/0x1510
[  560.555768]  kcm_ioctl+0xdf0/0x1610
[  560.559364]  sock_do_ioctl+0x65/0xb0
[  560.563050]  sock_ioctl+0x2c2/0x440
[  560.566659]  do_vfs_ioctl+0x1b1/0x1530
[  560.570516]  SyS_ioctl+0x8f/0xc0
[  560.573853]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  560.578575] 
[  560.580177] The buggy address belongs to the object at ffff8801c9ae6000
[  560.580177]  which belongs to the cache kcm_psock_cache of size 664
[  560.593151] The buggy address is located 312 bytes inside of
[  560.593151]  664-byte region [ffff8801c9ae6000, ffff8801c9ae6298)
[  560.604991] The buggy address belongs to the page:
[  560.609895] page:ffffea000726b980 count:1 mapcount:0 mapping:ffff8801c9ae6000 index:0x0 compound_mapcount: 0
[  560.619841] flags: 0x200000000008100(slab|head)
[  560.624481] raw: 0200000000008100 ffff8801c9ae6000 0000000000000000 0000000100000009
[  560.632333] raw: ffffea000720d5a0 ffffea000720fc20 ffff8801d328a640 0000000000000000
[  560.640181] page dumped because: kasan: bad access detected
[  560.645862] 
[  560.647460] Memory state around the buggy address:
[  560.652359]  ffff8801c9ae6000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  560.659688]  ffff8801c9ae6080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  560.667020] >ffff8801c9ae6100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  560.674349]                                         ^
[  560.679508]  ffff8801c9ae6180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  560.686837]  ffff8801c9ae6200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  560.694165] ==================================================================
[  560.701493] Disabling lock debugging due to kernel taint
[  560.706906] Kernel panic - not syncing: panic_on_warn set ...
[  560.706906] 
[  560.714234] CPU: 1 PID: 3030 Comm: syz-executor6 Tainted: G    B           4.13.0+ #43
[  560.722250] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  560.731570] Call Trace:
[  560.734126]  dump_stack+0x194/0x257
[  560.737732]  ? arch_local_irq_restore+0x53/0x53
[  560.742369]  ? vprintk_default+0x28/0x30
[  560.746403]  ? get_work_pool+0xf0/0x1e0
[  560.750345]  panic+0x1e4/0x417
[  560.753502]  ? __warn+0x1d9/0x1d9
[  560.756928]  ? get_work_pool+0x1c2/0x1e0
[  560.760957]  kasan_end_report+0x50/0x50
[  560.764897]  kasan_report+0x137/0x340
[  560.768665]  __asan_report_load8_noabort+0x14/0x20
[  560.773559]  get_work_pool+0x1c2/0x1e0
[  560.777414]  ? check_flush_dependency+0x370/0x370
[  560.782221]  ? save_stack_trace+0x16/0x20
[  560.786340]  ? save_stack+0x43/0xd0
[  560.789932]  ? kasan_kmalloc+0xad/0xe0
[  560.793784]  ? kasan_slab_alloc+0x12/0x20
[  560.797899]  ? kmem_cache_alloc+0x12e/0x760
[  560.802185]  ? kcm_ioctl+0x2d1/0x1610
[  560.805952]  ? sock_do_ioctl+0x65/0xb0
[  560.809808]  __queue_work+0x235/0x1150
[  560.813666]  ? insert_work+0x5d0/0x5d0
[  560.817528]  ? lock_downgrade+0x990/0x990
[  560.821641]  ? init_timer_key+0x126/0x3b0
[  560.825756]  ? retint_kernel+0x10/0x10
[  560.829609]  ? trace_hardirqs_on_caller+0x19e/0x5c0
[  560.834589]  ? kcm_ioctl+0x81a/0x1610
[  560.838358]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[  560.843084]  ? retint_kernel+0x10/0x10
[  560.846937]  ? kcm_ioctl+0x81a/0x1610
[  560.850707]  ? __local_bh_enable_ip+0x9d/0x160
[  560.855256]  queue_work_on+0x16a/0x1c0
[  560.859118]  strp_check_rcv+0x25/0x30
[  560.862890]  kcm_ioctl+0x826/0x1610
[  560.866487]  ? kcm_unattach+0x1510/0x1510
[  560.870601]  ? avc_ss_reset+0x110/0x110
[  560.874542]  ? lock_release+0xd70/0xd70
[  560.878484]  ? __lock_is_held+0xbc/0x140
[  560.882529]  sock_do_ioctl+0x65/0xb0
[  560.886209]  sock_ioctl+0x2c2/0x440
[  560.889803]  ? dlci_ioctl_set+0x40/0x40
[  560.893744]  do_vfs_ioctl+0x1b1/0x1530
[  560.897601]  ? ioctl_preallocate+0x2b0/0x2b0
[  560.901980]  ? selinux_capable+0x40/0x40
[  560.906013]  ? SyS_futex+0x260/0x390
[  560.909700]  ? SyS_futex+0x269/0x390
[  560.913381]  ? vfs_write+0x1cb/0x510
[  560.917068]  ? security_file_ioctl+0x7d/0xb0
[  560.921455]  ? security_file_ioctl+0x89/0xb0
[  560.925832]  SyS_ioctl+0x8f/0xc0
[  560.929167]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  560.933886] RIP: 0033:0x451e59
[  560.937043] RSP: 002b:00007f546431dc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  560.944725] RAX: ffffffffffffffda RBX: 0000000000718160 RCX: 0000000000451e59
[  560.951962] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000b
[  560.959196] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  560.966431] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004bb500
[  560.973665] R13: 00000000ffffffff R14: 0000000000000002 R15: 0000000000000003
[  560.981351] Dumping ftrace buffer:
[  560.984863]    (ftrace buffer empty)
[  560.988539] Kernel Offset: disabled
[  560.992131] Rebooting in 86400 seconds..