INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-next-kasan-gce-8,10.128.0.37' (ECDSA) to the list of known hosts. net.ipv6.conf.syz3.accept_dad = 0 net.ipv6.conf.syz4.accept_dad = 0 net.ipv6.conf.syz7.accept_dad = 0 net.ipv6.conf.syz5.accept_dad = 0 net.ipv6.conf.syz6.accept_dad = 0 net.ipv6.conf.syz1.accept_dad = 0 net.ipv6.conf.syz0.accept_dad = 0 net.ipv6.conf.syz2.accept_dad = 0 net.ipv6.conf.syz4.router_solicitations = 0 net.ipv6.conf.syz7.router_solicitations = 0 net.ipv6.conf.syz5.router_solicitations = 0 net.ipv6.conf.syz3.router_solicitations = 0 net.ipv6.conf.syz6.router_solicitations = 0 net.ipv6.conf.syz1.router_solicitations = 0 net.ipv6.conf.syz0.router_solicitations = 0 net.ipv6.conf.syz2.router_solicitations = 0 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 49.585295] dev_remove_pack: ffff8801d8206d00 not found executing program executing program [ 49.694283] ================================================================== [ 49.701715] BUG: KASAN: use-after-free in fanout_demux_rollover+0x49b/0x4d0 [ 49.708797] Read of size 8 at addr ffff8801d8206cb0 by task syzkaller003430/8367 [ 49.716304] [ 49.717909] CPU: 0 PID: 8367 Comm: syzkaller003430 Not tainted 4.13.0-next-20170911+ #19 [ 49.726111] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 49.735446] Call Trace: [ 49.738017] [ 49.740156] dump_stack+0x194/0x257 [ 49.743784] ? arch_local_irq_restore+0x53/0x53 [ 49.748462] ? show_regs_print_info+0x65/0x65 [ 49.752958] ? fanout_demux_rollover+0x49b/0x4d0 [ 49.757693] print_address_description+0x73/0x250 [ 49.762515] ? fanout_demux_rollover+0x49b/0x4d0 [ 49.767255] kasan_report+0x24e/0x340 [ 49.771046] __asan_report_load8_noabort+0x14/0x20 [ 49.775955] fanout_demux_rollover+0x49b/0x4d0 [ 49.780522] ? skb_split+0x1310/0x1310 [ 49.784407] packet_rcv_fanout+0x52e/0x7d0 [ 49.788644] ? compat_packet_setsockopt+0x140/0x140 [ 49.793677] ? refcount_add+0x60/0x60 [ 49.797473] ? packet_rcv_fanout+0x7d0/0x7d0 [ 49.801875] __netif_receive_skb_core+0xc12/0x33d0 [ 49.806778] ? __bpf_address_lookup+0x2b0/0x2b0 [ 49.811444] ? nf_ingress+0x9f0/0x9f0 [ 49.815219] ? unwind_dump+0x4c0/0x4c0 [ 49.819082] ? check_noncircular+0x20/0x20 [ 49.823302] ? check_noncircular+0x20/0x20 [ 49.827515] ? __kernel_text_address+0xae/0xe0 [ 49.832072] ? unwind_get_return_address+0x61/0xa0 [ 49.836978] ? __save_stack_trace+0x7e/0xd0 [ 49.841285] ? print_usage_bug+0x480/0x480 [ 49.845508] ? find_held_lock+0x39/0x1d0 [ 49.849566] ? lock_downgrade+0x990/0x990 [ 49.853692] ? handle_mm_fault+0x334/0x8d0 [ 49.857913] ? lock_acquire+0x1d5/0x580 [ 49.861863] ? netif_receive_skb_internal+0x1d7/0x670 [ 49.867039] ? find_held_lock+0x39/0x1d0 [ 49.871090] ? pvclock_read_flags+0x160/0x160 [ 49.875562] ? mark_held_locks+0xb2/0x100 [ 49.879691] ? lock_acquire+0x1d5/0x580 [ 49.883642] ? netif_receive_skb_internal+0xa2/0x670 [ 49.888724] ? ktime_get_with_offset+0x2c1/0x420 [ 49.893459] ? lock_release+0xd70/0xd70 [ 49.897408] ? ktime_get+0x3a0/0x3a0 [ 49.901120] __netif_receive_skb+0x2c/0x1b0 [ 49.905419] ? __netif_receive_skb+0x2c/0x1b0 [ 49.909891] netif_receive_skb_internal+0x10b/0x670 [ 49.914894] ? dev_cpu_dead+0xb00/0xb00 [ 49.918842] ? __alloc_pages_nodemask+0xd80/0xd80 [ 49.923664] ? net_rx_action+0x1910/0x1910 [ 49.927875] ? __lock_is_held+0xbc/0x140 [ 49.931916] ? skb_gro_reset_offset+0x17b/0x300 [ 49.936562] napi_gro_receive+0x3d0/0x500 [ 49.940685] ? dev_gro_receive+0x19b0/0x19b0 [ 49.945069] ? eth_type_trans+0x2a3/0x650 [ 49.949195] ? eth_gro_receive+0x810/0x810 [ 49.953414] receive_buf+0xcc5/0x51f0 [ 49.957200] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 49.961761] ? print_usage_bug+0x480/0x480 [ 49.965978] ? __lock_acquire+0x732/0x4620 [ 49.970188] ? unwind_get_return_address+0x61/0xa0 [ 49.975093] ? __save_stack_trace+0x61/0xd0 [ 49.979399] ? rcu_report_qs_rnp+0x613/0x880 [ 49.983803] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 49.988978] ? print_usage_bug+0x480/0x480 [ 49.993195] ? find_held_lock+0x39/0x1d0 [ 49.997260] ? __lock_acquire+0x732/0x4620 [ 50.001480] ? check_noncircular+0x20/0x20 [ 50.005702] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.010873] ? print_usage_bug+0x480/0x480 [ 50.015090] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 50.020949] ? hrtimer_interrupt+0x1d4/0x5f0 [ 50.025337] ? hrtimer_interrupt+0x1d4/0x5f0 [ 50.029735] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 50.035592] ? print_usage_bug+0x480/0x480 [ 50.039807] ? smp_apic_timer_interrupt+0x177/0x710 [ 50.044796] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 50.049785] ? unwind_dump+0x4c0/0x4c0 [ 50.053655] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 50.058662] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 50.063653] ? unwind_dump+0x4c0/0x4c0 [ 50.067523] ? unwind_dump+0x4c0/0x4c0 [ 50.071395] ? __unwind_start+0x169/0x330 [ 50.075521] ? unwind_get_return_address+0x61/0xa0 [ 50.080425] ? __save_stack_trace+0x61/0xd0 [ 50.084726] ? smp_apic_timer_interrupt+0x177/0x710 [ 50.089721] ? save_stack_trace+0x16/0x20 [ 50.093842] ? __lock_acquire+0x20fd/0x4620 [ 50.098148] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 50.103139] ? unwind_dump+0x4c0/0x4c0 [ 50.107017] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.112196] ? __unwind_start+0x169/0x330 [ 50.116320] ? print_usage_bug+0x480/0x480 [ 50.120528] ? unwind_get_return_address+0x61/0xa0 [ 50.125432] ? __save_stack_trace+0x61/0xd0 [ 50.129736] ? _raw_spin_unlock_irqrestore+0x5e/0xba [ 50.134821] ? save_stack_trace+0x16/0x20 [ 50.138947] ? __lock_acquire+0x20fd/0x4620 [ 50.143252] ? vring_use_dma_api+0x7f/0xa0 [ 50.147461] ? vring_unmap_one+0x49/0x3d0 [ 50.151608] ? detach_buf+0x463/0x6a0 [ 50.155385] ? print_usage_bug+0x480/0x480 [ 50.159607] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 50.164342] ? common_interrupt+0x9d/0x9d [ 50.168470] ? detach_buf+0x6a0/0x6a0 [ 50.172254] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 50.177252] virtnet_poll+0x304/0xad0 [ 50.181051] ? receive_buf+0x51f0/0x51f0 [ 50.185090] ? unwind_dump+0x4c0/0x4c0 [ 50.188955] ? mark_held_locks+0xb2/0x100 [ 50.193080] ? net_rx_action+0x49b/0x1910 [ 50.197212] net_rx_action+0x792/0x1910 [ 50.201181] ? napi_complete_done+0x6c0/0x6c0 [ 50.205653] ? save_stack_trace+0x16/0x20 [ 50.209777] ? __lock_acquire+0x20fd/0x4620 [ 50.214084] ? mark_held_locks+0xb2/0x100 [ 50.218211] ? _raw_spin_unlock_irq+0x27/0x70 [ 50.222693] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.227862] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.233045] ? del_timer_sync+0x240/0x240 [ 50.237184] ? __lock_is_held+0xbc/0x140 [ 50.241233] ? rcu_read_lock_sched_held+0x108/0x120 [ 50.246232] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 50.251060] ? raise_softirq+0x490/0x490 [ 50.255107] ? lock_downgrade+0x990/0x990 [ 50.259236] ? print_usage_bug+0x480/0x480 [ 50.263451] ? lock_acquire+0x1d5/0x580 [ 50.267401] ? clockevents_program_event+0x163/0x2e0 [ 50.272491] ? trace_hardirqs_off+0xd/0x10 [ 50.276724] ? __napi_schedule+0x25e/0x370 [ 50.280938] ? netdev_info+0x170/0x170 [ 50.284807] ? check_noncircular+0x20/0x20 [ 50.289024] ? __lock_is_held+0xbc/0x140 [ 50.293080] ? check_noncircular+0x20/0x20 [ 50.297292] ? __lock_is_held+0xbc/0x140 [ 50.301345] ? rcu_read_lock_sched_held+0x108/0x120 [ 50.306518] ? __handle_irq_event_percpu+0x308/0x9d0 [ 50.311633] ? __lock_is_held+0xbc/0x140 [ 50.315691] __do_softirq+0x2bb/0xbd0 [ 50.319484] ? __softirqentry_text_start+0x8/0x8 [ 50.324218] ? do_raw_spin_trylock+0x190/0x190 [ 50.328786] ? handle_irq_event_percpu+0x141/0x1b0 [ 50.333693] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 50.338783] ? _raw_spin_lock+0x32/0x40 [ 50.342740] ? _raw_spin_unlock+0x22/0x30 [ 50.346874] ? handle_edge_irq+0x2b4/0x7c0 [ 50.351104] irq_exit+0x1d3/0x210 [ 50.354534] do_IRQ+0xf6/0x190 [ 50.357708] common_interrupt+0x9d/0x9d [ 50.361655] [ 50.363954] RIP: 0010:lock_release+0x69b/0xd70 [ 50.368515] RSP: 0000:ffff8801bac2f3f0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff6e [ 50.376212] RAX: dffffc0000000000 RBX: 1ffff10037585e83 RCX: 0000000000000000 [ 50.383458] RDX: 1ffffffff0b59305 RSI: ffffffff8130379e RDI: 0000000000000282 [ 50.390704] RBP: ffff8801bac2f5a0 R08: ffff8801bac2edf0 R09: 1ffff10037585e8f [ 50.397957] R10: ffff8801d8d060c0 R11: 0000000000000002 R12: ffff8801bac2f478 [ 50.405233] R13: ffff8801d8d060c0 R14: 06cdf9ec61b0fb41 R15: 0000000000000003 [ 50.412508] ? do_page_fault+0xee/0x720 [ 50.416472] ? lock_downgrade+0x990/0x990 [ 50.420603] ? alloc_set_pte+0x965/0x18f0 [ 50.424740] ? do_swap_page+0x29e0/0x29e0 [ 50.428867] ? unlock_page+0x19f/0x270 [ 50.432733] ? wake_up_page_bit+0x320/0x320 [ 50.437047] ? __lock_is_held+0xbc/0x140 [ 50.441105] filemap_map_pages+0x942/0x15d0 [ 50.445430] ? find_get_entries_tag+0xeb0/0xeb0 [ 50.450095] ? __lock_acquire+0x732/0x4620 [ 50.454306] ? __lock_acquire+0x732/0x4620 [ 50.458526] ? __save_stack_trace+0x7e/0xd0 [ 50.462833] ? depot_save_stack+0x12c/0x490 [ 50.467151] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.472317] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 50.477482] ? check_noncircular+0x20/0x20 [ 50.481692] ? print_usage_bug+0x480/0x480 [ 50.485904] ? handle_mm_fault+0x334/0x8d0 [ 50.490118] ? __do_page_fault+0x4f6/0xb60 [ 50.494328] ? do_page_fault+0xee/0x720 [ 50.498290] ? check_noncircular+0x20/0x20 [ 50.502505] ? find_held_lock+0x39/0x1d0 [ 50.506553] ? lock_downgrade+0x990/0x990 [ 50.510681] ? lock_acquire+0x1d5/0x580 [ 50.514630] ? __handle_mm_fault+0xf07/0x39c0 [ 50.519116] ? check_noncircular+0x20/0x20 [ 50.523347] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 50.528349] ? __lockdep_init_map+0xe4/0x650 [ 50.532754] ? check_noncircular+0x20/0x20 [ 50.536971] __handle_mm_fault+0x1f57/0x39c0 [ 50.541361] ? __pmd_alloc+0x4e0/0x4e0 [ 50.545235] ? lock_downgrade+0x990/0x990 [ 50.549361] ? find_held_lock+0x39/0x1d0 [ 50.553402] ? __lock_is_held+0xbc/0x140 [ 50.557467] handle_mm_fault+0x334/0x8d0 [ 50.561508] ? down_read_trylock+0xdb/0x170 [ 50.565812] ? __do_page_fault+0x2b8/0xb60 [ 50.570035] ? __handle_mm_fault+0x39c0/0x39c0 [ 50.574602] ? vmacache_find+0x61/0x270 [ 50.578557] ? find_vma+0x30/0x150 [ 50.582088] __do_page_fault+0x4f6/0xb60 [ 50.586137] do_page_fault+0xee/0x720 [ 50.589914] ? __do_page_fault+0xb60/0xb60 [ 50.594126] ? cap_task_prctl+0x1b5/0xaa0 [ 50.598256] ? security_task_prctl+0xad/0xe0 [ 50.602656] ? entry_SYSCALL_64_fastpath+0x4b/0xbe [ 50.607568] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 50.612406] page_fault+0x22/0x30 [ 50.615833] RIP: 0033:0x476af0 [ 50.618997] RSP: 002b:00007ffceb43e0f8 EFLAGS: 00010246 [ 50.624348] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000044d19a [ 50.631602] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 50.638866] RBP: 000000000000c17b R08: 0000000000000000 R09: 0000000000896940 [ 50.646115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 50.653361] R13: 0000000000407990 R14: 0000000000000000 R15: 0000000000000000 [ 50.660626] [ 50.662237] Allocated by task 8328: [ 50.665851] save_stack_trace+0x16/0x20 [ 50.669807] save_stack+0x43/0xd0 [ 50.673238] kasan_kmalloc+0xad/0xe0 [ 50.676928] __kmalloc+0x162/0x760 [ 50.680442] sk_prot_alloc+0x101/0x2a0 [ 50.684302] sk_alloc+0x89/0x700 [ 50.687652] packet_create+0x169/0xb00 [ 50.691514] __sock_create+0x4d4/0x850