[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   11.898466] audit: type=1400 audit(1514237783.872:6): avc:  denied  { map } for  pid=3130 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-kasan-gce-2,10.128.0.8' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   20.492549] audit: type=1400 audit(1514237792.466:7): avc:  denied  { map } for  pid=3144 comm="syzkaller929061" path="/root/syzkaller929061525" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   20.498564] ==================================================================
[   20.498583] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   20.498589] Read of size 8 at addr ffff8801c97453b0 by task syzkaller929061/3144
[   20.498590] 
[   20.498598] CPU: 0 PID: 3144 Comm: syzkaller929061 Not tainted 4.15.0-rc5+ #237
[   20.498601] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   20.498603] Call Trace:
[   20.498614]  dump_stack+0x194/0x257
[   20.498622]  ? arch_local_irq_restore+0x53/0x53
[   20.498631]  ? show_regs_print_info+0x18/0x18
[   20.498637]  ? print_irqtrace_events+0x270/0x270
[   20.498643]  ? __lock_acquire+0x664/0x3e00
[   20.498656]  ? __lock_acquire+0x3d4d/0x3e00
[   20.498664]  print_address_description+0x73/0x250
[   20.498671]  ? __lock_acquire+0x3d4d/0x3e00
[   20.498676]  kasan_report+0x25b/0x340
[   20.498685]  __asan_report_load8_noabort+0x14/0x20
[   20.498690]  __lock_acquire+0x3d4d/0x3e00
[   20.498696]  ? __lock_acquire+0x664/0x3e00
[   20.498701]  ? lock_downgrade+0x980/0x980
[   20.498707]  ? lock_downgrade+0x980/0x980
[   20.498715]  ? remove_wait_queue+0x81/0x350
[   20.498724]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   20.498731]  ? __lock_acquire+0x664/0x3e00
[   20.498736]  ? check_noncircular+0x20/0x20
[   20.498748]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   20.498755]  ? lock_acquire+0x1d5/0x580
[   20.498761]  ? lock_acquire+0x1d5/0x580
[   20.498767]  ? ep_free+0xf4/0x320
[   20.498776]  ? lock_release+0xa40/0xa40
[   20.498784]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   20.498790]  ? print_irqtrace_events+0x270/0x270
[   20.498798]  ? rcu_note_context_switch+0x710/0x710
[   20.498806]  ? __might_sleep+0x95/0x190
[   20.498811]  ? ep_free+0xf4/0x320
[   20.498818]  ? __mutex_lock+0x16f/0x1a80
[   20.498822]  ? ep_free+0xf4/0x320
[   20.498829]  ? print_irqtrace_events+0x270/0x270
[   20.498834]  ? ep_free+0xf4/0x320
[   20.498842]  lock_acquire+0x1d5/0x580
[   20.498847]  ? lock_acquire+0x1d5/0x580
[   20.498853]  ? remove_wait_queue+0x81/0x350
[   20.498859]  ? __lock_acquire+0x664/0x3e00
[   20.498866]  ? lock_release+0xa40/0xa40
[   20.498875]  ? lock_acquire+0x1d5/0x580
[   20.498880]  ? lock_acquire+0x1d5/0x580
[   20.498886]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   20.498895]  _raw_spin_lock_irqsave+0x96/0xc0
[   20.498900]  ? remove_wait_queue+0x81/0x350
[   20.498906]  remove_wait_queue+0x81/0x350
[   20.498914]  ? add_wait_queue+0x290/0x290
[   20.498920]  ? rcutorture_record_progress+0x10/0x10
[   20.498929]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   20.498939]  ? __kernel_text_address+0xd/0x40
[   20.498947]  ? clear_tfile_check_list+0x370/0x370
[   20.498954]  ? check_noncircular+0x20/0x20
[   20.498963]  ? locks_remove_file+0x3fa/0x5a0
[   20.498972]  ep_free+0x13f/0x320
[   20.498977]  ? ep_remove+0x800/0x800
[   20.498985]  ? fsnotify_first_mark+0x2b0/0x2b0
[   20.498992]  ? ep_free+0x320/0x320
[   20.498998]  ep_eventpoll_release+0x44/0x60
[   20.499008]  __fput+0x327/0x7e0
[   20.499016]  ? fput+0x140/0x140
[   20.499023]  ? _raw_spin_unlock_irq+0x27/0x70
[   20.499031]  ____fput+0x15/0x20
[   20.499037]  task_work_run+0x199/0x270
[   20.499045]  ? task_work_cancel+0x210/0x210
[   20.499051]  ? _raw_spin_unlock+0x22/0x30
[   20.499057]  ? switch_task_namespaces+0x87/0xc0
[   20.499066]  do_exit+0x9bb/0x1ad0
[   20.499075]  ? binder_ioctl+0x4a1/0x1417
[   20.499081]  ? mm_update_next_owner+0x930/0x930
[   20.499089]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   20.499100]  ? avc_ss_reset+0x110/0x110
[   20.499106]  ? mutex_unlock+0xd/0x10
[   20.499111]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   20.499130]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   20.499135]  ? up_read+0x1a/0x40
[   20.499141]  ? rcu_note_context_switch+0x710/0x710
[   20.499148]  ? __fd_install+0x288/0x740
[   20.499157]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   20.499163]  ? do_vfs_ioctl+0x486/0x1520
[   20.499171]  ? _cond_resched+0x14/0x30
[   20.499180]  ? ioctl_preallocate+0x2b0/0x2b0
[   20.499187]  ? selinux_capable+0x40/0x40
[   20.499194]  ? __alloc_fd+0x750/0x750
[   20.499202]  do_group_exit+0x149/0x400
[   20.499209]  ? SyS_exit+0x30/0x30
[   20.499215]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.499223]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   20.499230]  SyS_exit_group+0x1d/0x20
[   20.499237]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   20.499242] RIP: 0033:0x4429f8
[   20.499245] RSP: 002b:00007ffcaa252918 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   20.499252] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   20.499255] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   20.499259] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   20.499262] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   20.499265] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   20.499273] 
[   20.499276] Allocated by task 3144:
[   20.499282]  save_stack+0x43/0xd0
[   20.499286]  kasan_kmalloc+0xad/0xe0
[   20.499295]  kmem_cache_alloc_trace+0x136/0x750
[   20.499301]  binder_get_thread+0x1cf/0x870
[   20.499305]  binder_poll+0x8c/0x390
[   20.499309]  ep_item_poll.isra.10+0xec/0x320
[   20.499314]  ep_insert+0x6a3/0x1b10
[   20.499318]  SyS_epoll_ctl+0x12e4/0x1ab0
[   20.499323]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   20.499324] 
[   20.499326] Freed by task 3144:
[   20.499331]  save_stack+0x43/0xd0
[   20.499335]  kasan_slab_free+0x71/0xc0
[   20.499339]  kfree+0xd6/0x260
[   20.499345]  binder_thread_dec_tmpref+0x27f/0x310
[   20.499350]  binder_thread_release+0x27d/0x540
[   20.499355]  binder_ioctl+0xc02/0x1417
[   20.499360]  do_vfs_ioctl+0x1b1/0x1520
[   20.499365]  SyS_ioctl+0x8f/0xc0
[   20.499370]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   20.499371] 
[   20.499375] The buggy address belongs to the object at ffff8801c9745300
[   20.499375]  which belongs to the cache kmalloc-512 of size 512
[   20.499380] The buggy address is located 176 bytes inside of
[   20.499380]  512-byte region [ffff8801c9745300, ffff8801c9745500)
[   20.499382] The buggy address belongs to the page:
[   20.499388] page:00000000055711fa count:1 mapcount:0 mapping:00000000f1be22b4 index:0x0
[   20.499393] flags: 0x2fffc0000000100(slab)
[   20.499402] raw: 02fffc0000000100 ffff8801c9745080 0000000000000000 0000000100000006
[   20.499408] raw: ffffea000727bda0 ffffea00072561a0 ffff8801db000940 0000000000000000
[   20.499410] page dumped because: kasan: bad access detected
[   20.499412] 
[   20.499413] Memory state around the buggy address:
[   20.499418]  ffff8801c9745280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.499423]  ffff8801c9745300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.499427] >ffff8801c9745380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.499429]                                      ^
[   20.499433]  ffff8801c9745400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.499437]  ffff8801c9745480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   20.499439] ==================================================================
[   20.499441] Disabling lock debugging due to kernel taint
[   20.499445] Kernel panic - not syncing: panic_on_warn set ...
[   20.499445] 
[   20.499451] CPU: 0 PID: 3144 Comm: syzkaller929061 Tainted: G    B            4.15.0-rc5+ #237
[   20.499454] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   20.499455] Call Trace:
[   20.499461]  dump_stack+0x194/0x257
[   20.499468]  ? arch_local_irq_restore+0x53/0x53
[   20.499473]  ? kasan_end_report+0x32/0x50
[   20.499479]  ? lock_downgrade+0x980/0x980
[   20.499485]  ? vsnprintf+0x1ed/0x1900
[   20.499491]  ? __lock_acquire+0x3cd0/0x3e00
[   20.499496]  panic+0x1e4/0x41c
[   20.499502]  ? refcount_error_report+0x214/0x214
[   20.499509]  ? add_taint+0x40/0x50
[   20.499514]  ? add_taint+0x1c/0x50
[   20.499521]  ? __lock_acquire+0x3d4d/0x3e00
[   20.499526]  kasan_end_report+0x50/0x50
[   20.499532]  kasan_report+0x144/0x340
[   20.499539]  __asan_report_load8_noabort+0x14/0x20
[   20.499545]  __lock_acquire+0x3d4d/0x3e00
[   20.499550]  ? __lock_acquire+0x664/0x3e00
[   20.499556]  ? lock_downgrade+0x980/0x980
[   20.499561]  ? lock_downgrade+0x980/0x980
[   20.499568]  ? remove_wait_queue+0x81/0x350
[   20.499577]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   20.499583]  ? __lock_acquire+0x664/0x3e00
[   20.499588]  ? check_noncircular+0x20/0x20
[   20.499600]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   20.499606]  ? lock_acquire+0x1d5/0x580
[   20.499612]  ? lock_acquire+0x1d5/0x580
[   20.499617]  ? ep_free+0xf4/0x320
[   20.499625]  ? lock_release+0xa40/0xa40
[   20.499630]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   20.499636]  ? print_irqtrace_events+0x270/0x270
[   20.499642]  ? rcu_note_context_switch+0x710/0x710
[   20.499654]  ? __might_sleep+0x95/0x190
[   20.499660]  ? ep_free+0xf4/0x320
[   20.499665]  ? __mutex_lock+0x16f/0x1a80
[   20.499669]  ? ep_free+0xf4/0x320
[   20.499676]  ? print_irqtrace_events+0x270/0x270
[   20.499680]  ? ep_free+0xf4/0x320
[   20.499688]  lock_acquire+0x1d5/0x580
[   20.499693]  ? lock_acquire+0x1d5/0x580
[   20.499699]  ? remove_wait_queue+0x81/0x350
[   20.499705]  ? __lock_acquire+0x664/0x3e00
[   20.499712]  ? lock_release+0xa40/0xa40
[   20.499721]  ? lock_acquire+0x1d5/0x580
[   20.499726]  ? lock_acquire+0x1d5/0x580
[   20.499731]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   20.499738]  _raw_spin_lock_irqsave+0x96/0xc0
[   20.499744]  ? remove_wait_queue+0x81/0x350
[   20.499750]  remove_wait_queue+0x81/0x350
[   20.499758]  ? add_wait_queue+0x290/0x290
[   20.499763]  ? rcutorture_record_progress+0x10/0x10
[   20.499773]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   20.499779]  ? __kernel_text_address+0xd/0x40
[   20.499787]  ? clear_tfile_check_list+0x370/0x370
[   20.499794]  ? check_noncircular+0x20/0x20
[   20.499801]  ? locks_remove_file+0x3fa/0x5a0
[   20.499810]  ep_free+0x13f/0x320
[   20.499815]  ? ep_remove+0x800/0x800
[   20.499821]  ? fsnotify_first_mark+0x2b0/0x2b0
[   20.499828]  ? ep_free+0x320/0x320
[   20.499834]  ep_eventpoll_release+0x44/0x60
[   20.499839]  __fput+0x327/0x7e0
[   20.499847]  ? fput+0x140/0x140
[   20.499853]  ? _raw_spin_unlock_irq+0x27/0x70
[   20.499861]  ____fput+0x15/0x20
[   20.499867]  task_work_run+0x199/0x270
[   20.499875]  ? task_work_cancel+0x210/0x210
[   20.499880]  ? _raw_spin_unlock+0x22/0x30
[   20.499886]  ? switch_task_namespaces+0x87/0xc0
[   20.499893]  do_exit+0x9bb/0x1ad0
[   20.499900]  ? binder_ioctl+0x4a1/0x1417
[   20.499906]  ? mm_update_next_owner+0x930/0x930
[   20.499914]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   20.499923]  ? avc_ss_reset+0x110/0x110
[   20.499928]  ? mutex_unlock+0xd/0x10
[   20.499933]  ? SyS_epoll_ctl+0x30a/0x1ab0
[   20.499951]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   20.499956]  ? up_read+0x1a/0x40
[   20.499962]  ? rcu_note_context_switch+0x710/0x710
[   20.499968]  ? __fd_install+0x288/0x740
[   20.499976]  ? binder_ioctl_write_read.isra.41+0xcb0/0xcb0
[   20.499982]  ? do_vfs_ioctl+0x486/0x1520
[   20.499987]  ? _cond_resched+0x14/0x30
[   20.499996]  ? ioctl_preallocate+0x2b0/0x2b0
[   20.500002]  ? selinux_capable+0x40/0x40
[   20.500009]  ? __alloc_fd+0x750/0x750
[   20.500017]  do_group_exit+0x149/0x400
[   20.500023]  ? SyS_exit+0x30/0x30
[   20.500030]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   20.500036]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   20.500044]  SyS_exit_group+0x1d/0x20
[   20.500050]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   20.500053] RIP: 0033:0x4429f8
[   20.500056] RSP: 002b:00007ffcaa252918 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   20.500062] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   20.500065] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   20.500069] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   20.500072] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   20.500075] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   20.518893] Dumping ftrace buffer:
[   20.518896]    (ftrace buffer empty)
[   20.518899] Kernel Offset: disabled
[   21.641355] Rebooting in 86400 seconds..