INIT: Entering runlevel: 2

[info] Using makefile-style concurrent boot in runlevel 2.
[....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.32' (ECDSA) to the list of known hosts.
2018/04/09 06:02:07 parsed 1 programs
2018/04/09 06:02:07 executed programs: 0
syzkaller login: [   35.595640] IPVS: ftp: loaded support on port[0] = 21
[   35.606264] IPVS: ftp: loaded support on port[0] = 21
[   35.607611] IPVS: ftp: loaded support on port[0] = 21
[   35.626167] IPVS: ftp: loaded support on port[0] = 21
[   35.630956] IPVS: ftp: loaded support on port[0] = 21
[   35.643628] IPVS: ftp: loaded support on port[0] = 21
[   35.654458] IPVS: ftp: loaded support on port[0] = 21
[   35.663262] IPVS: ftp: loaded support on port[0] = 21
2018/04/09 06:02:12 executed programs: 458
[   45.578655] ==================================================================
[   45.586213] BUG: KASAN: use-after-free in pppol2tp_connect+0x1e60/0x1f60
[   45.593059] Read of size 8 at addr ffff8801c13d5968 by task syz-executor1/8011
[   45.600425] 
[   45.602064] CPU: 1 PID: 8011 Comm: syz-executor1 Not tainted 4.16.0+ #1
[   45.608818] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.618172] Call Trace:
[   45.620768]  dump_stack+0x1b9/0x29f
[   45.624405]  ? arch_local_irq_restore+0x52/0x52
[   45.629078]  ? printk+0x9e/0xba
[   45.632368]  ? show_regs_print_info+0x18/0x18
[   45.636871]  ? kasan_check_write+0x14/0x20
[   45.641116]  print_address_description+0x6c/0x20b
[   45.645967]  ? pppol2tp_connect+0x1e60/0x1f60
[   45.650479]  kasan_report.cold.7+0xac/0x2f5
[   45.654844]  __asan_report_load8_noabort+0x14/0x20
[   45.659785]  pppol2tp_connect+0x1e60/0x1f60
[   45.664123]  ? pppol2tp_session_destruct+0x130/0x130
[   45.669244]  ? lock_downgrade+0x8e0/0x8e0
[   45.673399]  ? lock_release+0xa10/0xa10
[   45.677379]  ? check_same_owner+0x320/0x320
[   45.681712]  ? __check_object_size+0x95/0x5d9
[   45.686227]  ? __might_sleep+0x95/0x190
[   45.690213]  ? _copy_from_user+0xdf/0x150
[   45.694369]  ? security_socket_connect+0x9b/0xd0
[   45.699135]  __sys_connect+0x37d/0x4c0
[   45.703031]  ? SyS_accept+0x30/0x30
[   45.706668]  ? find_held_lock+0x36/0x1c0
[   45.710743]  ? finish_task_switch+0x182/0x820
[   45.715247]  ? kasan_check_read+0x11/0x20
[   45.719407]  ? do_raw_spin_unlock+0x9e/0x2e0
[   45.723822]  ? do_raw_spin_trylock+0x1b0/0x1b0
2018/04/09 06:02:17 executed programs: 939
[   45.728417]  SyS_connect+0x24/0x30
[   45.731958]  ? __sys_connect+0x4c0/0x4c0
[   45.736027]  do_syscall_64+0x29e/0x9d0
[   45.739924]  ? _raw_spin_unlock_irq+0x27/0x70
[   45.744422]  ? finish_task_switch+0x1ca/0x820
[   45.748925]  ? syscall_return_slowpath+0x5c0/0x5c0
[   45.753859]  ? syscall_return_slowpath+0x30f/0x5c0
[   45.758802]  ? entry_SYSCALL_64_after_hwframe+0x52/0xb7
[   45.764187]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   45.769050]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   45.774244] RIP: 0033:0x455259
[   45.777432] RSP: 002b:00007fc8562e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[   45.785143] RAX: ffffffffffffffda RBX: 00007fc8562e86d4 RCX: 0000000000455259
[   45.792504] RDX: 000000000000002e RSI: 00000000205fafd2 RDI: 0000000000000004
[   45.799769] RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000
[   45.807034] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[   45.814308] R13: 000000000000005c R14: 00000000006f3940 R15: 0000000000000001
[   45.821589] 
[   45.823212] Allocated by task 8009:
[   45.826843]  save_stack+0x43/0xd0
[   45.830297]  kasan_kmalloc+0xc4/0xe0
[   45.834015]  kasan_slab_alloc+0x12/0x20
[   45.837992]  kmem_cache_alloc+0x12e/0x760
[   45.842127]  sk_prot_alloc+0x69/0x2e0
[   45.845906]  sk_alloc+0x104/0x17b0
[   45.849441]  inet6_create+0x4f0/0x12a0
[   45.853313]  __sock_create+0x526/0x920
[   45.857181]  __sys_socket+0x100/0x250
[   45.860972]  SyS_socket+0x24/0x30
[   45.864405]  do_syscall_64+0x29e/0x9d0
[   45.868288]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   45.873456] 
[   45.875060] Freed by task 56:
[   45.878154]  save_stack+0x43/0xd0
[   45.881594]  __kasan_slab_free+0x11a/0x170
[   45.885816]  kasan_slab_free+0xe/0x10
[   45.889605]  kmem_cache_free+0x86/0x2d0
[   45.893561]  __sk_destruct+0x6fe/0xa40
[   45.897444]  sk_destruct+0x78/0x90
[   45.900973]  __sk_free+0x22e/0x340
[   45.904489]  sk_free+0x42/0x50
[   45.907663]  l2tp_tunnel_del_work+0x669/0x830
[   45.912137]  process_one_work+0xc1e/0x1b50
[   45.916348]  worker_thread+0x1cc/0x1440
[   45.920310]  kthread+0x345/0x410
[   45.923673]  ret_from_fork+0x3a/0x50
[   45.927359] 
[   45.928979] The buggy address belongs to the object at ffff8801c13d5740
[   45.928979]  which belongs to the cache UDPv6 of size 1728
[   45.941180] The buggy address is located 552 bytes inside of
[   45.941180]  1728-byte region [ffff8801c13d5740, ffff8801c13d5e00)
[   45.953119] The buggy address belongs to the page:
[   45.958039] page:ffffea000704f540 count:1 mapcount:0 mapping:ffff8801c13d5000 index:0x0
[   45.966172] flags: 0x2fffc0000000100(slab)
[   45.970390] raw: 02fffc0000000100 ffff8801c13d5000 0000000000000000 0000000100000002
[   45.978252] raw: ffffea0006c39120 ffffea0006b76ea0 ffff8801ce4da200 0000000000000000
[   45.986106] page dumped because: kasan: bad access detected
[   45.991789] 
[   45.993396] Memory state around the buggy address:
[   45.998305]  ffff8801c13d5800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.005641]  ffff8801c13d5880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.012980] >ffff8801c13d5900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.020313]                                                           ^
[   46.027047]  ffff8801c13d5980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.034389]  ffff8801c13d5a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   46.041729] ==================================================================
[   46.049081] Disabling lock debugging due to kernel taint
[   46.054672] Kernel panic - not syncing: panic_on_warn set ...
[   46.054672] 
[   46.062043] CPU: 1 PID: 8011 Comm: syz-executor1 Tainted: G    B            4.16.0+ #1
[   46.070094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   46.079440] Call Trace:
[   46.082015]  dump_stack+0x1b9/0x29f
[   46.085627]  ? arch_local_irq_restore+0x52/0x52
[   46.090286]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   46.095037]  ? pppol2tp_connect+0x1d80/0x1f60
[   46.099513]  panic+0x22f/0x4de
[   46.102686]  ? add_taint.cold.5+0x16/0x16
[   46.106814]  ? do_raw_spin_unlock+0x9e/0x2e0
[   46.111204]  ? do_raw_spin_unlock+0x9e/0x2e0
[   46.115593]  ? pppol2tp_connect+0x1e60/0x1f60
[   46.120085]  kasan_end_report+0x47/0x4f
[   46.124046]  kasan_report.cold.7+0xc9/0x2f5
[   46.128350]  __asan_report_load8_noabort+0x14/0x20
[   46.133261]  pppol2tp_connect+0x1e60/0x1f60
[   46.137569]  ? pppol2tp_session_destruct+0x130/0x130
[   46.142658]  ? lock_downgrade+0x8e0/0x8e0
[   46.146795]  ? lock_release+0xa10/0xa10
[   46.150748]  ? check_same_owner+0x320/0x320
[   46.155055]  ? __check_object_size+0x95/0x5d9
[   46.159541]  ? __might_sleep+0x95/0x190
[   46.163513]  ? _copy_from_user+0xdf/0x150
[   46.167647]  ? security_socket_connect+0x9b/0xd0
[   46.172385]  __sys_connect+0x37d/0x4c0
[   46.176262]  ? SyS_accept+0x30/0x30
[   46.179878]  ? find_held_lock+0x36/0x1c0
[   46.183940]  ? finish_task_switch+0x182/0x820
[   46.188418]  ? kasan_check_read+0x11/0x20
[   46.192553]  ? do_raw_spin_unlock+0x9e/0x2e0
[   46.196957]  ? do_raw_spin_trylock+0x1b0/0x1b0
[   46.201523]  SyS_connect+0x24/0x30
[   46.205051]  ? __sys_connect+0x4c0/0x4c0
[   46.209101]  do_syscall_64+0x29e/0x9d0
[   46.212973]  ? _raw_spin_unlock_irq+0x27/0x70
[   46.217450]  ? finish_task_switch+0x1ca/0x820
[   46.221929]  ? syscall_return_slowpath+0x5c0/0x5c0
[   46.226841]  ? syscall_return_slowpath+0x30f/0x5c0
[   46.231750]  ? entry_SYSCALL_64_after_hwframe+0x52/0xb7
[   46.237093]  ? trace_hardirqs_off_thunk+0x1a/0x1c
[   46.241917]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
[   46.247085] RIP: 0033:0x455259
[   46.250252] RSP: 002b:00007fc8562e7c68 EFLAGS: 00000246 ORIG_RAX: 000000000000002a
[   46.257940] RAX: ffffffffffffffda RBX: 00007fc8562e86d4 RCX: 0000000000455259
[   46.265193] RDX: 000000000000002e RSI: 00000000205fafd2 RDI: 0000000000000004
[   46.272451] RBP: 000000000072bf58 R08: 0000000000000000 R09: 0000000000000000
[   46.279702] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
[   46.286952] R13: 000000000000005c R14: 00000000006f3940 R15: 0000000000000001
[   46.294669] Dumping ftrace buffer:
[   46.298189]    (ftrace buffer empty)
[   46.301874] Kernel Offset: disabled
[   46.305475] Rebooting in 86400 seconds..