[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   12.359960] audit: type=1400 audit(1514489914.041:6): avc:  denied  { map } for  pid=3129 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added '10.128.0.24' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.558174] audit: type=1400 audit(1514489920.239:7): avc:  denied  { map } for  pid=3143 comm="syzkaller440026" path="/root/syzkaller440026500" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.564216] ==================================================================
[   18.564231] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.564236] Read of size 8 at addr ffff8801c9dd2b70 by task syzkaller440026/3143
[   18.564238] 
[   18.564244] CPU: 1 PID: 3143 Comm: syzkaller440026 Not tainted 4.15.0-rc5+ #239
[   18.564248] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.564250] Call Trace:
[   18.564259]  dump_stack+0x194/0x257
[   18.564267]  ? arch_local_irq_restore+0x53/0x53
[   18.564274]  ? show_regs_print_info+0x18/0x18
[   18.564280]  ? print_irqtrace_events+0x270/0x270
[   18.564286]  ? __lock_acquire+0x664/0x3e00
[   18.564293]  ? __lock_acquire+0x3d4d/0x3e00
[   18.564301]  print_address_description+0x73/0x250
[   18.564307]  ? __lock_acquire+0x3d4d/0x3e00
[   18.564313]  kasan_report+0x25b/0x340
[   18.564321]  __asan_report_load8_noabort+0x14/0x20
[   18.564327]  __lock_acquire+0x3d4d/0x3e00
[   18.564332]  ? __lock_acquire+0x664/0x3e00
[   18.564338]  ? lock_downgrade+0x980/0x980
[   18.564343]  ? lock_downgrade+0x980/0x980
[   18.564351]  ? remove_wait_queue+0x81/0x350
[   18.564360]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.564366]  ? __lock_acquire+0x664/0x3e00
[   18.564372]  ? check_noncircular+0x20/0x20
[   18.564384]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.564391]  ? lock_acquire+0x1d5/0x580
[   18.564396]  ? lock_acquire+0x1d5/0x580
[   18.564402]  ? ep_free+0xf4/0x320
[   18.564411]  ? lock_release+0xa40/0xa40
[   18.564418]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.564424]  ? print_irqtrace_events+0x270/0x270
[   18.564431]  ? rcu_note_context_switch+0x710/0x710
[   18.564438]  ? __might_sleep+0x95/0x190
[   18.564444]  ? ep_free+0xf4/0x320
[   18.564450]  ? __mutex_lock+0x16f/0x1a80
[   18.564455]  ? ep_free+0xf4/0x320
[   18.564462]  ? print_irqtrace_events+0x270/0x270
[   18.564466]  ? ep_free+0xf4/0x320
[   18.564474]  lock_acquire+0x1d5/0x580
[   18.564479]  ? lock_acquire+0x1d5/0x580
[   18.564485]  ? remove_wait_queue+0x81/0x350
[   18.564491]  ? __lock_acquire+0x664/0x3e00
[   18.564498]  ? lock_release+0xa40/0xa40
[   18.564508]  ? lock_acquire+0x1d5/0x580
[   18.564513]  ? lock_acquire+0x1d5/0x580
[   18.564519]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.564526]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.564532]  ? remove_wait_queue+0x81/0x350
[   18.564538]  remove_wait_queue+0x81/0x350
[   18.564546]  ? add_wait_queue+0x290/0x290
[   18.564552]  ? rcutorture_record_progress+0x10/0x10
[   18.564561]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.564569]  ? __kernel_text_address+0xd/0x40
[   18.564576]  ? clear_tfile_check_list+0x370/0x370
[   18.564583]  ? check_noncircular+0x20/0x20
[   18.564591]  ? locks_remove_file+0x3fa/0x5a0
[   18.564600]  ep_free+0x13f/0x320
[   18.564606]  ? ep_remove+0x800/0x800
[   18.564613]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.564620]  ? ep_free+0x320/0x320
[   18.564625]  ep_eventpoll_release+0x44/0x60
[   18.564631]  __fput+0x327/0x7e0
[   18.564639]  ? fput+0x140/0x140
[   18.564646]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.564654]  ____fput+0x15/0x20
[   18.564660]  task_work_run+0x199/0x270
[   18.564668]  ? task_work_cancel+0x210/0x210
[   18.564674]  ? _raw_spin_unlock+0x22/0x30
[   18.564679]  ? switch_task_namespaces+0x87/0xc0
[   18.564688]  do_exit+0x9bb/0x1ad0
[   18.564697]  ? binder_ioctl+0x551/0x1417
[   18.564703]  ? mm_update_next_owner+0x930/0x930
[   18.564711]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.564726]  ? avc_ss_reset+0x110/0x110
[   18.564731]  ? mutex_unlock+0xd/0x10
[   18.564737]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   18.564756]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.564760]  ? up_read+0x1a/0x40
[   18.564767]  ? rcu_note_context_switch+0x710/0x710
[   18.564774]  ? __fd_install+0x288/0x740
[   18.564793]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.564800]  ? do_vfs_ioctl+0x486/0x1520
[   18.564807]  ? _cond_resched+0x14/0x30
[   18.564815]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.564823]  ? selinux_capable+0x40/0x40
[   18.564830]  ? __alloc_fd+0x750/0x750
[   18.564838]  do_group_exit+0x149/0x400
[   18.564844]  ? SyS_exit+0x30/0x30
[   18.564851]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.564860]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.564868]  SyS_exit_group+0x1d/0x20
[   18.564875]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.564879] RIP: 0033:0x4429f8
[   18.564883] RSP: 002b:00007ffe785d0af8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.564889] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.564892] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.564896] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.564900] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.564903] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.564911] 
[   18.564914] Allocated by task 3143:
[   18.564919]  save_stack+0x43/0xd0
[   18.564924]  kasan_kmalloc+0xad/0xe0
[   18.564930]  kmem_cache_alloc_trace+0x136/0x750
[   18.564935]  binder_get_thread+0x1cf/0x870
[   18.564939]  binder_poll+0x8c/0x390
[   18.564944]  ep_item_poll.isra.10+0xec/0x320
[   18.564948]  ep_insert+0x6a3/0x1b10
[   18.564953]  SyS_epoll_ctl+0x12e4/0x1ab0
[   18.564958]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.564959] 
[   18.564962] Freed by task 3143:
[   18.564966]  save_stack+0x43/0xd0
[   18.564970]  kasan_slab_free+0x71/0xc0
[   18.564974]  kfree+0xd6/0x260
[   18.564979]  binder_thread_dec_tmpref+0x27f/0x310
[   18.564984]  binder_thread_release+0x27d/0x540
[   18.564988]  binder_ioctl+0xc02/0x1417
[   18.564993]  do_vfs_ioctl+0x1b1/0x1520
[   18.565006]  SyS_ioctl+0x8f/0xc0
[   18.565011]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.565012] 
[   18.565016] The buggy address belongs to the object at ffff8801c9dd2ac0
[   18.565016]  which belongs to the cache kmalloc-512 of size 512
[   18.565021] The buggy address is located 176 bytes inside of
[   18.565021]  512-byte region [ffff8801c9dd2ac0, ffff8801c9dd2cc0)
[   18.565023] The buggy address belongs to the page:
[   18.565028] page:00000000b0b8c6bd count:1 mapcount:0 mapping:000000007efcd817 index:0xffff8801c9dd2d40
[   18.565034] flags: 0x2fffc0000000100(slab)
[   18.565044] raw: 02fffc0000000100 ffff8801c9dd20c0 ffff8801c9dd2d40 0000000100000002
[   18.565050] raw: ffffea000728d060 ffffea00073b1b60 ffff8801db000940 0000000000000000
[   18.565053] page dumped because: kasan: bad access detected
[   18.565054] 
[   18.565055] Memory state around the buggy address:
[   18.565060]  ffff8801c9dd2a00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   18.565064]  ffff8801c9dd2a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   18.565069] >ffff8801c9dd2b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.565071]                                                              ^
[   18.565075]  ffff8801c9dd2b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.565079]  ffff8801c9dd2c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.565081] ==================================================================
[   18.565083] Disabling lock debugging due to kernel taint
[   18.565087] Kernel panic - not syncing: panic_on_warn set ...
[   18.565087] 
[   18.565092] CPU: 1 PID: 3143 Comm: syzkaller440026 Tainted: G    B            4.15.0-rc5+ #239
[   18.565095] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.565097] Call Trace:
[   18.565103]  dump_stack+0x194/0x257
[   18.565109]  ? arch_local_irq_restore+0x53/0x53
[   18.565114]  ? kasan_end_report+0x32/0x50
[   18.565121]  ? lock_downgrade+0x980/0x980
[   18.565127]  ? vsnprintf+0x1ed/0x1900
[   18.565133]  ? __lock_acquire+0x3cd0/0x3e00
[   18.565138]  panic+0x1e4/0x41c
[   18.565144]  ? refcount_error_report+0x214/0x214
[   18.565151]  ? add_taint+0x40/0x50
[   18.565156]  ? add_taint+0x1c/0x50
[   18.565163]  ? __lock_acquire+0x3d4d/0x3e00
[   18.565168]  kasan_end_report+0x50/0x50
[   18.565174]  kasan_report+0x144/0x340
[   18.565181]  __asan_report_load8_noabort+0x14/0x20
[   18.565187]  __lock_acquire+0x3d4d/0x3e00
[   18.565193]  ? __lock_acquire+0x664/0x3e00
[   18.565198]  ? lock_downgrade+0x980/0x980
[   18.565203]  ? lock_downgrade+0x980/0x980
[   18.565211]  ? remove_wait_queue+0x81/0x350
[   18.565219]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.565225]  ? __lock_acquire+0x664/0x3e00
[   18.565231]  ? check_noncircular+0x20/0x20
[   18.565242]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.565249]  ? lock_acquire+0x1d5/0x580
[   18.565255]  ? lock_acquire+0x1d5/0x580
[   18.565259]  ? ep_free+0xf4/0x320
[   18.565267]  ? lock_release+0xa40/0xa40
[   18.565273]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.565279]  ? print_irqtrace_events+0x270/0x270
[   18.565286]  ? rcu_note_context_switch+0x710/0x710
[   18.565293]  ? __might_sleep+0x95/0x190
[   18.565298]  ? ep_free+0xf4/0x320
[   18.565303]  ? __mutex_lock+0x16f/0x1a80
[   18.565308]  ? ep_free+0xf4/0x320
[   18.565315]  ? print_irqtrace_events+0x270/0x270
[   18.565319]  ? ep_free+0xf4/0x320
[   18.565327]  lock_acquire+0x1d5/0x580
[   18.565332]  ? lock_acquire+0x1d5/0x580
[   18.565338]  ? remove_wait_queue+0x81/0x350
[   18.565344]  ? __lock_acquire+0x664/0x3e00
[   18.565351]  ? lock_release+0xa40/0xa40
[   18.565360]  ? lock_acquire+0x1d5/0x580
[   18.565365]  ? lock_acquire+0x1d5/0x580
[   18.565370]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.565378]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.565383]  ? remove_wait_queue+0x81/0x350
[   18.565390]  remove_wait_queue+0x81/0x350
[   18.565397]  ? add_wait_queue+0x290/0x290
[   18.565403]  ? rcutorture_record_progress+0x10/0x10
[   18.565412]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.565419]  ? __kernel_text_address+0xd/0x40
[   18.565426]  ? clear_tfile_check_list+0x370/0x370
[   18.565433]  ? check_noncircular+0x20/0x20
[   18.565440]  ? locks_remove_file+0x3fa/0x5a0
[   18.565449]  ep_free+0x13f/0x320
[   18.565454]  ? ep_remove+0x800/0x800
[   18.565461]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.565468]  ? ep_free+0x320/0x320
[   18.565473]  ep_eventpoll_release+0x44/0x60
[   18.565479]  __fput+0x327/0x7e0
[   18.565486]  ? fput+0x140/0x140
[   18.565493]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.565500]  ____fput+0x15/0x20
[   18.565507]  task_work_run+0x199/0x270
[   18.565514]  ? task_work_cancel+0x210/0x210
[   18.565520]  ? _raw_spin_unlock+0x22/0x30
[   18.565526]  ? switch_task_namespaces+0x87/0xc0
[   18.565533]  do_exit+0x9bb/0x1ad0
[   18.565541]  ? binder_ioctl+0x551/0x1417
[   18.565546]  ? mm_update_next_owner+0x930/0x930
[   18.565554]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.565563]  ? avc_ss_reset+0x110/0x110
[   18.565568]  ? mutex_unlock+0xd/0x10
[   18.565573]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   18.565591]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.565596]  ? up_read+0x1a/0x40
[   18.565602]  ? rcu_note_context_switch+0x710/0x710
[   18.565608]  ? __fd_install+0x288/0x740
[   18.565617]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   18.565623]  ? do_vfs_ioctl+0x486/0x1520
[   18.565628]  ? _cond_resched+0x14/0x30
[   18.565636]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.565643]  ? selinux_capable+0x40/0x40
[   18.565650]  ? __alloc_fd+0x750/0x750
[   18.565658]  do_group_exit+0x149/0x400
[   18.565664]  ? SyS_exit+0x30/0x30
[   18.565671]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.565678]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.565685]  SyS_exit_group+0x1d/0x20
[   18.565691]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.565695] RIP: 0033:0x4429f8
[   18.565698] RSP: 002b:00007ffe785d0af8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.565703] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.565707] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.565710] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.565713] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.565716] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.586044] Dumping ftrace buffer:
[   18.586047]    (ftrace buffer empty)
[   18.586050] Kernel Offset: disabled
[   19.714486] Rebooting in 86400 seconds..