INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added '10.128.0.38' (ECDSA) to the list of known hosts. 2018/04/23 20:39:28 parsed 1 programs 2018/04/23 20:39:28 executed programs: 0 syzkaller login: [ 23.712866] IPVS: Creating netns size=2536 id=1 [ 23.745371] IPVS: Creating netns size=2536 id=2 [ 23.780479] IPVS: Creating netns size=2536 id=3 [ 23.818588] IPVS: Creating netns size=2536 id=4 [ 23.841942] IPVS: Creating netns size=2536 id=5 [ 23.867839] IPVS: Creating netns size=2536 id=6 [ 23.896132] IPVS: Creating netns size=2536 id=7 [ 23.930066] IPVS: Creating netns size=2536 id=8 [ 24.461820] ================================================================== [ 24.469261] BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 [ 24.476005] Read of size 8 at addr ffff8801d87a4960 by task blkid/3962 [ 24.482658] [ 24.484285] CPU: 1 PID: 3962 Comm: blkid Not tainted 4.9.95-g142d4b5 #4 [ 24.491031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 24.500374] ffff8801d7b476d8 ffffffff81eb0f89 ffffea000761e800 ffff8801d87a4960 [ 24.508398] 0000000000000000 ffff8801d87a4960 0000000000000000 ffff8801d7b47710 [ 24.516424] ffffffff815653cb ffff8801d87a4960 0000000000000008 0000000000000000 [ 24.524463] Call Trace: [ 24.527035] [] dump_stack+0xc1/0x128 [ 24.532402] [] print_address_description+0x6c/0x234 [ 24.539072] [] kasan_report.cold.6+0x242/0x2fe [ 24.545297] [] ? disk_unblock_events+0x51/0x60 [ 24.551518] [] __asan_report_load8_noabort+0x14/0x20 [ 24.558268] [] disk_unblock_events+0x51/0x60 [ 24.564320] [] __blkdev_get+0x6b6/0xd60 [ 24.569931] [] ? __blkdev_put+0x840/0x840 [ 24.575728] [] ? fsnotify+0x114/0x1100 [ 24.581241] [] blkdev_get+0x2da/0x920 [ 24.587184] [] ? bd_may_claim+0xd0/0xd0 [ 24.592781] [] ? bd_acquire+0x27/0x250 [ 24.598303] [] ? bd_acquire+0x88/0x250 [ 24.603818] [] ? _raw_spin_unlock+0x2c/0x50 [ 24.609762] [] blkdev_open+0x1a5/0x250 [ 24.615281] [] do_dentry_open+0x703/0xc80 [ 24.621052] [] ? blkdev_get_by_dev+0x70/0x70 [ 24.627096] [] vfs_open+0x11c/0x210 [ 24.632355] [] ? may_open.isra.57+0x14f/0x2a0 [ 24.638483] [] path_openat+0x758/0x3590 [ 24.644082] [] ? save_stack+0xa9/0xd0 [ 24.649516] [] ? path_lookupat.isra.41+0x410/0x410 [ 24.656071] [] ? __lock_is_held+0xa2/0xf0 [ 24.661843] [] do_filp_open+0x197/0x270 [ 24.667441] [] ? may_open_dev+0xe0/0xe0 [ 24.673042] [] ? _raw_spin_unlock+0x2c/0x50 [ 24.678997] [] ? __alloc_fd+0x1d7/0x4a0 [ 24.684593] [] do_sys_open+0x30d/0x5c0 [ 24.690114] [] ? filp_open+0x70/0x70 [ 24.695462] [] ? up_read+0x1a/0x40 [ 24.700627] [] ? __do_page_fault+0x183/0xd50 [ 24.706669] [] SyS_open+0x2d/0x40 [ 24.711754] [] ? do_sys_open+0x5c0/0x5c0 [ 24.717439] [] do_syscall_64+0x1a6/0x490 [ 24.723124] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 24.730021] [ 24.731621] Allocated by task 3789: [ 24.735233] save_stack_trace+0x16/0x20 [ 24.739181] save_stack+0x43/0xd0 [ 24.742611] kasan_kmalloc+0xc7/0xe0 [ 24.746306] kmem_cache_alloc_trace+0xfd/0x2b0 [ 24.750863] alloc_disk_node+0x54/0x3a0 [ 24.754810] alloc_disk+0x18/0x20 [ 24.758235] loop_add+0x33b/0x770 [ 24.761661] loop_probe+0x14f/0x180 [ 24.765262] kobj_lookup+0x223/0x410 [ 24.768948] get_gendisk+0x39/0x2d0 [ 24.772552] __blkdev_get+0x351/0xd60 [ 24.776327] blkdev_get+0x2da/0x920 [ 24.779932] blkdev_open+0x1a5/0x250 [ 24.783617] do_dentry_open+0x703/0xc80 [ 24.787663] vfs_open+0x11c/0x210 [ 24.791092] path_openat+0x758/0x3590 [ 24.794867] do_filp_open+0x197/0x270 [ 24.798637] do_sys_open+0x30d/0x5c0 [ 24.802322] SyS_open+0x2d/0x40 [ 24.805575] do_syscall_64+0x1a6/0x490 [ 24.809437] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 24.814519] [ 24.816119] Freed by task 3962: [ 24.819373] save_stack_trace+0x16/0x20 [ 24.823318] save_stack+0x43/0xd0 [ 24.826753] kasan_slab_free+0x72/0xc0 [ 24.830612] kfree+0xfb/0x310 [ 24.833692] disk_release+0x259/0x330 [ 24.837466] device_release+0x7e/0x220 [ 24.841325] kobject_release+0x103/0x1b0 [ 24.845358] kobject_put+0x6d/0xd0 [ 24.848870] put_disk+0x23/0x30 [ 24.852123] __blkdev_get+0x616/0xd60 [ 24.855909] blkdev_get+0x2da/0x920 [ 24.859509] blkdev_open+0x1a5/0x250 [ 24.863196] do_dentry_open+0x703/0xc80 [ 24.867144] vfs_open+0x11c/0x210 [ 24.870570] path_openat+0x758/0x3590 [ 24.874353] do_filp_open+0x197/0x270 [ 24.878133] do_sys_open+0x30d/0x5c0 [ 24.881818] SyS_open+0x2d/0x40 [ 24.885075] do_syscall_64+0x1a6/0x490 [ 24.888949] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 24.894030] [ 24.895632] The buggy address belongs to the object at ffff8801d87a4400 [ 24.895632] which belongs to the cache kmalloc-2048 of size 2048 [ 24.908436] The buggy address is located 1376 bytes inside of [ 24.908436] 2048-byte region [ffff8801d87a4400, ffff8801d87a4c00) [ 24.920984] The buggy address belongs to the page: [ 24.925890] page:ffffea000761e800 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 [ 24.936125] flags: 0x8000000000004080(slab|head) [ 24.940858] page dumped because: kasan: bad access detected [ 24.946541] [ 24.948142] Memory state around the buggy address: [ 24.953048] ffff8801d87a4800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.960391] ffff8801d87a4880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.967727] >ffff8801d87a4900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.975069] ^ [ 24.981537] ffff8801d87a4980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.988878] ffff8801d87a4a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 24.996220] ================================================================== [ 25.003560] Disabling lock debugging due to kernel taint [ 25.011278] Kernel panic - not syncing: panic_on_warn set ... [ 25.011278] [ 25.018659] CPU: 1 PID: 3962 Comm: blkid Tainted: G B 4.9.95-g142d4b5 #4 [ 25.026614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 25.035963] ffff8801d7b47638 ffffffff81eb0f89 ffffffff841c4735 00000000ffffffff [ 25.044025] 0000000000000000 0000000000000001 0000000000000000 ffff8801d7b476f8 [ 25.052109] ffffffff8141f945 0000000041b58ab3 ffffffff841b7e38 ffffffff8141f786 [ 25.060164] Call Trace: [ 25.062755] [] dump_stack+0xc1/0x128 [ 25.068126] [] panic+0x1bf/0x3bc [ 25.073139] [] ? add_taint.cold.6+0x16/0x16 [ 25.079107] [] ? ___preempt_schedule+0x16/0x18 [ 25.085339] [] kasan_end_report+0x47/0x4f [ 25.091134] [] kasan_report.cold.6+0x76/0x2fe [ 25.097277] [] ? disk_unblock_events+0x51/0x60 [ 25.103504] [] __asan_report_load8_noabort+0x14/0x20 [ 25.110260] [] disk_unblock_events+0x51/0x60 [ 25.116317] [] __blkdev_get+0x6b6/0xd60 [ 25.121939] [] ? __blkdev_put+0x840/0x840 [ 25.127732] [] ? fsnotify+0x114/0x1100 [ 25.133261] [] blkdev_get+0x2da/0x920 [ 25.138714] [] ? bd_may_claim+0xd0/0xd0 [ 25.144342] [] ? bd_acquire+0x27/0x250 [ 25.149873] [] ? bd_acquire+0x88/0x250 [ 25.155402] [] ? _raw_spin_unlock+0x2c/0x50 [ 25.161369] [] blkdev_open+0x1a5/0x250 [ 25.166902] [] do_dentry_open+0x703/0xc80 [ 25.172694] [] ? blkdev_get_by_dev+0x70/0x70 [ 25.178743] [] vfs_open+0x11c/0x210 [ 25.184017] [] ? may_open.isra.57+0x14f/0x2a0 [ 25.190155] [] path_openat+0x758/0x3590 [ 25.195772] [] ? save_stack+0xa9/0xd0 [ 25.201216] [] ? path_lookupat.isra.41+0x410/0x410 [ 25.207793] [] ? __lock_is_held+0xa2/0xf0 [ 25.213585] [] do_filp_open+0x197/0x270 [ 25.219203] [] ? may_open_dev+0xe0/0xe0 [ 25.224821] [] ? _raw_spin_unlock+0x2c/0x50 [ 25.230810] [] ? __alloc_fd+0x1d7/0x4a0 [ 25.236426] [] do_sys_open+0x30d/0x5c0 [ 25.241953] [] ? filp_open+0x70/0x70 [ 25.247312] [] ? up_read+0x1a/0x40 [ 25.252509] [] ? __do_page_fault+0x183/0xd50 [ 25.258563] [] SyS_open+0x2d/0x40 [ 25.263695] [] ? do_sys_open+0x5c0/0x5c0 [ 25.269399] [] do_syscall_64+0x1a6/0x490 [ 25.275106] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 25.282507] Dumping ftrace buffer: [ 25.286029] (ftrace buffer empty) [ 25.289722] Kernel Offset: disabled [ 25.293321] Rebooting in 86400 seconds..