INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-kasan-gce-0,10.128.0.10' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 52.163282] dev_remove_pack: ffff8801cb2bfa80 not found [ 52.220453] ================================================================== [ 52.227891] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0 [ 52.235398] Read of size 2 at addr ffff8801c64c7340 by task syzkaller279297/2991 [ 52.242899] [ 52.244523] CPU: 0 PID: 2991 Comm: syzkaller279297 Not tainted 4.13.0+ #81 [ 52.251525] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 52.260853] Call Trace: [ 52.263410] [ 52.265540] dump_stack+0x194/0x257 [ 52.269142] ? arch_local_irq_restore+0x53/0x53 [ 52.273783] ? show_regs_print_info+0x65/0x65 [ 52.278259] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 52.283423] print_address_description+0x73/0x250 [ 52.288240] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 52.293404] kasan_report+0x24e/0x340 [ 52.297183] __asan_report_load2_noabort+0x14/0x20 [ 52.302084] __netif_receive_skb_core+0x2be3/0x33d0 [ 52.307073] ? __bpf_address_lookup+0x2b0/0x2b0 [ 52.311726] ? nf_ingress+0x9f0/0x9f0 [ 52.315501] ? unwind_dump+0x4c0/0x4c0 executing program [ 52.319379] ? check_noncircular+0x20/0x20 [ 52.323586] ? __kernel_text_address+0xae/0xe0 [ 52.328142] ? unwind_get_return_address+0x61/0xa0 [ 52.333044] ? __save_stack_trace+0x7e/0xd0 [ 52.337345] ? print_usage_bug+0x480/0x480 [ 52.341566] ? find_held_lock+0x39/0x1d0 [ 52.345614] ? lock_downgrade+0x990/0x990 [ 52.349732] ? unwind_get_return_address+0x61/0xa0 [ 52.354642] ? lock_acquire+0x1d5/0x580 [ 52.358590] ? netif_receive_skb_internal+0x1d7/0x670 [ 52.363751] ? find_held_lock+0x39/0x1d0 [ 52.367794] ? pvclock_read_flags+0x160/0x160 [ 52.372260] ? mark_held_locks+0xb2/0x100 [ 52.376388] ? lock_acquire+0x1d5/0x580 [ 52.380333] ? netif_receive_skb_internal+0xa2/0x670 [ 52.385409] ? ktime_get_with_offset+0x2c1/0x420 [ 52.390139] ? lock_release+0xd70/0xd70 [ 52.394092] ? ktime_get+0x3a0/0x3a0 [ 52.397788] __netif_receive_skb+0x2c/0x1b0 [ 52.402091] ? __netif_receive_skb+0x2c/0x1b0 [ 52.406563] netif_receive_skb_internal+0x10b/0x670 [ 52.411555] ? dev_cpu_dead+0xb00/0xb00 [ 52.415499] ? __alloc_pages_nodemask+0xd80/0xd80 [ 52.420317] ? net_rx_action+0x1910/0x1910 [ 52.424534] ? __lock_is_held+0xbc/0x140 [ 52.428584] ? skb_gro_reset_offset+0x17b/0x300 [ 52.433237] napi_gro_receive+0x3d0/0x500 [ 52.437362] ? dev_gro_receive+0x19b0/0x19b0 [ 52.441748] ? eth_type_trans+0x2a3/0x650 [ 52.445870] ? eth_gro_receive+0x810/0x810 [ 52.450087] receive_buf+0xcc5/0x51f0 [ 52.453871] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 52.458429] ? print_usage_bug+0x480/0x480 [ 52.462637] ? __lock_acquire+0x732/0x4620 [ 52.466852] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 52.472023] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 52.477875] ? complete+0x5f/0x80 [ 52.481297] ? complete+0x5f/0x80 [ 52.484733] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 52.489901] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.494891] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.499884] ? __lock_acquire+0x732/0x4620 [ 52.504089] ? unwind_dump+0x4c0/0x4c0 [ 52.507966] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 52.513139] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 52.518992] ? hrtimer_interrupt+0x1d4/0x5f0 [ 52.523371] ? hrtimer_interrupt+0x1d4/0x5f0 [ 52.527751] ? save_stack_trace+0x16/0x20 [ 52.531870] ? __lock_acquire+0x20fd/0x4620 [ 52.536171] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.541161] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.546149] ? unwind_dump+0x4c0/0x4c0 [ 52.550010] ? unwind_dump+0x4c0/0x4c0 [ 52.553881] ? __unwind_start+0x169/0x330 [ 52.558002] ? unwind_get_return_address+0x61/0xa0 [ 52.562902] ? __save_stack_trace+0x61/0xd0 [ 52.567199] ? get_stack_info+0x37/0x150 [ 52.571235] ? update_stack_state+0x225/0x700 [ 52.575711] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 52.581569] ? native_safe_halt+0x6/0x10 [ 52.585605] ? find_held_lock+0x39/0x1d0 [ 52.589644] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.594638] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.599627] ? unwind_dump+0x4c0/0x4c0 [ 52.603501] ? unwind_dump+0x4c0/0x4c0 [ 52.607368] ? pvclock_read_flags+0x160/0x160 [ 52.611839] ? __unwind_start+0x169/0x330 [ 52.615972] ? print_usage_bug+0x480/0x480 [ 52.620176] ? unwind_get_return_address+0x61/0xa0 [ 52.625077] ? __save_stack_trace+0x61/0xd0 [ 52.629377] ? native_safe_halt+0x6/0x10 [ 52.633413] ? save_stack_trace+0x16/0x20 [ 52.637532] ? __lock_acquire+0x20fd/0x4620 [ 52.641827] ? vring_use_dma_api+0x7f/0xa0 [ 52.646032] ? vring_unmap_one+0x49/0x3d0 [ 52.650155] ? detach_buf+0x463/0x6a0 [ 52.653927] ? print_usage_bug+0x480/0x480 [ 52.658143] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 52.662870] ? common_interrupt+0x9d/0x9d [ 52.667002] ? detach_buf+0x6a0/0x6a0 [ 52.670779] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 52.675776] virtnet_poll+0x304/0xad0 [ 52.679559] ? receive_buf+0x51f0/0x51f0 [ 52.683590] ? unwind_dump+0x4c0/0x4c0 [ 52.687456] ? mark_held_locks+0xb2/0x100 [ 52.691577] ? net_rx_action+0x49b/0x1910 [ 52.695704] net_rx_action+0x792/0x1910 [ 52.699665] ? napi_complete_done+0x6c0/0x6c0 [ 52.704131] ? save_stack_trace+0x16/0x20 [ 52.708252] ? __lock_acquire+0x20fd/0x4620 [ 52.712562] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 52.717728] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 52.722892] ? lock_downgrade+0x990/0x990 [ 52.727011] ? check_noncircular+0x20/0x20 [ 52.731224] ? __lock_is_held+0xbc/0x140 [ 52.735273] ? rcu_read_lock_sched_held+0x108/0x120 [ 52.740264] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 52.745078] ? raise_softirq+0x490/0x490 [ 52.749110] ? lock_downgrade+0x990/0x990 [ 52.753232] ? print_usage_bug+0x480/0x480 [ 52.757441] ? lock_acquire+0x1d5/0x580 [ 52.761390] ? clockevents_program_event+0x163/0x2e0 [ 52.766468] ? trace_hardirqs_off+0xd/0x10 [ 52.770676] ? __napi_schedule+0x25e/0x370 [ 52.774886] ? netdev_info+0x170/0x170 [ 52.778745] ? check_noncircular+0x20/0x20 [ 52.782954] ? check_noncircular+0x20/0x20 [ 52.787159] ? __lock_is_held+0xbc/0x140 [ 52.791203] ? rcu_read_lock_sched_held+0x108/0x120 [ 52.796191] ? __handle_irq_event_percpu+0x308/0x9d0 [ 52.801271] ? __lock_is_held+0xbc/0x140 [ 52.805335] __do_softirq+0x2bb/0xbd0 [ 52.809119] ? __softirqentry_text_start+0x8/0x8 [ 52.813858] ? do_raw_spin_trylock+0x190/0x190 [ 52.818410] ? handle_irq_event_percpu+0x141/0x1b0 [ 52.823311] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 52.828394] ? _raw_spin_lock+0x32/0x40 [ 52.832344] ? _raw_spin_unlock+0x22/0x30 [ 52.836465] ? handle_edge_irq+0x2b4/0x7c0 [ 52.840681] irq_exit+0x1d3/0x210 [ 52.844105] do_IRQ+0xf6/0x190 [ 52.847272] common_interrupt+0x9d/0x9d [ 52.851214] [ 52.853421] RIP: 0010:lock_acquire+0x256/0x580 [ 52.857972] RSP: 0018:ffff8801ce5eeb78 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e [ 52.865657] RAX: dffffc0000000000 RBX: ffff8801ce706240 RCX: 0000000000000000 [ 52.872898] RDX: 1ffffffff0b592fd RSI: 00000000c74c155f RDI: 0000000000000282 [ 52.880138] RBP: ffff8801ce5eec70 R08: 0000000000000000 R09: 0000000000000001 [ 52.887379] R10: 0000000000000000 R11: ffffffff87060ca0 R12: 1ffff10039cbdd75 [ 52.894629] R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000 [ 52.901897] ? lock_release+0xd70/0xd70 [ 52.905843] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 52.911702] ? entry_SYSCALL64_slow_path+0x25/0x25 [ 52.916603] ? lock_downgrade+0x990/0x990 [ 52.920724] ? show_initstate+0xb0/0xb0 [ 52.924682] __is_insn_slot_addr+0xb4/0x330 [ 52.928972] ? __free_insn_slot+0x5c0/0x5c0 [ 52.933266] ? unwind_dump+0x4c0/0x4c0 [ 52.937126] ? __free_insn_slot+0x5c0/0x5c0 [ 52.941427] ? unwind_dump+0x4c0/0x4c0 [ 52.945290] ? lockdep_init_map+0x3d/0x70 [ 52.949412] ? __module_text_address+0x13/0x150 [ 52.954056] __kernel_text_address+0x8f/0xe0 [ 52.958436] unwind_get_return_address+0x61/0xa0 [ 52.963167] __save_stack_trace+0x7e/0xd0 [ 52.967298] save_stack_trace+0x16/0x20 [ 52.971248] save_stack+0x43/0xd0 [ 52.974674] ? save_stack_trace+0x16/0x20 [ 52.978793] ? save_stack+0x43/0xd0 [ 52.982392] ? kasan_kmalloc+0xad/0xe0 [ 52.986248] ? kasan_slab_alloc+0x12/0x20 [ 52.990367] ? kmem_cache_alloc+0x12e/0x760 [ 52.994659] ? copy_mm+0x8d7/0x1310 [ 52.998258] ? copy_process.part.36+0x1eae/0x4af0 [ 53.003069] ? _do_fork+0x1ef/0xfe0 [ 53.006668] ? SyS_clone+0x37/0x50 [ 53.010178] ? do_syscall_64+0x26c/0x8c0 [ 53.014209] ? entry_SYSCALL64_slow_path+0x25/0x25 [ 53.019119] ? lock_downgrade+0x990/0x990 [ 53.023240] ? mmput+0x6d0/0x6d0 [ 53.026582] ? __lock_is_held+0xbc/0x140 [ 53.030628] ? check_same_owner+0x320/0x320 [ 53.034926] ? kasan_unpoison_shadow+0x35/0x50 [ 53.039482] kasan_kmalloc+0xad/0xe0 [ 53.043173] kasan_slab_alloc+0x12/0x20 [ 53.047120] kmem_cache_alloc+0x12e/0x760 [ 53.051237] ? _down_write_nest_lock+0x120/0x120 [ 53.055968] ? rcu_read_lock_sched_held+0x108/0x120 [ 53.060960] copy_mm+0x8d7/0x1310 [ 53.064406] ? list_add_tail_rcu+0x193/0x193 [ 53.068798] ? check_same_owner+0x320/0x320 [ 53.073093] ? rcu_pm_notify+0xc0/0xc0 [ 53.076956] ? copy_process.part.36+0x202f/0x4af0 [ 53.081774] ? rcu_read_lock_sched_held+0x108/0x120 [ 53.086762] ? kmem_cache_alloc+0x469/0x760 [ 53.091067] ? _raw_spin_unlock+0x22/0x30 [ 53.095197] copy_process.part.36+0x1eae/0x4af0 [ 53.099851] ? __cleanup_sighand+0x40/0x40 [ 53.104056] ? show_initstate+0xb0/0xb0 [ 53.108004] ? bpf_prog_alloc+0x310/0x310 [ 53.112134] ? lock_release+0xd70/0xd70 [ 53.116083] ? __free_insn_slot+0x5c0/0x5c0 [ 53.120379] ? unwind_dump+0x4c0/0x4c0 [ 53.124250] ? is_bpf_text_address+0xa4/0x120 [ 53.128718] ? __kernel_text_address+0xae/0xe0 [ 53.133270] ? unwind_get_return_address+0x61/0xa0 [ 53.138171] ? __save_stack_trace+0x7e/0xd0 [ 53.142477] ? save_stack_trace+0x16/0x20 [ 53.146596] ? __lock_acquire+0x20fd/0x4620 [ 53.150889] ? find_held_lock+0x39/0x1d0 [ 53.154937] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 53.160102] ? do_wait+0x441/0xa90 [ 53.163617] ? do_raw_spin_trylock+0x190/0x190 [ 53.168170] ? lock_release+0xd50/0xd70 [ 53.172120] ? find_held_lock+0x39/0x1d0 [ 53.176162] ? lock_downgrade+0x990/0x990 [ 53.180288] ? remove_wait_queue+0x81/0x350 [ 53.184598] ? do_raw_spin_trylock+0x190/0x190 [ 53.189150] ? do_raw_spin_trylock+0x190/0x190 [ 53.193715] ? check_noncircular+0x20/0x20 [ 53.197922] ? lock_acquire+0x1d5/0x580 [ 53.201870] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 53.206860] ? trace_hardirqs_on+0xd/0x10 [ 53.210981] ? remove_wait_queue+0x1b4/0x350 [ 53.215368] ? add_wait_queue+0x1bb/0x2d0 [ 53.219510] _do_fork+0x1ef/0xfe0