[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c.
Starting mcstransd: 
[....] Starting file context maintaining daemon: restorecond[?25l[?1c7[ ok 8[?25h[?0c.
[....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c.
[   12.767625] audit: type=1400 audit(1514083137.978:6): avc:  denied  { map } for  pid=3132 comm="bash" path="/bin/bash" dev="sda1" ino=1457 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=system_u:object_r:file_t:s0 tclass=file permissive=1

Debian GNU/Linux 7 syzkaller ttyS0

Warning: Permanently added 'ci-upstream-mmots-kasan-gce-3,10.128.15.245' (ECDSA) to the list of known hosts.
executing program
syzkaller login: [   18.933249] audit: type=1400 audit(1514083144.144:7): avc:  denied  { map } for  pid=3146 comm="syzkaller857924" path="/root/syzkaller857924574" dev="sda1" ino=16481 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1
[   18.938847] ==================================================================
[   18.938860] BUG: KASAN: use-after-free in __lock_acquire+0x3d4d/0x3e00
[   18.938866] Read of size 8 at addr ffff8801c9923d38 by task syzkaller857924/3146
[   18.938867] 
[   18.938874] CPU: 1 PID: 3146 Comm: syzkaller857924 Not tainted 4.15.0-rc4-mm1+ #49
[   18.938878] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.938880] Call Trace:
[   18.938888]  dump_stack+0x194/0x257
[   18.938896]  ? arch_local_irq_restore+0x53/0x53
[   18.938904]  ? show_regs_print_info+0x18/0x18
[   18.938910]  ? print_irqtrace_events+0x270/0x270
[   18.938916]  ? __lock_acquire+0x664/0x3e00
[   18.938923]  ? __lock_acquire+0x3d4d/0x3e00
[   18.938932]  print_address_description+0x73/0x250
[   18.938938]  ? __lock_acquire+0x3d4d/0x3e00
[   18.938944]  kasan_report+0x23b/0x360
[   18.938952]  __asan_report_load8_noabort+0x14/0x20
[   18.938957]  __lock_acquire+0x3d4d/0x3e00
[   18.938963]  ? __lock_acquire+0x664/0x3e00
[   18.938968]  ? lock_downgrade+0x980/0x980
[   18.938974]  ? lock_downgrade+0x980/0x980
[   18.938982]  ? remove_wait_queue+0x81/0x350
[   18.938991]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.938998]  ? __lock_acquire+0x664/0x3e00
[   18.939007]  ? check_noncircular+0x20/0x20
[   18.939020]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.939027]  ? lock_acquire+0x1d5/0x580
[   18.939032]  ? lock_acquire+0x1d5/0x580
[   18.939039]  ? ep_free+0xf4/0x320
[   18.939047]  ? lock_release+0xa40/0xa40
[   18.939054]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.939060]  ? print_irqtrace_events+0x270/0x270
[   18.939067]  ? rcu_note_context_switch+0x710/0x710
[   18.939074]  ? __might_sleep+0x95/0x190
[   18.939080]  ? ep_free+0xf4/0x320
[   18.939087]  ? __mutex_lock+0x16f/0x1a80
[   18.939091]  ? ep_free+0xf4/0x320
[   18.939099]  ? print_irqtrace_events+0x270/0x270
[   18.939103]  ? ep_free+0xf4/0x320
[   18.939112]  lock_acquire+0x1d5/0x580
[   18.939117]  ? lock_acquire+0x1d5/0x580
[   18.939123]  ? remove_wait_queue+0x81/0x350
[   18.939129]  ? __lock_acquire+0x664/0x3e00
[   18.939136]  ? lock_release+0xa40/0xa40
[   18.939146]  ? lock_acquire+0x1d5/0x580
[   18.939151]  ? lock_acquire+0x1d5/0x580
[   18.939157]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.939165]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.939171]  ? remove_wait_queue+0x81/0x350
[   18.939177]  remove_wait_queue+0x81/0x350
[   18.939185]  ? add_wait_queue+0x290/0x290
[   18.939191]  ? rcutorture_record_progress+0x10/0x10
[   18.939201]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.939208]  ? __kernel_text_address+0xd/0x40
[   18.939216]  ? clear_tfile_check_list+0x370/0x370
[   18.939223]  ? check_noncircular+0x20/0x20
[   18.939232]  ? locks_remove_file+0x3fa/0x5a0
[   18.939241]  ep_free+0x13f/0x320
[   18.939248]  ? ep_remove+0x800/0x800
[   18.939253]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.939261]  ? ep_free+0x320/0x320
[   18.939267]  ep_eventpoll_release+0x44/0x60
[   18.939273]  __fput+0x327/0x7e0
[   18.939281]  ? fput+0x140/0x140
[   18.939288]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.939296]  ____fput+0x15/0x20
[   18.939303]  task_work_run+0x199/0x270
[   18.939310]  ? task_work_cancel+0x210/0x210
[   18.939316]  ? _raw_spin_unlock+0x22/0x30
[   18.939322]  ? switch_task_namespaces+0x87/0xc0
[   18.939330]  do_exit+0x9bb/0x1ad0
[   18.939339]  ? binder_ioctl+0x551/0x1417
[   18.939345]  ? mm_update_next_owner+0x930/0x930
[   18.939353]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.939363]  ? avc_ss_reset+0x110/0x110
[   18.939369]  ? mutex_unlock+0xd/0x10
[   18.939375]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.939394]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.939399]  ? up_read+0x1a/0x40
[   18.939406]  ? rcu_note_context_switch+0x710/0x710
[   18.939411]  ? __fd_install+0x288/0x740
[   18.939420]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.939426]  ? do_vfs_ioctl+0x486/0x1520
[   18.939431]  ? _cond_resched+0x14/0x30
[   18.939438]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.939446]  ? selinux_capable+0x40/0x40
[   18.939452]  ? __alloc_fd+0x750/0x750
[   18.939460]  do_group_exit+0x149/0x400
[   18.939467]  ? SyS_exit+0x30/0x30
[   18.939474]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.939481]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.939489]  SyS_exit_group+0x1d/0x20
[   18.939495]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.939500] RIP: 0033:0x4429f8
[   18.939503] RSP: 002b:00007ffe89f10de8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.939509] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.939513] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.939516] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.939520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.939523] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.939531] 
[   18.939534] Allocated by task 3146:
[   18.939540]  save_stack+0x43/0xd0
[   18.939545]  kasan_kmalloc+0xad/0xe0
[   18.939550]  kmem_cache_alloc_trace+0x136/0x750
[   18.939554]  binder_get_thread+0x1cf/0x870
[   18.939558]  binder_poll+0x8c/0x390
[   18.939563]  ep_item_poll.isra.10+0xf2/0x320
[   18.939568]  ep_insert+0x6a2/0x1ac0
[   18.939573]  SyS_epoll_ctl+0x12bf/0x1a80
[   18.939577]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.939579] 
[   18.939581] Freed by task 3146:
[   18.939586]  save_stack+0x43/0xd0
[   18.939591]  kasan_slab_free+0x71/0xc0
[   18.939595]  kfree+0xd6/0x260
[   18.939599]  binder_thread_dec_tmpref+0x27f/0x310
[   18.939604]  binder_thread_release+0x27d/0x540
[   18.939608]  binder_ioctl+0xc02/0x1417
[   18.939612]  do_vfs_ioctl+0x1b1/0x1520
[   18.939616]  SyS_ioctl+0x8f/0xc0
[   18.939621]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.939622] 
[   18.939626] The buggy address belongs to the object at ffff8801c9923c80
[   18.939626]  which belongs to the cache kmalloc-512 of size 512
[   18.939631] The buggy address is located 184 bytes inside of
[   18.939631]  512-byte region [ffff8801c9923c80, ffff8801c9923e80)
[   18.939633] The buggy address belongs to the page:
[   18.939638] page:ffffea00072648c0 count:1 mapcount:0 mapping:ffff8801c9923000 index:0x0
[   18.939643] flags: 0x2fffc0000000100(slab)
[   18.939651] raw: 02fffc0000000100 ffff8801c9923000 0000000000000000 0000000100000006
[   18.939662] raw: ffffea000725eea0 ffffea000725fde0 ffff8801dac00940 0000000000000000
[   18.939665] page dumped because: kasan: bad access detected
[   18.939666] 
[   18.939668] Memory state around the buggy address:
[   18.939672]  ffff8801c9923c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   18.939677]  ffff8801c9923c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.939681] >ffff8801c9923d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.939683]                                         ^
[   18.939688]  ffff8801c9923d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.939692]  ffff8801c9923e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   18.939694] ==================================================================
[   18.939695] Disabling lock debugging due to kernel taint
[   18.939698] Kernel panic - not syncing: panic_on_warn set ...
[   18.939698] 
[   18.939704] CPU: 1 PID: 3146 Comm: syzkaller857924 Tainted: G    B            4.15.0-rc4-mm1+ #49
[   18.939707] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   18.939708] Call Trace:
[   18.939714]  dump_stack+0x194/0x257
[   18.939721]  ? arch_local_irq_restore+0x53/0x53
[   18.939726]  ? kasan_end_report+0x32/0x50
[   18.939732]  ? lock_downgrade+0x980/0x980
[   18.939738]  ? vsnprintf+0x1ed/0x1900
[   18.939744]  ? __lock_acquire+0x3c90/0x3e00
[   18.939750]  panic+0x1e4/0x41c
[   18.939755]  ? refcount_error_report+0x214/0x214
[   18.939762]  ? add_taint+0x40/0x50
[   18.939768]  ? add_taint+0x1c/0x50
[   18.939774]  ? __lock_acquire+0x3d4d/0x3e00
[   18.939780]  kasan_end_report+0x50/0x50
[   18.939786]  kasan_report+0x148/0x360
[   18.939794]  __asan_report_load8_noabort+0x14/0x20
[   18.939800]  __lock_acquire+0x3d4d/0x3e00
[   18.939805]  ? __lock_acquire+0x664/0x3e00
[   18.939811]  ? lock_downgrade+0x980/0x980
[   18.939817]  ? lock_downgrade+0x980/0x980
[   18.939824]  ? remove_wait_queue+0x81/0x350
[   18.939833]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.939839]  ? __lock_acquire+0x664/0x3e00
[   18.939844]  ? check_noncircular+0x20/0x20
[   18.939856]  ? debug_check_no_locks_freed+0x3c0/0x3c0
[   18.939863]  ? lock_acquire+0x1d5/0x580
[   18.939869]  ? lock_acquire+0x1d5/0x580
[   18.939874]  ? ep_free+0xf4/0x320
[   18.939882]  ? lock_release+0xa40/0xa40
[   18.939888]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.939894]  ? print_irqtrace_events+0x270/0x270
[   18.939900]  ? rcu_note_context_switch+0x710/0x710
[   18.939907]  ? __might_sleep+0x95/0x190
[   18.939912]  ? ep_free+0xf4/0x320
[   18.939917]  ? __mutex_lock+0x16f/0x1a80
[   18.939922]  ? ep_free+0xf4/0x320
[   18.939929]  ? print_irqtrace_events+0x270/0x270
[   18.939934]  ? ep_free+0xf4/0x320
[   18.939942]  lock_acquire+0x1d5/0x580
[   18.939947]  ? lock_acquire+0x1d5/0x580
[   18.939953]  ? remove_wait_queue+0x81/0x350
[   18.939959]  ? __lock_acquire+0x664/0x3e00
[   18.939966]  ? lock_release+0xa40/0xa40
[   18.939975]  ? lock_acquire+0x1d5/0x580
[   18.939980]  ? lock_acquire+0x1d5/0x580
[   18.939986]  ? ep_unregister_pollwait.isra.7+0x323/0x590
[   18.939993]  _raw_spin_lock_irqsave+0x96/0xc0
[   18.939999]  ? remove_wait_queue+0x81/0x350
[   18.940005]  remove_wait_queue+0x81/0x350
[   18.940012]  ? add_wait_queue+0x290/0x290
[   18.940018]  ? rcutorture_record_progress+0x10/0x10
[   18.940028]  ep_unregister_pollwait.isra.7+0x18c/0x590
[   18.940034]  ? __kernel_text_address+0xd/0x40
[   18.940042]  ? clear_tfile_check_list+0x370/0x370
[   18.940049]  ? check_noncircular+0x20/0x20
[   18.940057]  ? locks_remove_file+0x3fa/0x5a0
[   18.940066]  ep_free+0x13f/0x320
[   18.940071]  ? ep_remove+0x800/0x800
[   18.940077]  ? fsnotify_first_mark+0x2b0/0x2b0
[   18.940084]  ? ep_free+0x320/0x320
[   18.940090]  ep_eventpoll_release+0x44/0x60
[   18.940096]  __fput+0x327/0x7e0
[   18.940104]  ? fput+0x140/0x140
[   18.940110]  ? _raw_spin_unlock_irq+0x27/0x70
[   18.940118]  ____fput+0x15/0x20
[   18.940124]  task_work_run+0x199/0x270
[   18.940132]  ? task_work_cancel+0x210/0x210
[   18.940138]  ? _raw_spin_unlock+0x22/0x30
[   18.940143]  ? switch_task_namespaces+0x87/0xc0
[   18.940151]  do_exit+0x9bb/0x1ad0
[   18.940158]  ? binder_ioctl+0x551/0x1417
[   18.940163]  ? mm_update_next_owner+0x930/0x930
[   18.940171]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.940179]  ? avc_ss_reset+0x110/0x110
[   18.940184]  ? mutex_unlock+0xd/0x10
[   18.940190]  ? SyS_epoll_ctl+0x30a/0x1a80
[   18.940208]  ? trace_event_raw_event_sched_switch+0x800/0x800
[   18.940213]  ? up_read+0x1a/0x40
[   18.940219]  ? rcu_note_context_switch+0x710/0x710
[   18.940224]  ? __fd_install+0x288/0x740
[   18.940232]  ? binder_ioctl_write_read.isra.38+0xcb0/0xcb0
[   18.940237]  ? do_vfs_ioctl+0x486/0x1520
[   18.940242]  ? _cond_resched+0x14/0x30
[   18.940250]  ? ioctl_preallocate+0x2b0/0x2b0
[   18.940256]  ? selinux_capable+0x40/0x40
[   18.940262]  ? __alloc_fd+0x750/0x750
[   18.940270]  do_group_exit+0x149/0x400
[   18.940277]  ? SyS_exit+0x30/0x30
[   18.940283]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   18.940290]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   18.940297]  SyS_exit_group+0x1d/0x20
[   18.940303]  entry_SYSCALL_64_fastpath+0x1f/0x96
[   18.940306] RIP: 0033:0x4429f8
[   18.940309] RSP: 002b:00007ffe89f10de8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[   18.940315] RAX: ffffffffffffffda RBX: 00000000004002e0 RCX: 00000000004429f8
[   18.940318] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[   18.940322] RBP: 00000000006ce018 R08: 00000000000000e7 R09: ffffffffffffffd0
[   18.940325] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a40
[   18.940328] R13: 0000000000401ad0 R14: 0000000000000000 R15: 0000000000000000
[   18.959578] Dumping ftrace buffer:
[   18.959581]    (ftrace buffer empty)
[   18.959584] Kernel Offset: disabled
[   20.082401] Rebooting in 86400 seconds..