INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-3,10.128.15.214' (ECDSA) to the list of known hosts.
2017/09/21 08:18:36 parsed 1 programs
2017/09/21 08:18:36 executed programs: 0
2017/09/21 08:18:41 executed programs: 466
2017/09/21 08:18:46 executed programs: 892
2017/09/21 08:18:51 executed programs: 1316
2017/09/21 08:18:56 executed programs: 1745
2017/09/21 08:19:01 executed programs: 2171
2017/09/21 08:19:06 executed programs: 2600
2017/09/21 08:19:11 executed programs: 3031
2017/09/21 08:19:16 executed programs: 3461
2017/09/21 08:19:21 executed programs: 3893
2017/09/21 08:19:26 executed programs: 4319
2017/09/21 08:19:31 executed programs: 4749
2017/09/21 08:19:36 executed programs: 5176
2017/09/21 08:19:41 executed programs: 5602
2017/09/21 08:19:46 executed programs: 6026
2017/09/21 08:19:51 executed programs: 6455
2017/09/21 08:19:56 executed programs: 6880
2017/09/21 08:20:01 executed programs: 7310
2017/09/21 08:20:06 executed programs: 7739
2017/09/21 08:20:11 executed programs: 8166
syzkaller login: [  947.154273] ==================================================================
[  947.161802] BUG: KASAN: use-after-free in __queue_work+0x1029/0x1150
[  947.168271] Read of size 8 at addr ffff8801d0ac0d00 by task syz-executor3/12844
[  947.175696] 
[  947.177299] CPU: 1 PID: 12844 Comm: syz-executor3 Not tainted 4.13.0-mm1+ #7
[  947.184455] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  947.193779] Call Trace:
[  947.196343]  dump_stack+0x194/0x257
[  947.199951]  ? arch_local_irq_restore+0x53/0x53
[  947.204592]  ? show_regs_print_info+0x65/0x65
[  947.209073]  ? __queue_work+0x1029/0x1150
[  947.213197]  print_address_description+0x73/0x250
[  947.218013]  ? __queue_work+0x1029/0x1150
[  947.222135]  kasan_report+0x24e/0x340
[  947.225917]  __asan_report_load8_noabort+0x14/0x20
[  947.230821]  __queue_work+0x1029/0x1150
[  947.234782]  ? insert_work+0x5d0/0x5d0
[  947.238660]  ? lock_downgrade+0x990/0x990
[  947.242787]  ? mark_held_locks+0xb2/0x100
[  947.246914]  ? psock_now_avail+0x34c/0x6c0
[  947.251128]  ? kcm_rcv_strparser+0x9a0/0x9a0
[  947.255515]  ? do_raw_spin_trylock+0x190/0x190
[  947.260077]  ? __local_bh_enable_ip+0x9d/0x160
[  947.264640]  queue_work_on+0x16a/0x1c0
[  947.268505]  strp_check_rcv+0x25/0x30
[  947.272280]  kcm_ioctl+0x826/0x1610
[  947.275892]  ? kcm_unattach+0x1510/0x1510
[  947.280014]  ? avc_ss_reset+0x110/0x110
[  947.283969]  ? lock_release+0xd70/0xd70
[  947.287920]  ? __lock_is_held+0xbc/0x140
[  947.291996]  sock_do_ioctl+0x65/0xb0
[  947.295687]  sock_ioctl+0x2c2/0x440
[  947.299289]  ? dlci_ioctl_set+0x40/0x40
[  947.303239]  do_vfs_ioctl+0x1b1/0x1530
[  947.307112]  ? ioctl_preallocate+0x2b0/0x2b0
[  947.311500]  ? selinux_capable+0x40/0x40
[  947.315542]  ? SyS_futex+0x260/0x390
[  947.319230]  ? SyS_futex+0x269/0x390
[  947.322918]  ? SyS_setsockopt+0x1fb/0x360
[  947.327056]  ? security_file_ioctl+0x7d/0xb0
[  947.331435]  ? security_file_ioctl+0x89/0xb0
[  947.335825]  SyS_ioctl+0x8f/0xc0
[  947.339175]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  947.343904] RIP: 0033:0x4520a9
[  947.347067] RSP: 002b:00007f03b7352c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  947.354752] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[  947.361996] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000a
[  947.369237] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  947.376478] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b73ea
[  947.383718] R13: 00000000ffffffff R14: 0000000000000005 R15: 0000000020b4cfd0
[  947.390984] 
[  947.392585] Allocated by task 12844:
[  947.396271]  save_stack_trace+0x16/0x20
[  947.400227]  save_stack+0x43/0xd0
[  947.403655]  kasan_kmalloc+0xad/0xe0
[  947.407341]  kasan_slab_alloc+0x12/0x20
[  947.411286]  kmem_cache_alloc+0x12e/0x760
[  947.415410]  kcm_ioctl+0x2d1/0x1610
[  947.419011]  sock_do_ioctl+0x65/0xb0
[  947.422701]  sock_ioctl+0x2c2/0x440
[  947.426299]  do_vfs_ioctl+0x1b1/0x1530
[  947.430157]  SyS_ioctl+0x8f/0xc0
[  947.433494]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  947.438220] 
[  947.439819] Freed by task 12852:
[  947.443159]  save_stack_trace+0x16/0x20
[  947.447106]  save_stack+0x43/0xd0
[  947.450528]  kasan_slab_free+0x71/0xc0
[  947.454389]  kmem_cache_free+0x77/0x280
[  947.458335]  kcm_unattach+0xe50/0x1510
[  947.462192]  kcm_ioctl+0xdf0/0x1610
[  947.465791]  sock_do_ioctl+0x65/0xb0
[  947.469474]  sock_ioctl+0x2c2/0x440
[  947.473073]  do_vfs_ioctl+0x1b1/0x1530
[  947.476933]  SyS_ioctl+0x8f/0xc0
[  947.480269]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  947.484993] 
[  947.486597] The buggy address belongs to the object at ffff8801d0ac0bc0
[  947.486597]  which belongs to the cache kcm_psock_cache of size 664
[  947.499570] The buggy address is located 320 bytes inside of
[  947.499570]  664-byte region [ffff8801d0ac0bc0, ffff8801d0ac0e58)
[  947.511415] The buggy address belongs to the page:
[  947.516314] page:ffffea000742b000 count:1 mapcount:0 mapping:ffff8801d0ac0200 index:0x0 compound_mapcount: 0
[  947.526262] flags: 0x200000000008100(slab|head)
[  947.530904] raw: 0200000000008100 ffff8801d0ac0200 0000000000000000 0000000100000009
[  947.538755] raw: ffffea000743da20 ffffea0007420620 ffff8801d2e2f680 0000000000000000
[  947.546614] page dumped because: kasan: bad access detected
[  947.552291] 
[  947.553890] Memory state around the buggy address:
[  947.558788]  ffff8801d0ac0c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  947.566119]  ffff8801d0ac0c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  947.573448] >ffff8801d0ac0d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  947.580775]                    ^
[  947.584111]  ffff8801d0ac0d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  947.591440]  ffff8801d0ac0e00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
[  947.598770] ==================================================================
[  947.606097] Disabling lock debugging due to kernel taint
[  947.611509] Kernel panic - not syncing: panic_on_warn set ...
[  947.611509] 
[  947.618836] CPU: 1 PID: 12844 Comm: syz-executor3 Tainted: G    B           4.13.0-mm1+ #7
[  947.627199] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[  947.636517] Call Trace:
[  947.639075]  dump_stack+0x194/0x257
[  947.642673]  ? arch_local_irq_restore+0x53/0x53
[  947.647308]  ? vprintk_default+0x28/0x30
[  947.651339]  ? __queue_work+0xf30/0x1150
[  947.655375]  panic+0x1e4/0x417
[  947.658534]  ? __warn+0x1d9/0x1d9
[  947.661961]  ? __queue_work+0x1029/0x1150
[  947.666074]  kasan_end_report+0x50/0x50
[  947.670019]  kasan_report+0x137/0x340
[  947.673787]  __asan_report_load8_noabort+0x14/0x20
[  947.678681]  __queue_work+0x1029/0x1150
[  947.682628]  ? insert_work+0x5d0/0x5d0
[  947.686490]  ? lock_downgrade+0x990/0x990
[  947.690603]  ? mark_held_locks+0xb2/0x100
[  947.694719]  ? psock_now_avail+0x34c/0x6c0
[  947.698922]  ? kcm_rcv_strparser+0x9a0/0x9a0
[  947.703297]  ? do_raw_spin_trylock+0x190/0x190
[  947.707847]  ? __local_bh_enable_ip+0x9d/0x160
[  947.712400]  queue_work_on+0x16a/0x1c0
[  947.716255]  strp_check_rcv+0x25/0x30
[  947.720019]  kcm_ioctl+0x826/0x1610
[  947.723619]  ? kcm_unattach+0x1510/0x1510
[  947.727732]  ? avc_ss_reset+0x110/0x110
[  947.731675]  ? lock_release+0xd70/0xd70
[  947.735619]  ? __lock_is_held+0xbc/0x140
[  947.739666]  sock_do_ioctl+0x65/0xb0
[  947.743348]  sock_ioctl+0x2c2/0x440
[  947.746945]  ? dlci_ioctl_set+0x40/0x40
[  947.750884]  do_vfs_ioctl+0x1b1/0x1530
[  947.754743]  ? ioctl_preallocate+0x2b0/0x2b0
[  947.759116]  ? selinux_capable+0x40/0x40
[  947.763148]  ? SyS_futex+0x260/0x390
[  947.766827]  ? SyS_futex+0x269/0x390
[  947.770515]  ? SyS_setsockopt+0x1fb/0x360
[  947.774636]  ? security_file_ioctl+0x7d/0xb0
[  947.779008]  ? security_file_ioctl+0x89/0xb0
[  947.783386]  SyS_ioctl+0x8f/0xc0
[  947.786723]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[  947.791441] RIP: 0033:0x4520a9
[  947.794597] RSP: 002b:00007f03b7352c08 EFLAGS: 00000216 ORIG_RAX: 0000000000000010
[  947.802271] RAX: ffffffffffffffda RBX: 00000000007180b0 RCX: 00000000004520a9
[  947.809508] RDX: 00000000209b9000 RSI: 00000000000089e0 RDI: 000000000000000a
[  947.816744] RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000
[  947.823982] R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b73ea
[  947.831223] R13: 00000000ffffffff R14: 0000000000000005 R15: 0000000020b4cfd0