[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   12.166607] audit: type=1400 audit(1514551933.378:6): avc:  denied  { map } for  pid=3127 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.10' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.301459] audit: type=1400 audit(1514551939.513:7): avc:  denied  { map } for  pid=3141 comm="syzkaller212257" path="/root/syzkaller212257601" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.307610] ==================================================================
[   18.307624] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.307629] Read of size 8 at addr ffff8801cf3eeb38 by task syzkaller212257/3141
[   18.307630] 
[   18.307637] CPU: 1 PID: 3141 Comm: syzkaller212257 Not tainted 4.15.0-rc4-mm1+ #49
[   18.307641] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.307643] Call Trace:
[   18.307651]  dump_stack+0x194/0x257
[   18.307659]  ? arch_local_irq_restore+0x53/0x53
[   18.307667]  ? show_regs_print_info+0x18/0x18
[   18.307672]  ? print_irqtrace_events+0x270/0x270
[   18.307679]  ? __lock_acquire+0x664/0x3e00
[   18.307685]  ? __lock_acquire+0x3d4d/0x3e00
[   18.307694]  print_address_description+0x73/0x250
[   18.307700]  ? __lock_acquire+0x3d4d/0x3e00
[   18.307706]  kasan_report+0x23b/0x360
[   18.307715]  __asan_report_load8_noabort+0x14/0x20
[   18.307720]  __lock_acquire+0x3d4d/0x3e00
[   18.307726]  ? __lock_acquire+0x664/0x3e00
[   18.307732]  ? lock_downgrade+0x980/0x980
[   18.307737]  ? lock_downgrade+0x980/0x980
[   18.307745]  ? remove_wait_queue+0x81/0x350
[   18.307754]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.307760]  ? __lock_acquire+0x664/0x3e00
[   18.307766]  ? check_noncircular+0x20/0x20
[   18.307778]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.307785]  ? lock_acquire+0x1d5/0x580
[   18.307790]  ? lock_acquire+0x1d5/0x580
[   18.307797]  ? ep_free+0xf4/0x320
[   18.307806]  ? lock_release+0xa40/0xa40
[   18.307812]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.307818]  ? print_irqtrace_events+0x270/0x270
[   18.307825]  ? rcu_note_context_switch+0x710/0x710
[   18.307832]  ? __might_sleep+0x95/0x190
[   18.307838]  ? ep_free+0xf4/0x320
[   18.307844]  ? __mutex_lock+0x16f/0x1a80
[   18.307848]  ? ep_free+0xf4/0x320
[   18.307855]  ? print_irqtrace_events+0x270/0x270
[   18.307860]  ? ep_free+0xf4/0x320
[   18.307868]  lock_acquire+0x1d5/0x580
[   18.307874]  ? lock_acquire+0x1d5/0x580
[   18.307879]  ? remove_wait_queue+0x81/0x350
[   18.307885]  ? __lock_acquire+0x664/0x3e00
[   18.307893]  ? lock_release+0xa40/0xa40
[   18.307902]  ? lock_acquire+0x1d5/0x580
[   18.307907]  ? lock_acquire+0x1d5/0x580
[   18.307913]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.307921]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.307926]  ? remove_wait_queue+0x81/0x350
[   18.307933]  remove_wait_queue+0x81/0x350
[   18.307941]  ? add_wait_queue+0x290/0x290
[   18.307946]  ? rcutorture_record_progress+0x10/0x10
[   18.307956]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.307963]  ? __kernel_text_address+0xd/0x40
[   18.307971]  ? clear_tfile_check_list+0x370/0x370
[   18.307979]  ? check_noncircular+0x20/0x20
[   18.307987]  ? locks_remove_file+0x3fa/0x5a0
[   18.307996]  ep_free+0x13f/0x320
[   18.308006]  ? ep_remove+0x800/0x800
[   18.308012]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.308020]  ? ep_free+0x320/0x320
[   18.308026]  ep_eventpoll_release+0x44/0x60
[   18.308032]  __fput+0x327/0x7e0
[   18.308041]  ? fput+0x140/0x140
[   18.308047]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.308055]  ____fput+0x15/0x20
[   18.308062]  task_work_run+0x199/0x270
[   18.308074]  ? task_work_cancel+0x210/0x210
[   18.308079]  ? _raw_spin_unlock+0x22/0x30
[   18.308085]  ? switch_task_namespaces+0x87/0xc0
[   18.308094]  do_exit+0x9bb/0x1ad0
[   18.308102]  ? binder_ioctl+0x551/0x1417
[   18.308109]  ? mm_update_next_owner+0x930/0x930
[   18.308116]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.308126]  ? avc_ss_reset+0x110/0x110
[   18.308134]  ? mutex_unlock+0xd/0x10
[   18.308139]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.308159]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.308164]  ? up_read+0x1a/0x40
[   18.308170]  ? rcu_note_context_switch+0x710/0x710
[   18.308175]  ? __fd_install+0x288/0x740
[   18.308184]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.308190]  ? do_vfs_ioctl+0x486/0x1520
[   18.308196]  ? _cond_resched+0x14/0x30
[   18.308204]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.308211]  ? selinux_capable+0x40/0x40
[   18.308217]  ? __alloc_fd+0x750/0x750
[   18.308226]  do_group_exit+0x149/0x400
[   18.308232]  ? SyS_exit+0x30/0x30
[   18.308239]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.308248]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.308255]  SyS_exit_group+0x1d/0x20
[   18.308261]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.308266] RIP: 0033:0x4429f8
[   18.308269] RSP: 002b:00007ffc732a1d58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.308275] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.308279] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.308282] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.308286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.308289] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.308297] 
[   18.308300] Allocated by task 3141:
[   18.308306]  save_stack+0x43/0xd0
[   18.308310]  kasan_kmalloc+0xad/0xe0
[   18.308315]  kmem_cache_alloc_trace+0x136/0x750
[   18.308320]  binder_get_thread+0x1cf/0x870
[   18.308324]  binder_poll+0x8c/0x390
[   18.308329]  ep_item_poll.isra.10+0xf2/0x320
[   18.308333]  ep_insert+0x6a2/0x1ac0
[   18.308338]  SyS_epoll_ctl+0x12bf/0x1a80
[   18.308343]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.308344] 
[   18.308347] Freed by task 3141:
[   18.308351]  save_stack+0x43/0xd0
[   18.308356]  kasan_slab_free+0x71/0xc0
[   18.308360]  kfree+0xd6/0x260
[   18.308365]  binder_thread_dec_tmpref+0x27f/0x310
[   18.308369]  binder_thread_release+0x27d/0x540
[   18.308373]  binder_ioctl+0xc02/0x1417
[   18.308377]  do_vfs_ioctl+0x1b1/0x1520
[   18.308382]  SyS_ioctl+0x8f/0xc0
[   18.308387]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.308388] 
[   18.308392] The buggy address belongs to the object at ffff8801cf3eea80
[   18.308392]  which belongs to the cache kmalloc-512 of size 512
[   18.308397] The buggy address is located 184 bytes inside of
[   18.308397]  512-byte region [ffff8801cf3eea80, ffff8801cf3eec80)
[   18.308398] The buggy address belongs to the page:
[   18.308403] page:ffffea00073cfb80 count:1 mapcount:0 mapping:ffff8801cf3ee080 index:0x0
[   18.308408] flags: 0x2fffc0000000100(slab)
[   18.308416] raw: 02fffc0000000100 ffff8801cf3ee080 0000000000000000 0000000100000006
[   18.308423] raw: ffffea00073b1f20 ffffea00073cf120 ffff8801dac00940 0000000000000000
[   18.308426] page dumped because: kasan: bad access detected
[   18.308427] 
[   18.308428] Memory state around the buggy address:
[   18.308433]  ffff8801cf3eea00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.308438]  ffff8801cf3eea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.308442] >ffff8801cf3eeb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.308444]                                         ^
[   18.308448]  ffff8801cf3eeb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.308452]  ffff8801cf3eec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.308454] ==================================================================
[   18.308456] Disabling lock debugging due to kernel taint
[   18.308459] Kernel panic - not syncing: panic_on_warn set ...
[   18.308459] 
[   18.308465] CPU: 1 PID: 3141 Comm: syzkaller212257 Tainted: G    B            4.15.0-rc4-mm1+ #49
[   18.308468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.308469] Call Trace:
[   18.308475]  dump_stack+0x194/0x257
[   18.308482]  ? arch_local_irq_restore+0x53/0x53
[   18.308487]  ? kasan_end_report+0x32/0x50
[   18.308493]  ? lock_downgrade+0x980/0x980
[   18.308499]  ? vsnprintf+0x1ed/0x1900
[   18.308505]  ? __lock_acquire+0x3c90/0x3e00
[   18.308510]  panic+0x1e4/0x41c
[   18.308516]  ? refcount_error_report+0x214/0x214
[   18.308524]  ? add_taint+0x40/0x50
[   18.308528]  ? add_taint+0x1c/0x50
[   18.308535]  ? __lock_acquire+0x3d4d/0x3e00
[   18.308541]  kasan_end_report+0x50/0x50
[   18.308547]  kasan_report+0x148/0x360
[   18.308555]  __asan_report_load8_noabort+0x14/0x20
[   18.308560]  __lock_acquire+0x3d4d/0x3e00
[   18.308565]  ? __lock_acquire+0x664/0x3e00
[   18.308571]  ? lock_downgrade+0x980/0x980
[   18.308576]  ? lock_downgrade+0x980/0x980
[   18.308583]  ? remove_wait_queue+0x81/0x350
[   18.308592]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.308598]  ? __lock_acquire+0x664/0x3e00
[   18.308603]  ? check_noncircular+0x20/0x20
[   18.308615]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.308622]  ? lock_acquire+0x1d5/0x580
[   18.308628]  ? lock_acquire+0x1d5/0x580
[   18.308633]  ? ep_free+0xf4/0x320
[   18.308641]  ? lock_release+0xa40/0xa40
[   18.308647]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.308653]  ? print_irqtrace_events+0x270/0x270
[   18.308659]  ? rcu_note_context_switch+0x710/0x710
[   18.308666]  ? __might_sleep+0x95/0x190
[   18.308672]  ? ep_free+0xf4/0x320
[   18.308677]  ? __mutex_lock+0x16f/0x1a80
[   18.308682]  ? ep_free+0xf4/0x320
[   18.308688]  ? print_irqtrace_events+0x270/0x270
[   18.308693]  ? ep_free+0xf4/0x320
[   18.308701]  lock_acquire+0x1d5/0x580
[   18.308706]  ? lock_acquire+0x1d5/0x580
[   18.308712]  ? remove_wait_queue+0x81/0x350
[   18.308718]  ? __lock_acquire+0x664/0x3e00
[   18.308725]  ? lock_release+0xa40/0xa40
[   18.308734]  ? lock_acquire+0x1d5/0x580
[   18.308739]  ? lock_acquire+0x1d5/0x580
[   18.308745]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.308752]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.308757]  ? remove_wait_queue+0x81/0x350
[   18.308764]  remove_wait_queue+0x81/0x350
[   18.308771]  ? add_wait_queue+0x290/0x290
[   18.308777]  ? rcutorture_record_progress+0x10/0x10
[   18.308787]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.308793]  ? __kernel_text_address+0xd/0x40
[   18.308801]  ? clear_tfile_check_list+0x370/0x370
[   18.308808]  ? check_noncircular+0x20/0x20
[   18.308816]  ? locks_remove_file+0x3fa/0x5a0
[   18.308825]  ep_free+0x13f/0x320
[   18.308831]  ? ep_remove+0x800/0x800
[   18.308836]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.308843]  ? ep_free+0x320/0x320
[   18.308849]  ep_eventpoll_release+0x44/0x60
[   18.308855]  __fput+0x327/0x7e0
[   18.308863]  ? fput+0x140/0x140
[   18.308869]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.308877]  ____fput+0x15/0x20
[   18.308883]  task_work_run+0x199/0x270
[   18.308890]  ? task_work_cancel+0x210/0x210
[   18.308896]  ? _raw_spin_unlock+0x22/0x30
[   18.308902]  ? switch_task_namespaces+0x87/0xc0
[   18.308909]  do_exit+0x9bb/0x1ad0
[   18.308916]  ? binder_ioctl+0x551/0x1417
[   18.308922]  ? mm_update_next_owner+0x930/0x930
[   18.308930]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.308938]  ? avc_ss_reset+0x110/0x110
[   18.308944]  ? mutex_unlock+0xd/0x10
[   18.308950]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.308968]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.308972]  ? up_read+0x1a/0x40
[   18.308979]  ? rcu_note_context_switch+0x710/0x710
[   18.308983]  ? __fd_install+0x288/0x740
[   18.308992]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.308997]  ? do_vfs_ioctl+0x486/0x1520
[   18.309002]  ? _cond_resched+0x14/0x30
[   18.309010]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.309017]  ? selinux_capable+0x40/0x40
[   18.309023]  ? __alloc_fd+0x750/0x750
[   18.309031]  do_group_exit+0x149/0x400
[   18.309037]  ? SyS_exit+0x30/0x30
[   18.309044]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.309050]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.309057]  SyS_exit_group+0x1d/0x20
[   18.309067]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.309070] RIP: 0033:0x4429f8
[   18.309073] RSP: 002b:00007ffc732a1d58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.309079] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.309082] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.309086] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.309089] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.309092] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.328866] Dumping ftrace buffer:
[   18.328869]    (ftrace buffer empty)
[   18.328871] Kernel Offset: disabled
[   19.474615] Rebooting in 86400 seconds..