INIT: Entering runlevel: 2 [info] Using makefile-style concurrent boot in runlevel 2. [....] Starting enhanced syslogd: rsyslogd[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. Debian GNU/Linux 7 syzkaller ttyS0 Warning: Permanently added 'ci-upstream-mmots-kasan-gce-9,10.128.0.37' (ECDSA) to the list of known hosts. executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program syzkaller login: [ 36.051929] dev_remove_pack: ffff8801c7fdd2c0 not found [ 36.090414] ================================================================== [ 36.097875] BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2be3/0x33d0 [ 36.105394] Read of size 2 at addr ffff8801c8b0cd40 by task syzkaller670389/5799 [ 36.112907] [ 36.114514] CPU: 1 PID: 5799 Comm: syzkaller670389 Not tainted 4.13.0-mm1+ #7 [ 36.121766] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 36.131117] Call Trace: [ 36.133683] [ 36.135827] dump_stack+0x194/0x257 [ 36.139438] ? arch_local_irq_restore+0x53/0x53 [ 36.144084] ? show_regs_print_info+0x65/0x65 [ 36.148565] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 36.153735] print_address_description+0x73/0x250 [ 36.158555] ? __netif_receive_skb_core+0x2be3/0x33d0 [ 36.163720] kasan_report+0x24e/0x340 [ 36.167515] __asan_report_load2_noabort+0x14/0x20 [ 36.172434] __netif_receive_skb_core+0x2be3/0x33d0 [ 36.177433] ? __bpf_address_lookup+0x2b0/0x2b0 [ 36.182096] ? nf_ingress+0x9f0/0x9f0 [ 36.185871] ? unwind_dump+0x4c0/0x4c0 [ 36.189736] ? check_noncircular+0x20/0x20 [ 36.193984] ? check_noncircular+0x20/0x20 [ 36.198208] ? __kernel_text_address+0xae/0xe0 [ 36.202771] ? unwind_get_return_address+0x61/0xa0 [ 36.207674] ? __save_stack_trace+0x7e/0xd0 [ 36.211976] ? print_usage_bug+0x480/0x480 [ 36.216194] ? find_held_lock+0x39/0x1d0 [ 36.220260] ? lock_downgrade+0x990/0x990 [ 36.224406] ? lock_acquire+0x1d5/0x580 [ 36.228361] ? netif_receive_skb_internal+0x1d7/0x670 [ 36.233526] ? find_held_lock+0x39/0x1d0 [ 36.237570] ? pvclock_read_flags+0x160/0x160 [ 36.242052] ? mark_held_locks+0xb2/0x100 [ 36.246180] ? lock_acquire+0x1d5/0x580 [ 36.250125] ? netif_receive_skb_internal+0xa2/0x670 [ 36.255205] ? ktime_get_with_offset+0x2c1/0x420 [ 36.259937] ? lock_release+0xd70/0xd70 [ 36.263885] ? ktime_get+0x3a0/0x3a0 [ 36.267585] __netif_receive_skb+0x2c/0x1b0 [ 36.271891] ? __netif_receive_skb+0x2c/0x1b0 [ 36.276371] netif_receive_skb_internal+0x10b/0x670 [ 36.281362] ? dev_cpu_dead+0xb00/0xb00 [ 36.285316] ? __put_compound_page+0x87/0xb0 [ 36.289711] ? net_rx_action+0x1910/0x1910 [ 36.293936] ? __lock_is_held+0xbc/0x140 [ 36.298000] ? skb_gro_reset_offset+0x17b/0x300 [ 36.302664] napi_gro_receive+0x3d0/0x500 [ 36.306804] ? dev_gro_receive+0x19b0/0x19b0 [ 36.311202] ? eth_type_trans+0x2a3/0x650 [ 36.315333] ? eth_gro_receive+0x810/0x810 [ 36.319559] receive_buf+0xcc5/0x51f0 [ 36.323349] ? virtnet_set_rx_mode+0x9f0/0x9f0 [ 36.327918] ? print_usage_bug+0x480/0x480 [ 36.332141] ? __unwind_start+0x169/0x330 [ 36.336288] ? unwind_get_return_address+0x61/0xa0 [ 36.341211] ? __save_stack_trace+0x61/0xd0 [ 36.345520] ? rcu_report_qs_rnp+0x613/0x880 [ 36.349920] ? save_stack_trace+0x16/0x20 [ 36.354051] ? __lock_acquire+0x20fd/0x4620 [ 36.358367] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 36.363552] ? find_held_lock+0x39/0x1d0 [ 36.367606] ? __lock_acquire+0x732/0x4620 [ 36.371818] ? check_noncircular+0x20/0x20 [ 36.376048] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 36.381227] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 36.387086] ? hrtimer_interrupt+0x1d4/0x5f0 [ 36.391465] ? hrtimer_interrupt+0x1d4/0x5f0 [ 36.395865] ? unwind_next_frame.part.6+0x1ae/0xc70 executing program [ 36.400860] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 36.405850] ? unwind_dump+0x4c0/0x4c0 [ 36.409713] ? unwind_dump+0x4c0/0x4c0 [ 36.413610] ? __unwind_start+0x169/0x330 [ 36.417746] ? unwind_get_return_address+0x61/0xa0 [ 36.422664] ? __save_stack_trace+0x61/0xd0 [ 36.426980] ? get_stack_info+0x37/0x150 [ 36.431031] ? update_stack_state+0x225/0x700 [ 36.435512] ? __read_once_size_nocheck.constprop.8+0x10/0x10 [ 36.441371] ? lock_acquire+0x256/0x580 [ 36.445332] ? find_held_lock+0x39/0x1d0 [ 36.449384] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 36.454382] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 36.459377] ? unwind_dump+0x4c0/0x4c0 [ 36.463245] ? unwind_dump+0x4c0/0x4c0 [ 36.467118] ? check_noncircular+0x20/0x20 [ 36.471336] ? pvclock_read_flags+0x160/0x160 [ 36.475811] ? __unwind_start+0x169/0x330 [ 36.479934] ? print_usage_bug+0x480/0x480 [ 36.484151] ? unwind_get_return_address+0x61/0xa0 [ 36.489062] ? __save_stack_trace+0x61/0xd0 [ 36.493365] ? lock_acquire+0x256/0x580 [ 36.497337] ? save_stack_trace+0x16/0x20 [ 36.501463] ? __lock_acquire+0x20fd/0x4620 [ 36.505763] ? vring_use_dma_api+0x7f/0xa0 [ 36.509982] ? vring_unmap_one+0x49/0x3d0 [ 36.514125] ? detach_buf+0x463/0x6a0 [ 36.517909] ? print_usage_bug+0x480/0x480 [ 36.522134] ? virtqueue_get_buf_ctx+0x3b1/0x8b0 [ 36.526867] ? common_interrupt+0x9d/0x9d [ 36.530994] ? detach_buf+0x6a0/0x6a0 [ 36.534778] ? unwind_next_frame.part.6+0x1ae/0xc70 [ 36.539773] virtnet_poll+0x304/0xad0 [ 36.543558] ? receive_buf+0x51f0/0x51f0 [ 36.547591] ? unwind_dump+0x4c0/0x4c0 [ 36.551469] ? mark_held_locks+0xb2/0x100 [ 36.555601] ? net_rx_action+0x49b/0x1910 [ 36.559740] net_rx_action+0x792/0x1910 [ 36.563712] ? napi_complete_done+0x6c0/0x6c0 [ 36.568183] ? save_stack_trace+0x16/0x20 [ 36.572306] ? __lock_acquire+0x20fd/0x4620 [ 36.576625] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 36.581791] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 36.586958] ? check_noncircular+0x20/0x20 [ 36.591169] ? check_noncircular+0x20/0x20 [ 36.595389] ? __lock_is_held+0xbc/0x140 [ 36.599435] ? rcu_read_lock_sched_held+0x108/0x120 [ 36.604433] ? __raise_softirq_irqoff+0x21c/0x2c0 [ 36.609257] ? raise_softirq+0x490/0x490 [ 36.613299] ? lock_downgrade+0x990/0x990 [ 36.617428] ? print_usage_bug+0x480/0x480 [ 36.621639] ? lock_acquire+0x1d5/0x580 [ 36.625586] ? clockevents_program_event+0x163/0x2e0 [ 36.630667] ? trace_hardirqs_off+0xd/0x10 [ 36.634882] ? __napi_schedule+0x25e/0x370 [ 36.639091] ? netdev_info+0x170/0x170 [ 36.642950] ? check_noncircular+0x20/0x20 [ 36.647170] ? check_noncircular+0x20/0x20 [ 36.651378] ? __lock_is_held+0xbc/0x140 [ 36.655426] ? rcu_read_lock_sched_held+0x108/0x120 [ 36.660433] ? __handle_irq_event_percpu+0x308/0x9d0 [ 36.665524] ? __lock_is_held+0xbc/0x140 [ 36.669572] __do_softirq+0x2bb/0xbd0 [ 36.673358] ? __softirqentry_text_start+0x8/0x8 [ 36.678092] ? do_raw_spin_trylock+0x190/0x190 [ 36.682652] ? handle_irq_event_percpu+0x141/0x1b0 [ 36.687563] ? __handle_irq_event_percpu+0x9d0/0x9d0 [ 36.692662] ? _raw_spin_lock+0x32/0x40 [ 36.696621] ? _raw_spin_unlock+0x22/0x30 [ 36.700743] ? handle_edge_irq+0x2b4/0x7c0 [ 36.704963] irq_exit+0x1d3/0x210 [ 36.708392] do_IRQ+0xf6/0x190 [ 36.711562] common_interrupt+0x9d/0x9d [ 36.715507] [ 36.717720] RIP: 0010:lock_acquire+0x256/0x580 [ 36.722271] RSP: 0018:ffff8801c795f1e8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff1e [ 36.729953] RAX: dffffc0000000000 RBX: ffff8801c84b4540 RCX: 0000000000000000 [ 36.737197] RDX: 1ffffffff0b592fd RSI: ffffffff813f36ef RDI: 0000000000000282 [ 36.744439] RBP: ffff8801c795f2e0 R08: ffff8801c795ec60 R09: ffff8801c795ec58 [ 36.751680] R10: ffff8801c795ebd0 R11: 1ffff10039096b3b R12: 1ffff10038f2be43 [ 36.758924] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 [ 36.766199] ? _do_fork+0x1ef/0xfe0 [ 36.769822] ? lock_release+0xd70/0xd70 [ 36.773779] ? pvclock_read_flags+0x160/0x160 [ 36.778269] ? ktime_get_with_offset+0x188/0x420 [ 36.783015] ? kvm_clock_get_cycles+0x25/0x30 [ 36.787489] ? ktime_get_with_offset+0x2c1/0x420 [ 36.792223] fs_reclaim_acquire.part.85+0x24/0x30 [ 36.797045] ? bad_range+0x1e0/0x1e0 [ 36.800744] fs_reclaim_acquire+0x14/0x20 [ 36.804871] kmem_cache_alloc_trace+0x2d/0x750 [ 36.809427] ? trace_hardirqs_on_caller+0x421/0x5c0 [ 36.814414] ? __lockdep_init_map+0xe4/0x650 [ 36.818797] ? __lockdep_init_map+0xe4/0x650 [ 36.823192] lockdep_init_task+0x187/0x210 [ 36.827403] copy_process.part.36+0x16eb/0x4af0 [ 36.832061] ? __cleanup_sighand+0x40/0x40 [ 36.836275] ? print_usage_bug+0x480/0x480 [ 36.840481] ? print_usage_bug+0x480/0x480 [ 36.844698] ? debug_check_no_locks_freed+0x3d0/0x3d0 [ 36.849865] ? mem_cgroup_update_lru_size+0xe0/0xe0 [ 36.854864] ? lock_downgrade+0x990/0x990 [ 36.858994] ? lock_page_memcg+0x3b0/0x3b0 [ 36.863217] ? find_held_lock+0x39/0x1d0 [ 36.867275] ? print_usage_bug+0x480/0x480 [ 36.871484] ? mem_cgroup_css_offline+0x510/0x510 [ 36.876310] ? __lock_is_held+0xbc/0x140 [ 36.880355] ? __lru_cache_add+0x2a4/0x410 [ 36.884566] ? __pagevec_lru_add+0x30/0x30 [ 36.888780] ? get_mem_cgroup_from_mm+0x49b/0x710 [ 36.893604] ? check_noncircular+0x20/0x20 [ 36.897819] ? lock_page_memcg+0x3b0/0x3b0 [ 36.902041] ? __lock_is_held+0xbc/0x140 [ 36.906091] ? lru_cache_add+0x1c7/0x3a0 [ 36.910125] ? get_mem_cgroup_from_mm+0x710/0x710 [ 36.914951] ? lru_cache_add_file+0x20/0x20 [ 36.919254] ? find_held_lock+0x39/0x1d0 [ 36.923320] ? lock_downgrade+0x990/0x990 [ 36.927447] ? lru_cache_add_active_or_unevictable+0x20e/0x540 [ 36.933393] ? add_page_to_unevictable_list+0x730/0x730 [ 36.938729] ? __handle_mm_fault+0x2780/0x39c0 [ 36.943311] ? do_raw_spin_trylock+0x190/0x190 [ 36.947870] ? lock_downgrade+0x990/0x990 [ 36.952018] ? check_noncircular+0x20/0x20 [ 36.956235] ? _raw_spin_unlock+0x22/0x30 [ 36.960362] ? __handle_mm_fault+0x587/0x39c0 [ 36.964863] _do_fork+0x1ef/0xfe0 [ 36.968315] ? fork_idle+0x2d0/0x2d0 [ 36.972035] ? lock_downgrade+0x990/0x990 [ 36.976184] ? handle_mm_fault+0x410/0x8d0 [ 36.980396] ? down_read_trylock+0xdb/0x170 [ 36.984696] ? __do_page_fault+0x2b8/0xb60 [ 36.988913] ? __handle_mm_fault+0x39c0/0x39c0 [ 36.993469] ? vmacache_find+0x61/0x270 [ 36.997422] ? vmacache_update+0xfe/0x130 [ 37.001555] ? up_read+0x1a/0x40 [ 37.004902] ? __do_page_fault+0x35b/0xb60 [ 37.009128] SyS_clone+0x37/0x50 [ 37.012470] ? ptregs_sys_rt_sigreturn+0x10/0x10 [ 37.017199] do_syscall_64+0x26c/0x8c0 [ 37.021065] ? __do_page_fault+0xb60/0xb60 [ 37.025283] ? syscall_return_slowpath+0x500/0x500 [ 37.030197] ? SyS_mmap_pgoff+0x243/0x5f0 [ 37.034321] ? lockdep_sys_exit+0x47/0xf0 [ 37.038442] ? entry_SYSCALL_64_fastpath+0x5/0xbe [ 37.043268] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 37.048115] ? sys_vfork+0x30/0x30 [ 37.051635] entry_SYSCALL64_slow_path+0x25/0x25 [ 37.056372] RIP: 0033:0x4497a9 [ 37.059550] RSP: 002b:00007fff712bfa18 EFLAGS: 00000202 ORIG_RAX: 0000000000000038 [ 37.067253] RAX: ffffffffffffffda RBX: 00007f76c9957700 RCX: 00000000004497a9 [ 37.074505] RDX: 00007f76c99579d0 RSI: 00007f76c9956db0 RDI: 00000000003d0f00 [ 37.081751] RBP: 00007fff712bfad0 R08: 00007f76c9957700 R09: 00007f76c9957700 [ 37.088996] R10: 00007f76c99579d0 R11: 0000000000000202 R12: 0000000000000000 [ 37.096243] R13: 00007fff712bfacf R14: 00007f76c99579c0 R15: 0000000000000000 [ 37.103508]